Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    773s
  • max time network
    733s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/02/2024, 00:15

General

  • Target

    http://google.com

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 40 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 20 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2508
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fefd46f8,0x7ff8fefd4708,0x7ff8fefd4718
      2⤵
        PID:4936
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:752
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
        2⤵
          PID:2800
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
          2⤵
            PID:2088
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
            2⤵
              PID:4740
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
              2⤵
                PID:1788
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
                2⤵
                  PID:2352
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
                  2⤵
                    PID:1600
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
                    2⤵
                      PID:1676
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
                      2⤵
                        PID:4020
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
                        2⤵
                          PID:436
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
                          2⤵
                            PID:228
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4628
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
                            2⤵
                              PID:2576
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
                              2⤵
                                PID:5108
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
                                2⤵
                                  PID:3636
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
                                  2⤵
                                    PID:4864
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
                                    2⤵
                                      PID:4516
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
                                      2⤵
                                        PID:4140
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
                                        2⤵
                                          PID:2216
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
                                          2⤵
                                            PID:4428
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
                                            2⤵
                                              PID:3400
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
                                              2⤵
                                                PID:3384
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6632 /prefetch:1
                                                2⤵
                                                  PID:3968
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
                                                  2⤵
                                                    PID:3528
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
                                                    2⤵
                                                      PID:1724
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
                                                      2⤵
                                                        PID:4456
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
                                                        2⤵
                                                          PID:2208
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
                                                          2⤵
                                                            PID:2344
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
                                                            2⤵
                                                              PID:5192
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
                                                              2⤵
                                                                PID:5660
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:1
                                                                2⤵
                                                                  PID:5668
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
                                                                  2⤵
                                                                    PID:5756
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8236 /prefetch:1
                                                                    2⤵
                                                                      PID:5768
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
                                                                      2⤵
                                                                        PID:5932
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8476 /prefetch:1
                                                                        2⤵
                                                                          PID:5948
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8100 /prefetch:1
                                                                          2⤵
                                                                            PID:5152
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
                                                                            2⤵
                                                                              PID:808
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
                                                                              2⤵
                                                                                PID:5472
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:1
                                                                                2⤵
                                                                                  PID:5492
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2752 /prefetch:1
                                                                                  2⤵
                                                                                    PID:1568
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8744 /prefetch:1
                                                                                    2⤵
                                                                                      PID:1948
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3316 /prefetch:8
                                                                                      2⤵
                                                                                        PID:1884
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
                                                                                        2⤵
                                                                                          PID:232
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9056 /prefetch:1
                                                                                          2⤵
                                                                                            PID:4140
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8160 /prefetch:1
                                                                                            2⤵
                                                                                              PID:4916
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,9925617920847958469,13422961323751878232,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
                                                                                              2⤵
                                                                                                PID:5168
                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                              1⤵
                                                                                                PID:3244
                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                1⤵
                                                                                                  PID:4700
                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x508 0x510
                                                                                                  1⤵
                                                                                                    PID:5632
                                                                                                  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                                                    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\ResetBackup.xlsm"
                                                                                                    1⤵
                                                                                                    • Checks processor information in registry
                                                                                                    • Enumerates system info in registry
                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:6112
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                                                    1⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:5288
                                                                                                    • C:\Windows\system32\dashost.exe
                                                                                                      dashost.exe {6cbb54fa-a3ec-4eea-a9b157211cd384e3}
                                                                                                      2⤵
                                                                                                        PID:2096
                                                                                                    • C:\Windows\System32\cleanmgr.exe
                                                                                                      "C:\Windows\System32\cleanmgr.exe" /D C
                                                                                                      1⤵
                                                                                                      • Drops file in System32 directory
                                                                                                      • Drops file in Windows directory
                                                                                                      • Checks SCSI registry key(s)
                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                      PID:6000
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\62FA08EA-7B58-4147-8E3E-1CEC78ACE5C6\dismhost.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\62FA08EA-7B58-4147-8E3E-1CEC78ACE5C6\dismhost.exe {EDC726D9-AEB6-400F-85CD-68E5188143A6}
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Loads dropped DLL
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:6028
                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                      1⤵
                                                                                                        PID:2004
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                                                                        1⤵
                                                                                                        • Enumerates system info in registry
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                        PID:1332
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8fefd46f8,0x7ff8fefd4708,0x7ff8fefd4718
                                                                                                          2⤵
                                                                                                            PID:4888
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
                                                                                                            2⤵
                                                                                                              PID:1660
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
                                                                                                              2⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:2384
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:2668
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:4176
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:1868
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:2904
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:1628
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
                                                                                                                        2⤵
                                                                                                                        • Modifies registry class
                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                        PID:2612
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 /prefetch:8
                                                                                                                        2⤵
                                                                                                                          PID:3932
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 /prefetch:8
                                                                                                                          2⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:2476
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:5092
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:6040
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:3460
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,13649493977212118553,16090954751441085820,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4224 /prefetch:2
                                                                                                                                2⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:3504
                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:2884
                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:5772
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  "C:\Windows\system32\cmd.exe"
                                                                                                                                  1⤵
                                                                                                                                    PID:4560
                                                                                                                                    • C:\Windows\system32\takeown.exe
                                                                                                                                      takeown /f C:\Windows\System32
                                                                                                                                      2⤵
                                                                                                                                      • Modifies file permissions
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4472
                                                                                                                                    • C:\Windows\system32\cacls.exe
                                                                                                                                      cacls C:\Windows\System32
                                                                                                                                      2⤵
                                                                                                                                        PID:3352
                                                                                                                                      • C:\Windows\system32\cacls.exe
                                                                                                                                        cacls C:\Windows\System32
                                                                                                                                        2⤵
                                                                                                                                          PID:808
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                                                                                                        1⤵
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                        PID:2396
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8fefd46f8,0x7ff8fefd4708,0x7ff8fefd4718
                                                                                                                                          2⤵
                                                                                                                                            PID:1880
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
                                                                                                                                            2⤵
                                                                                                                                              PID:3960
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
                                                                                                                                              2⤵
                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                              PID:1168
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
                                                                                                                                              2⤵
                                                                                                                                                PID:2260
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:3652
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1180
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5060
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2004
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1992
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5580
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3068
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:4744
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4496
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5040
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3196
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:3048
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:912
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4664
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5940
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6236 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5992
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7392 /prefetch:8
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3580
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7392 /prefetch:8
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                  PID:3364
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3200
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5616
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4012
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,9130954095833173608,6698522948728550519,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5592
                                                                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5216
                                                                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:1900
                                                                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:4480
                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:1064
                                                                                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                                                                                              C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              PID:4708
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                              PID:5668
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                              PID:5192
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                              PID:3048
                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                              PID:4440

                                                                                                                                                                                            Network

                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                            Downloads

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9d52f5c8-d9f9-4eb6-91db-1313d80b67e8.tmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              11KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              7d7cde2e6a73113616ceeb70e3dbda74

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a433566af44f6be9a040b93fb5f10dc4d8da479b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              10666d55e585f4b4c975a43ef1b549b92d3d0af16d4e82d769fc5c77105bf867

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3a70cd69b95763cc8121e6c0d822e77abd202e2105576625d1b63c39527e40b2982a68fc930c7d671f59c34a5b61d9a64c92bdd084e5781301bc4e34a9507b94

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              152B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              23b6b1c4e66d52a1ca79bb725ec02063

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              3e51313184ad63ae75a65ab4d94d314849192db4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8d5bad84b874bf8b3bade9718f6b9c4a1a54d87edd53b347081d98b4a135f7bd

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              9a2cb19930edde1fbdb0954c0c0048b6b007457126dd72cd684930ad3f12664418817b80d59c0a0201010ab8d583ba2cab5a1a37135e2d34bc4d7c64c8a7020c

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              152B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              68629c91994bb2aa412aac50066174b5

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              c1cfa8bdde3012ccd3f253cb2ae08cb9938263bb

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5cee89c220f168d58a9667e5308a956598dea74c85ed679e491b8b90fc7b2298

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              27566abdb6954fdbce5e8b49430bd0a2df431fc98fdecfaa0021b9d037d8de1a2783ce5a346c0627c44932277c75ca4ec1681f146aab788b3c55ff57e737718f

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              152B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1f6d41bf10dc1ec1ca4e14d350bbc0b1

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              7a62b23dc3c19e16930b5108d209c4ec937d7dfb

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              35947f71e9cd4bda79e78d028d025dff5fe99c07ea9c767e487ca45d33a5c770

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              046d6c2193a89f4b1b7f932730a0fc72e9fc95fbdb5514435a3e2a73415a105e4f6fa7d536ae6b24638a6aa97beb5c8777e03f597bb4bc928fa8b364b7192a13

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              152B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4254f7a8438af12de575e00b22651d6c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a3c7bde09221129451a7bb42c1707f64b178e573

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              7f55f63c6b77511999eee973415c1f313f81bc0533a36b041820dd4e84f9879b

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e6a3244139cd6e09cef7dab531bff674847c7ca77218bd1f971aa9bf733a253ac311571b8d6a3fe13e13da4f506fec413f3b345a3429e09d7ceb821a7017ec70

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\490ce825-b103-4620-9b47-c103b7b300a7.tmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              195KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              873734b55d4c7d35a177c8318b0caec7

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              469b913b09ea5b55e60098c95120cc9b935ddb28

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4ee3aa3dc43cb3ef3f6bfb91ed8214659e9c2600a45bee9728ebbcb6f33b088d

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              24f05ed981e994475879ca2221b6948418c4412063b9c07f46b8de581047ddd5d73401562fa9ee54d4ce5f97a6288c54eac5de0ca29b1bb5797bdac5a1b30308

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              40KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              cdfa622961c59f12e6fae8a10859c247

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              9bbb49f8097e6352c5aa0eaa23d357fff13a43b4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              ac5c09f244edd3eb82ea33e256367f6d0687843d123635d4bde336fdb8a5e8bc

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              668ae2725cc0f4a152059c940f33d4a090b622410dc5964793fa2f18b01c560d20751d9bc80769b21439d44d9d52835fcb3545a7dbab67d7da865316505efa40

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              126KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              c74036976f355462580c618bde1972ce

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              5cf7350afd17a4646583a01bda48cc7db9f3ab11

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              468e3b79344f5192fd5244e1122d92aa9ba318cd666a4a23f56cafff7137bdbe

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              019f77674e710dbc2247dcb21db92834e62bd348243bdb516e44bb8fb84fe4dd6ca8a77270259a1dbc92831874a35cd6e2f4e73da16f510cc9dbece1b38ce2e7

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              35KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              a4d33b403041d8a0c339b7d3071d6bfb

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              530fd360c02999a12dddd466b5df02a3e32ac201

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              f114c3f3b5398edf770f85e6c1d38d6176d9649ebc9507f5f2d7c3ce030537b0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              8c6b8efafc56bcc7b9253f741a5f916d17655d175481e8dfa5c104da4c77e7318aaf023a7626f52c2e0b1577cd53584963ca29125bffd7a1a85792ba158928c4

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              26KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              2acfb73fd2df022a7dad5595adef5bda

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              939b803ea641bd427b7599f92a816262e7a5bf48

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3d4610a2ab69d08e54685d0d3cfcf03ec663bacff8cc89a1e0a2904a7769e641

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5978a8866bbb30d409f728c4cc1081af19e3dcaedf2e4f0e1d9e40b75c0e80ecd6474cff4204114716f30ac832bfdb6787726caf504d2305332f151664d3e15d

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              78KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f3e6697902773ca97e32a62ab8b8b3e8

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              d1fd8ba462ca2689c042180c312208616b630c32

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              38f727f0f31d62c93d482ca209551103df8a842709d1b31c8332f08fdf22a186

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              355be915fa1b5b4aaf8bd5754cff21a560df19c3a1a8325151244d004f793f0bb853fe858db7e382926fad32ad3061a347fff1f40fc305a26a43482cac7e083d

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              156KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              e92470512b8d45e106f6c687c2e557c9

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              ca0612202ba01609400c0c0f17a285019296e667

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              bf252ddb0322282cf6f93762ecbae5495b634fd00120e9f5f562c17ba2e1a725

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              fcf3ed691bb5aee1978ff22499d6adad49a4fd4e78c73899614db7185dff739202e5d8bd92f1638dbbd888a61a578cde382184664c74667d937d20ee05539f12

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              79KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              036e0d798c6f86b77f62b3239f3fec5b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              77a9ba491feab285c4ee92b76ffc97801dc23052

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0f9052572b70ba126b59110dc44e8e4f85cbc1cbeafa266c2798490eb5ae8d86

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              9b8e53f38e112a8d149dde731d08dde05fd6c0708d40797fe134221454c14272c2e907a6f05691ffe9d0fddf68c273bdff7d2831313b42ca0edcbe04910c5c38

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              21KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              68d6c2571b31b2aec684df15d90a7d12

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              81b540636375d8648d30839a810f73907923d1db

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              33e3503ef3a7dc205b9a36025f8ec534daad28ae8773c930c245d463d250f472

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              80ec5de9098f1d76afa04810a081730c2794c981114f9d750be0faa6c50869d451996b5f62bbbea1e4aa7b369c0a9c3cf652d1a84a1681ddba0797a8f71fd00a

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              19KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              2a39f133a8af87dc3b845832ff6d30cb

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              e67bba16969705430f54e65ad0a241ff987aa273

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0d4451ade7ff63c59585c3637be283849dedd52d49886c6a7e73ec1364337ad4

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              45d828b3a0f890c5da32765549f5133ef074a5be630ffd0b24f712cccd6677f76ea134aeafb3d5a59fcd405cec3c36eca5dbf6ddd15c712cd2ed70c2d4882d96

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              87KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              27ebb57ca80d9efd1d7b2bb174af090f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              527a35fa8eb34124d8bdc9bee973de676977637d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              866c21d6cada368ff5a8049cb94a899b547fc763068036aacf94be7b24a2a40e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              230f0a48bcfe8c8552291b9fe4ff3f0a26da2903959478095b906b727ac97f6ee8105403671e58cc323d74ef7208d2cbb6d3f60185d952a0b3565cd1ce3fdd66

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              84KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              19b6efdb34844d71cb2e125bc9bcec35

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              0fb5e692af73f3a8ce4d2f1fb33831af776d6710

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              7964908ee857726946b361277588a35c5d454130ecd840e40d781f5b5e62a34d

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ad640b3c5e6e4804c230a3ab8445a43eb14c6c91caf461fbfc04b8d82caf7c1d31be434402793e2b2e2726e4c80f8443d6806eff7e855950066cfa747e9174a2

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              41KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              a571047206b4f87ae95ffb8cf806d547

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              0e3b92e284a0646a49c9a478c72872b976dbf193

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c3e8ec43c6d4ac1f7ac9ef25f14cfbddcb3815ab1aaf01a4a01064f9ac2835e4

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              c25f61e321f1b0d739310535d497bb445f2161b93d8180e2f7d33831da617d9aef33aaca438c9bcca48f5884511ef8785ec95e9aa1457c062928f9d34c7870d4

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              55KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6c8c6a48353d4681a1128dd769b8057b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6b04966adb45735b73c4c8f4f4cb9b495e7d2528

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              9afe9e34e17652b942296114b037437f57a343edab8dfa054fb0253f49b2a10c

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d09646cb6a23e538a1b8603af8baff6c32dd615eef40d41d8485f25751887f37182670711f6740bfd3136f93710a0abeb5e8268735b3bb46517b34d04d07ecd1

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1024KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              771cf1946c8fa50333342d02f357379d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              b19f3aaf757411a2a23362eddac20b359f94c56f

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              ecbb91c4a9012cc004bb4f30a40612c2e6f8128028ccdbdce54f6e081c6258a7

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              04633317a546997192364dd2d21f675d9a35a3ad2d6040cf1fd30c895f8c408ee4de1abe50ba7f1c5c09eff0244f13b3d5623ecb0b13b34c4ecef9b31eedf472

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\08cc782c4752db7a_0

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              253B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5350ffc6a99017bc7120bdeba2def510

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              1557cca4405b49bf769477cfbfbe363f51b76f9a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              ddd5d34ec5bc03ea4f3033225e81d215a87abfc5517bf68c18beee1d438b29c6

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              cc770c90adaff027251bd35fbdf39536bf76e13f20922017b63191d1267e4cc230f443bc7485baf876eec66b577093880ff6451cd5d14926e420eb060bc91fc0

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d868f894f5e7886a_0

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              fe2e8c62f7eea71f22469d30166b9aa2

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              068cb0e57a68333b1b675cd928b3a83e1260df46

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              095ddb4e04a5c1b6a90bdbad656e996ac3b0e8b2b0d54cf2bc1ec58a8caf3a90

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              834678e6a031289bc400766e8b60b0fb01eeaf8b8b5f899b77c414dd57fa4a4795916d04653b7bbec201003a00f8c68dc06e8c17de682053552d37be359beef0

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              9bb5a169dab09216e4828e9b92fb44b5

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              3c2c6048cb6a230b2ef245c137df394d6583e42f

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5f14d05ce94c6837f57525bb777d0988ec1c035f812007907a3ef9cbfddc6244

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              53e60c8e92e8aaf2cc1dd96c6c70ebdaf13a05375bf22c7b9fcba7ba40311e800f6535008b8fc98fd9c736167af6eb95a951f84032e05c811885d19a23a18a6a

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              87f704b8470fc3435032461e0163e502

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              e5c825e5228ff0a248e1a4b04b51e7887eb6df97

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0771f1e269f23e77bdccbe5e759582e605188d6c63ae3983f386a8c92bd1421e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              6c836a425be457a5e61738988bbedf577de8bd7a79d0b582aed61caf47b0443d240043f503d7c9dd8ad22141933c9bf6484b881e37fb5f764c6d9d0dbe6814c4

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              264KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              92644297f2fb1e736820a8c26fbb883b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a5b94c967ca3f9b44e949ee13060dca2deda2d8b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              f93250c87bfff7ff117e1329cfa960f222284a1c0fc547e74c919dca221166f1

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              f219fbf61ea46055167c15b19287ce218299d16d3d5f03e12a9c860344acf73549400f0d1424eac27d2bcba1c9e3cf548955da263bce3848d9eb4160111d31ee

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              12KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0e83e588171f0d6b7b3f177cdf691a26

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              cd37e9f0510f68c96b25663560ca3e5ef194a7f8

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              713da4df5937eaf48824f4f90213539d9cb7675978f452674bdccf708283967e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              069942c955ab406409d61ee8de25d75dee5a1e395eb7bbf82cc6d2f5bbe0f9d84f4fb0655ddbd7ccb90def1c8c5613b1eccc5af668a57fde715bf65cb15681ee

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              3KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              a07469f96a8c8c533bc41829f5016261

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f2d413d114edd8e2e1c34c59f91818661e0d35cc

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              055385bdb917994159bb9b9305cf10c8004033f4ee5e56011075c40afa7ecdf5

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              253dd15225594e0b0b58c0ce8ea23fac5aff084b84945aa43b205c51fc34df37fb0884454fe471867ca6a9714e727888c838251e2bbfac82e1eb97ad35c83643

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              3KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              9ada94acbedc89ed2f1a2984ad3d7d53

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              d7ec279bdde6cb8305fa0aac577dede9f21bc010

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              244563478c86e87f86afa2da42d0af73834af26694dc6d7ca2d4cb8312209daf

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e3c3da45ff0b5ac5bb1374b37d880e34a4f91df44e7bbd04a02d9fb811bb0997b7369f8e68e44235b701d49e8ec0f73ac205414573e23ae35f9900da8f01776f

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              48a8cb144ef10dbb15cc1a5cb2032032

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a9c87a3a0eb95c972a75ef51aa38dfed5e898f43

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5e7e0e47687c07172f7f21823ad84a6292f9dd298bc5b01d74d56a0c98c21548

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              36f22083e939f1c29b32663f7d5e4ca11332a8e4173265e2faf641f6a5f14f830680c514fa438eb27cec01179072e3cf43d9452c4f546999623557e7cb3033c7

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              10KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              10c777e05c4480c15a6c7db6ebb16f10

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              82ebdde570a83f9d10836af72709203962040666

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              cf087a29e885f59072c5442afe59b47d2832c605bb016400c80f872f85e2266f

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              3ff06702312529b36941f5bf5f0cd3b62b9b8f5d361e002496026c08ab6b8e20ec22f9ab60c9c02bd76447bf6e2fa48315f009b17a18b582977f60680158588e

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              13KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0bc1fcfea288faa47f35432138e05fff

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              547f2eb8617b2f09d211dff78e7141914a993055

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4873719d1c51da8e7b3a41eeb12c042390348792c11cf362745c014bf9592e83

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              610b662672e65e8a30dc2f4663db66e9a1520df399becf34e0e2b6c4bead579d2918460771e07b66a7b543f79418cec5cb32607cf69f6a47b65374c07d646783

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              e2c1175c39f6d93697ddb72cbb525164

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              69f9ad4c615d90c948371f5d084115d359311722

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3a6d411296e08d10576340693934856b8f54c18e029643449744ce403fa68927

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              d5214083c46f4c3a1fce26dfa6af1eb4ba8d37bbce5dfa94d139f7c7c9df8b3a7a5a9dab29f90daf43d7b6746696bda0a06e651a00086cd8773601dc32712811

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6db1c8303b4fc6b1e71a1f52079a31be

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              89f2c28be0b9bf4ce4b34a6035c8c4d1929cb6d0

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              d3b7a03bb07277cf3d5e47dc1a3f360efba16099ec22ac6793d72f59e10c1601

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              abb856abd5e93fff999448d006aac36432c565e49756b88b6e13570861a54b2cd862bc4c493e9004132cd56bf5576684e798b05875a2cdb42c1672a38d88f9b6

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              9dbf4cb03439656ea88310f3515b8631

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              23ae0232980cde6769b5bd5494674eb13d11a05b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              003bb6cbe81cc27b263a7bcad4c518105a069ea1fac47e00cf01f13b1bf0cd30

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b3e9d11cb777ee6a89e03bdf0e15941080b3cf57be4d7941b1222c404be8635829bc4b3fdb0d9c5c161e2a44724e0add6e6278cf98c3d55a5adffb52175c8c59

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              14KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4705dc82ec891cc4f1a6e3e54156d8a1

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              8756e50f0711984ae89393c906e5924b7fcd305c

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              ca955e30a64904b90081fb3a1e8a4516180b028db72130ea3895e29addb0e2cb

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              f3b0dff8e3c65483089d233e2b75c1b520500169bd7a32afc0617c43c48eb54e8780ef2b083eb29a04c79906c6c312521a9f77a3419d75f8c4e4dd698af39bfd

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              bfea2af77b2061e12441541f906d779b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              5842cc67dc5a313158ba1e774ff71b3c114c2954

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              55a89ea02a675bd46dc1dfda162f8958db07bc49d21f42c8d535765fd7882863

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5015a1c1a0bf845433e7dd8cdcf47a16297f8487a32673d30a8dfb57db125d35cda2fbd07442f765a6e5aac0b3904dca3129535c09563bb6603c708dff3f141f

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              00919fc3c1e10d06965241d3ca57da93

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              e9273aa7c2f51317b23f82d1d743bdc1c8204207

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              f1e48eb007e25f006d33dbe0273fd1b2190d1b59f95ac6a7ba734631717241fe

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a646f2fb922e241b12b8f750de064941dc89aaa5ec0f8aeb0cf91926869032522863e09d7475944751f0da9a12f1ed97dda2899db9b5efbc42685bf9a9e8205e

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              94d83590ad12c948efa0f2710982e815

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              b6c091162b746f39d76f6532b0391b3a2ed4306e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              24fb83df8835658a25c2ef04b7b7ebb20b11224dc686b218bc7b46ad6ee6edd0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              381b62b04d536be73a00af6788525f7ea28664c863d35b02b1c1574faa1ff52915e900b9718d7d879443f34d8717c197ba7fe42542de8fac4be63dadba3ff7d4

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              6KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6837556978a472b4221865302117d2af

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6a29f3d5db382937ab49b58a5e9292c0c226690e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              3433fe94f5705f623fecfc4d2b576a9ba8d11471ac0d7807cb4d303553d3cbee

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              875efd4dc1ec5c60ac9bcd6bd852c9e01320b34768d980e9f316e1100d61302c64777e306c57c60845e8ad0bd09bcceee3a4d3835fde42b9c30830e7b6d1189b

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              2c7d78b2c1512c1e35d52cddf029fa24

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fc46e5ac30dd54a5bebc24ce91a3c031b03c20f2

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              de409fa52be1b410e0569bb153032fbf287bcb243a8746cfe8bc9baa4775ae39

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              03595d2508c82919fcfc8e5be4cb0e9dd0316d2fc444bd3ecd190de361ae41d5e7709c7c5e584ef20d0077b0907035a41b81debaad96613046d95976e168db25

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              d0b0991314a30801903eaa065ebbcc42

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              bdc8d34dd9295ba9ef6972ebd5b34624481e050b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              ab6abd9ab1596b4998d5fe6496ba2f26b0c9b95b3b9fefcc682454ed79e9f64a

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              9f5f7865578cbd88150e3496cd911fef994e96ae211d4f6426e20b1fa7d758fd4c9327cd28cad7c6f5c97c15885477f305dd06353e9f57d8ee7d7bd62995f9f3

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              874B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              beb3bb5ed9a260b971da3d8d17035560

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              8a4cb93bbfecdfb7a8e37e1971a989c9c53f53ca

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e1879778c7cf4e9e2855d5b4208446298d83d22613dc1c01c7314bff524c630e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              7a03a2d22a0673e750c05f19fbb78d2ca3107c9f753480a0ab3c4a4ce39954108d7e8f0cb80316661797ba107dd1c4224429f4f59c0ad471f453659a273ced96

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              874B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              a700a9e9aba288cc8cbbd74400d94ee6

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              21d1df8bcf6d301d98912145ebee959afed44e2c

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              08ba43ba30ba0f5eeaa6458de6a11a623f2f6e03738ddbb2cd6c5cfcd3f097a6

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              12ca16f5d0d316401580a52f35278e5c32bec1cabf473ca5b01d0d1750190353ba37eb3da266450eb2c9f8fa21d336b4fbaeb3e740f3456ede96a83d8d13aedb

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e251.TMP

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              371B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              392f904a90182aef083d65e92710be00

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              749e905a8c27eacb301a765ed4f2a527ca60a5d4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              df91ab8931fc15987f4348bfa27494f1666e2ed8c8972125032d27a77eec56de

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b48047fe5c399e1155ee2079b3882bc64f32f20b718c9040b4d05d01eda53afdef1b1a497df5f60bb5ae532113a048b57d23c292e6ae9de90b906aee7be0a3cc

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aab9992c-58e0-4bc2-a13f-ee09807130f8.tmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              7KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              18cce856e16371220cbb9092ad478fdd

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              1c12f78540112956fbc237620cc9884779dc3dea

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4a24c5e5b1ad50198caa6919b69b3e10edeaef51148563325ff262bdf7c11e23

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              1c081a858989c0c242136473e21e1e75054a21d398058b674bbf16cc59d1cc8d757fe0a81e6c6224bcaa61c9bfd9f0e32e0aa51934548275df67eab931a9b2be

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              16B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              589c49f8a8e18ec6998a7a30b4958ebc

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              16B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              aefd77f47fb84fae5ea194496b44c67a

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              16B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              12KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              61df6d117b1300a56250e8e523924684

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f25972fed751fb86749d7ed21e2f3d42d6e95149

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              16a75553fb14f52ea7ddcbbbdc7c69cda43e868f651b32aed114d107b8d1b52d

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ba621ab270d660de893b98a0ac213b114be3087aec75b29262f99e149a38c8d0b0c4378591a636d7e367f2dee2018e337daef4bfd4dabdc355ab702b6dc8d98b

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              11KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              633b6b32de625e222f1e21c7e9abfc4c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a4b75058a3b1ebc665e0b7f05fb10479b41663c7

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4a3e8e1438c24a1e0b92ddcb6f9bacd609ee3bb2142995aed32980c6d5ceef64

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              11c77ee136abf01cf1df775d0a3b25365711f3c8ed249adceb052fdefe1dad60a63af46b9afad20168d05582b0cd4a653edbeaa216f52226e7a85028c2c1f9e7

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              12KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              91c1dc347632d55911c4e05a0db84c80

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              4bec01101c8822951ae83c02274b61796ecf66b0

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c8f9ca75bb8517e8b5138682a8713f77272540ba2166125095661f4c66061b0a

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              4dbe380d0f59ad5af714bdb6910368983e527ab3b94140ae236a63787a73bdc30f05be57e9adba595a073d4054fef3599326c558cb8edd40a7520924be628c37

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              11KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1f834b4f6f6e912306b8afd50e2fb7f3

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              08333a8e6b95d15ac2e987fef7fdac53953585cc

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              bed19e64c1f353be9e4f66f5d681bb48f5cf40aead2e40d770d698834b3689df

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              c27024025ffbe2837103f164f9a33899fcd114357879050a97a4cd16fd0ff0f27d049923be718186a404940b036a27f13a3d2c9f630bd2229239cc999442621f

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              aac379cdb385dfe637a3c2bcec19d953

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a6831ad3e62ec37342e29852f0e45017802a5c74

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              1a4f28bb8b32f2bd5d27588731031f76387b31da4b743df83727bed08857ff77

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ca0550c3716d83a3017128dc5ea585993fde772fea5dbb5116666a41bcf7d01fd04fd98a90b5e683a7eb1358d32414a64b7a942023e84e07f40fe81f58109ec8

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2M5VOT43\microsoft.windows[1].xml

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              96B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              b1d4dd85bcb76dc7b13463a25a2900d5

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              675df565ddc2196754f277062c95ffbd452216bd

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2d9a44fed6347e8f05ce85d54c0dc2d9f91bd1fa8fa7598ed443603a17d537bf

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              0070e5a2327e1e07a1843a8dc05791a8cc55c6ae0589c0ae192d56c56f7c600ab1c1a8f5072e8895af5a4d088199960bf39e71cc6a1d9022709e2947fe692155

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\apps.csg

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              444B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5475132f1c603298967f332dc9ffb864

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              4749174f29f34c7d75979c25f31d79774a49ea46

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\apps.schema

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              150B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              1659677c45c49a78f33551da43494005

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              ae588ef3c9ea7839be032ab4323e04bc260d9387

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\appsconversions.txt

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1.4MB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              2bef0e21ceb249ffb5f123c1e5bd0292

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              86877a464a0739114e45242b9d427e368ebcc02c

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settings.csg

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              454B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              411d53fc8e09fb59163f038ee9257141

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              cb67574c7872f684e586b438d55cab7144b5303d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              1844105bb927dbc405685d3bf5546be47fa2fc5846b763c9f2ba2b613ec6bc48

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              67b342c434d8f3a8b9e9ac8a4cbd4c3ef83ddfc450fe7e6ad6f375dba9c8a4977a15a08b49f5ad7644fbde092396e6da08865aa54d399836e5444cb177a33444

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settings.schema

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              162B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ac68ac6bffd26dbea6b7dbd00a19a3dd

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a3d70e56249db0b4cc92ba0d1fc46feb540bc83f

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              d6bdeaa9bc0674ae9e8c43f2e9f68a2c7bb8575b3509685b481940fda834e031

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              6c3fcce2f73e9a5fc6094f16707109d03171d4a7252cf3cb63618243dbb25adb40045de9be27cad7932fd98205bdaf0f557d282b2ba92118bba26efcf1cd2a02

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settingsconversions.txt

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              520KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              721134982ff8900b0e68a9c5f6f71668

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fca3e3eb8f49dd8376954b499c20a7b7cad6b0f1

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2541db95c321472c4cb91864cdfa2f1ed0f0069ac7f9cec86e10822283985c13

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5d1c305b938e52a82216b3d0cee0eead2dc793fac35da288061942b2bd281fb48c7bd18f5fdaa93a88aa42c88b2a0cce1f0513effb193782670d46164d277a59

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settingsglobals.txt

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              43KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              bbeadc734ad391f67be0c31d5b9cbf7b

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              8fd5391c482bfbca429aec17da69b2ca00ed81ae

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              218042bc243a1426dd018d484f9122662dba2c44a0594c37ffb3b3d1d0fb454a

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a046600c7ad6c30b003a1ac33841913d7d316606f636c747a0989425697457b4bc78da6607edd4b8510bd4e9b86011b5bd108a5590a2ba722d44e51633ed784f

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{807b387d-f5d5-4c63-addf-84abbfebc5fd}\settingssynonyms.txt

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              101KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              003ece80b3820c43eb83878928b8469d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              790af92ff0eb53a926412e16113c5d35421c0f42

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              12d00eee26e5f261931e51cfa56e04c54405eb32d1c4b440e35bd2b48d5fcf07

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b2d6d9b843124f5e8e06a35a89e34228af9e05cbfa2ae1fe3d9bc4ddbebda4d279ce52a99066f2148817a498950e37a7f0b73fe477c0c6c39c7016aa647079a5

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c4f3b4e5-baa4-491f-a6f7-26ac271034c5}\appsglobals.txt

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              343KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              931b27b3ec2c5e9f29439fba87ec0dc9

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{c4f3b4e5-baa4-491f-a6f7-26ac271034c5}\appssynonyms.txt

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              237KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              06a69ad411292eca66697dc17898e653

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133531216590569586.txt

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              72KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              5b4b9d0df8b6dfd821c5d714018057d2

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              737572ed9a2e31b9c70be6b89a69c1cef3b9fa5a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              c8fe9454e3257e33e2aa62872f4e7686f19e5ef84f161fdafb59e364e764e069

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              dc55427a58a5a84f3daed54eec79f47ad6278ca640ddb39d1c346006b2455347a94d41b7184afda1e9f34c9d848f478a1b55a70594afb5f500458bac4ed1ec29

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              177KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              b98363a1b78e81e1ead8494728373478

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              638fcc8b23950e73e77cadb422867db6a0f147f8

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8536a44a83336238c8d38b0a00d340d68bfd3faf3aa1d1af9c51924d3610c835

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              48ade59f986a6e2582d69cd75a02783fecea882336382cd7a446ea27e2c3b59fb50d200e2504cfe79f0cab4596b35c41f92fe6f56fbf2ea6144b6106595633ae

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              179KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              0cff4aa944251db08f4de5a86c92af0f

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6cfafdc59a9f51328b87a285b5cced23efc22c2a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              df81c8b7fe84013f202780630931abbb990af58fb2c1b3732ff3c37a230e1357

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5c04c9bf44453cf5b08ddaf695263514da57e69e1654112532e5b3705deba03ed151c6a36ff4ee8c98431ab97a1ce571676a5c9453e983acc107295dcdd81af9

                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              9KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              3a10b2b86c69f001a1f66f099cc07300

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              253d04ac8526ad1b56e63395776784bb7a25b184

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5f0cbe59e762ea7af522f7dd4f942097dff5ae7f386ad6b7dc10b6da620910cb

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b712018a5164b867a8b8c0cf9aab69491733e0277375a7aa60f922b7ddd67fd2c8673e8f73d97cc289077070ef6c8cdf8bbe06b060495b08ac59942968856503

                                                                                                                                                                                            • C:\Users\Admin\Desktop\ConvertHide.zip

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              1000KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              40e3e432cc5e3c107df8dfe04761d169

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              4abcfd84cb3566630bf747400bb79b7336bbac10

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              b6d6a496d45cc5f68055a92740b1b272f484f53d5ac7474840f0d3808f50e514

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              951aca8e307ed1c69f9a89cc11f4fec3525364dbe6db2ae36b179cd762c407c057479dba46f5bdd48694a2a0b44d811564e56b7a331cec4d8079d4a8959b6656

                                                                                                                                                                                            • C:\Users\Admin\Desktop\ConvertTest.M2TS

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              558KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              008fe77f76e52b0832fc4123424d47e7

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              8cd8cc57727367510c4bed9c712cde88ecb3e51a

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5bc0e0ac694840d86d8ba99185fefbd7d4a7dd12e5249d8a14fdd3da9f916cf5

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              5a260e406554aa550c8351e7f8c5afeb00eeb8c8772d29e77bd36545d2ed71256c1ffbe396bced5577ebe5e6d49ca074fe7d7094d3df4c4a35385a8d5fdecb75

                                                                                                                                                                                            • C:\Users\Admin\Desktop\ConvertToStop.MOD

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              279KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              849d56dd790562a66c6c577d6a811008

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              0946cba2adcc979bc5fbbb46ff630f4b641c651b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              695030ea25ec8366e607fd8c6477077c449467f77700682bc8accae30c67482d

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              e074c5be456aae47fed0552efa869d96956a6026de8794de187b253ce571699fc1e205faeaa618078d63eae27c2faf2f136a7b5f0f6c1b93d9825c68667013e2

                                                                                                                                                                                            • C:\Users\Admin\Desktop\CopyRequest.TTS

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              442KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              f2dbe0507dbde341111d26d2ec9ad8c2

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              2a87e2f340715f21ad370344c7e8683349020981

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              535417c8545f2d2450140573fd73d7a525a1300d7c4663dcbab511b987ec18b9

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              fc550e2a70c4c59331f7f0545c06d5604dbb8e84f9d85d36cbac1b7949f977dadcb0b4765f0fe9fb16c37273f9f7ee5eb3e54e1a639b8fe09bbbd28b50c75d50

                                                                                                                                                                                            • C:\Users\Admin\Desktop\HideRead.3gpp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              698KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ec150e36b0ecac85dd17c5f0ce471e9c

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              81eba091b5c94d46758bb7bea9e6d385347d618b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              0efa523959c5d24a66d84bee0d64a575d34bf4fb7a267931491e88428f5de7ca

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              88ab6d505f3f7b3e5742fe6d25ec53f9d0c242455dc090f9c89ce118fce30b5036b8e3937fd47066bdaf0135401104652fb5341daa065ba1b501cf1481a28cf2

                                                                                                                                                                                            • C:\Users\Admin\Desktop\MeasureInitialize.vbe

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              255KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              9e9ba2a0ca3679f2caabd82e9583babb

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              4018f243def36237e29a7631dbd69111bbc0db30

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8167ad76f9af81d838106b26e02a8b1390c1cf03af61854b9361761c64612038

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              232dece6220e5be1a4b1cb2842a24286dfa40a8de8b4ff52e6603abcc2932fb174fc9868999f4cd773ff1d9021046893692527885311eb845af6dfac2231939a

                                                                                                                                                                                            • C:\Users\Admin\Desktop\Microsoft Edge.lnk

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              294e090988f7b03d345b8a242cb55108

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              aa0849866f634f8eee649effc37f1f9c2e78ef74

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              28218100203ccb313e04b2375ad1e99565a7baccda15679f5c6b551dcd402c3d

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              6f330e411da775f86f0ddc01db767f2f14ce0714552a13244e38e1d1575f23c20fce7155662205c7b2da761dcbedad6f985598bd1da35255f89390e513233940

                                                                                                                                                                                            • C:\Users\Admin\Desktop\MountOptimize.jpeg

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              651KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              333c49017d81942b3f8212b8b78a4e9d

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a997cb5198dc88b108fd8a2c41d146510f2aebad

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2c449656e094e84c8973b3d13ab0b0e424643079bfddecc95a2b7e3dc41780cd

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              6b1bc72e50eb8006a653d5fb1db5c167ad8ca382de1666d24b24851d362116cb61571ff41bc6373a6f3149f9e63181b8f1ca5f6db77a4afad3625a16e502b065

                                                                                                                                                                                            • C:\Users\Admin\Desktop\OpenUninstall.mp3

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              535KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              fa126b0af8cb79fd5f5859400276a739

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6db61a3ba9f848af2c4df3bfbb730488f768a0da

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2462dde1d0bc111ee57ee8f63ccc3c95b9244e05004e76532ce1ed11cdcda3f0

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              599e8faa07937c818d5a86b87b057579e3bb28cd446d5533ec62ab007e570ad14097395ea01e5fd47b8fd87e3a9e353245435857abb25aebaefd1d992b3d8eee

                                                                                                                                                                                            • C:\Users\Admin\Desktop\RemoveSkip.mp2v

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              674KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              843b81061eb898feb3688f2253b52362

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              2bf251d80c3e53b6e8dc2e01bf509751c5fded7b

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              8842209c6fdb91ed1f015ac77ceae163a3dc6cb75cb366b5f925d3fa809a6e94

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a6a98eeaa07b168a3a2427267ed230050bb8bc25e6ef6bd15d72370a5b985809dd705104cc411f7061b0febb3474580fea98385c894f826c68658cd202db09ec

                                                                                                                                                                                            • C:\Users\Admin\Desktop\ResetBackup.xlsm

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              488KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              014a76a64c34d4c56319537e1c606cf0

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              78c33b6037809816ec267c3e84d77f39140c91ab

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              4d937d4f10f2a5f7346d39a8edd00fd82dba3105fa1bbb31faac72bb17e1b7e2

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              dbee354832af53b0dc1f96cba6dd2c7084193e1272619886035808609ee8930f690bb9df4fffd8f9352a2368ecc513a03e89c3ec08255bc09097f41be5dbb1ca

                                                                                                                                                                                            • C:\Users\Admin\Desktop\SplitExit.xht

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              418KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              ff5831df9705de8eea2e0bb57df34e81

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              f7433f694bdd4fc99f21d5c66b7ba48c16f639ae

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2aa2bf141bc0703a225b7f4b01a17105b84fee0010e2625c83ab028892d201be

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              dbe71ad5e262bb4e3dc335f7fc4b1e5670894c29e3177888bb94f7b0ca6618309875c0c953e3df0eb604b63dec5dcb670b89bb3f448a2ec538f4a88a5a0f0b4d

                                                                                                                                                                                            • C:\Users\Admin\Desktop\SuspendReceive.iso

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              325KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              b8b31f6c463d0b11d90ac456bf9d2384

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              a0687581a9c6132f336e9ca07d3fd639f9f12985

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              2bd8f8b5e5a8eee1f60ea53e777439592a26b67ec7e7c077d4855280758837e6

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              53859a4d5b9cf6824ed4a5e4d2983508110f37e56ee694601f2fa80d08ac6dc92e77bb57847a04fa484751c3048ba82f3030f96df3d6dab60d1f9f14f283aead

                                                                                                                                                                                            • C:\Users\Admin\Desktop\UnregisterDeny.mp3

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              721KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              365e88300778f9b1a74eeba916cd7969

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              2520d4843ee8347af6fb4297b9cb09cc3f6f1856

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              5ebc235a5a71140b117dc5338d3f25f4c497e87e7135516771ddac38b8908ef8

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              46f83f25234e5efef718c02f34dec86d9bdf25d40e9a675effce5ee8d5f9b94d99b57d99cc9895497897c7d749ae56ddcf52214d967379c0c2f06784c88d2ba2

                                                                                                                                                                                            • C:\Users\Admin\Desktop\UpdateUse.mht

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              581KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              df14310f1471f6b5e1db1d137e1e33cd

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              64de2b88c68572df85b1f7e9eff65fb46d7755d3

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              1b0bf5d69758e4b2c60e0a378be5003374a21fc5877ac6eb08c4475803b90969

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              28ad96fda8fd390a03360049210d349150ec73f13c57f2645771b6c1fa6a7c3b29d5de5d482d74554dcfc930077423faec9ba05c0127019b38b78c252743e81a

                                                                                                                                                                                            • C:\Users\Admin\Desktop\UseOut.jpe

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              511KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              11a81cb8dc66b395d918c48c8d98c862

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              30eb2d27e28a026ceeec1b118e8884296d1616b3

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              e46acf61b50f4d221678947fcc80fc9f171a91bb74ea345529aa75065b4fab1d

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              654cc2f4dbe2d51b4dbb4efe863926c979676bcd586f4106612b76e45e10217d9fb674472c833f4340c80e3423dadcd2036c66c0dc497e26a5250ea95712efcb

                                                                                                                                                                                            • C:\Users\Admin\Desktop\WaitReceive.wma

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              628KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              9649ffe3f275893bafa1f56eca1b1372

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              5427630856f5a33f5e74abe23471f8d587d21f56

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              629c0ff4624380366752255427344b284d63b397a7f92c388af58b02a5b999e3

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b7f8abca85ee97b302be24b0718e3cef0f6e0ce7fe5c87fd9dfb5e8f65648cc0b51116f23d3f9a29796db2074c66ed582afba79d2ec154183b5ea36b00efc27b

                                                                                                                                                                                            • C:\Users\Public\Desktop\Acrobat Reader DC.lnk

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              48b4930fbd965dd3256a1375078676d4

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              6dffc680225dd3eb1b1de02177024f940f836607

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              a22488a54111b5bdcc13f7505c33dc06da7ad7dcada4c94df9fbe297598d8ab2

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              bfce3001e53d630b2e40b73c3a3b1624364c13bc0e14ba432a63a1d3362fffc11c5a2cff2a16a667146f13195aacd749bc547f6d3139534656da5146b14c2ac7

                                                                                                                                                                                            • C:\Users\Public\Desktop\VLC media player.lnk

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              923B

                                                                                                                                                                                              MD5

                                                                                                                                                                                              fd4c2f08983c59e3b590cda4b3ed39ac

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              9f3022b150fd2b68f3552f07b5c21576e4ac3dbe

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              6fe6679732397cea6cbb444f9f74cf8419d2513610b78c09fa97240df4b8e920

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              a63068eba73fb8bc7b5772fe844c66f8b4f4ccf3e126db62cd2124023b35530116b804385b6e6dff268febc934a0034702c5cbeab5697ac46900b3edac848960

                                                                                                                                                                                            • C:\Windows\Logs\DISM\dism.log

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              200KB

                                                                                                                                                                                              MD5

                                                                                                                                                                                              4d5160d36ec2a4ef7f7c06b484c9e193

                                                                                                                                                                                              SHA1

                                                                                                                                                                                              683a6cb41e64104cfdba912230010f1a5cc7c974

                                                                                                                                                                                              SHA256

                                                                                                                                                                                              a5a7f50789e27d713b2d78ca65c3b8aaec6cb073a3212131101bf6007684faa8

                                                                                                                                                                                              SHA512

                                                                                                                                                                                              b889be1b62d6d37b70b230becf587689b01e52333c14de5414128bc9536e59ef8b58edfb285d04fcfdf73db37d3cb7fbc4ef0f40cd977d4d39da297dd9623f7b

                                                                                                                                                                                            • memory/4480-1649-0x0000018BD8BF0000-0x0000018BD8C10000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              128KB

                                                                                                                                                                                            • memory/4480-1644-0x0000018BD8780000-0x0000018BD87A0000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              128KB

                                                                                                                                                                                            • memory/4480-1647-0x0000018BD8740000-0x0000018BD8760000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              128KB

                                                                                                                                                                                            • memory/4708-1707-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1703-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1708-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1702-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1706-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1705-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1704-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1710-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1711-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1709-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1658-0x0000020F6DC50000-0x0000020F6DC60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/4708-1674-0x0000020F6DD50000-0x0000020F6DD60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/4708-1693-0x0000020F75F80000-0x0000020F75F81000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1695-0x0000020F760C0000-0x0000020F760C1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1697-0x0000020F760C0000-0x0000020F760C1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1698-0x0000020F760D0000-0x0000020F760D1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1699-0x0000020F760D0000-0x0000020F760D1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1700-0x0000020F760D0000-0x0000020F760D1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/4708-1701-0x0000020F760F0000-0x0000020F760F1000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              4KB

                                                                                                                                                                                            • memory/6112-700-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-696-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-701-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-702-0x00007FF8CBAF0000-0x00007FF8CBB00000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-722-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-723-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-724-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-725-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-726-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-727-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-699-0x00007FF8CBAF0000-0x00007FF8CBB00000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-698-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-697-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-728-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-695-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-694-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-693-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-692-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-690-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-691-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-689-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB

                                                                                                                                                                                            • memory/6112-688-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-685-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-686-0x00007FF8CDB50000-0x00007FF8CDB60000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              64KB

                                                                                                                                                                                            • memory/6112-687-0x00007FF90DAD0000-0x00007FF90DCC5000-memory.dmp

                                                                                                                                                                                              Filesize

                                                                                                                                                                                              2.0MB