Analysis
-
max time kernel
1635s -
max time network
2029s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 14:27
Static task
static1
General
-
Target
RobloxPlayerLauncher.exe
-
Size
1.6MB
-
MD5
df3c89248671866cfb9e0a407fad20b4
-
SHA1
2258e20671e6aaba8ce75abb5bc5bca8c4df0035
-
SHA256
93580834e65af2f5a83aacef47a1ec3ef45fc6ab9683ec4df771bbea713ab38f
-
SHA512
f6658f2653aefebc573518773c97319d87d70cabeb182cd622a5722d4df0417df17318f4b25b7929ab03e982a072e914175971b96e205356c5c6a23a3fedaf01
-
SSDEEP
49152:NmAhTN2Q5MmBRS+qYNS2+3njUrG+TvamoGXtTOgM7PMQpdAUFTHrPHHoV5N:gAhTkyZBdM2+3njUmrPHA
Malware Config
Extracted
limerat
-
aes_key
Venom
-
antivm
true
-
c2_url
https://pastebin.com/raw/9YkEF3aU
-
delay
3
-
download_payload
false
-
install
true
-
install_name
Google.exe
-
main_folder
Temp
-
pin_spread
true
-
sub_folder
\system\
-
usb_spread
true
Extracted
limerat
-
antivm
false
-
c2_url
https://pastebin.com/raw/9YkEF3aU
-
download_payload
false
-
install
false
-
pin_spread
false
-
usb_spread
false
Signatures
-
Cobalt Strike reflective loader 1 IoCs
Detects the reflective loader used by Cobalt Strike.
Processes:
resource yara_rule C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat.tmp cobalt_reflective_dll -
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Detect ZGRat V1 8 IoCs
Processes:
resource yara_rule C:\Program Files\ReasonLabs\EPP\mc.dll family_zgrat_v1 C:\Program Files\ReasonLabs\EPP\rsEngine.Core.dll family_zgrat_v1 behavioral1/memory/4992-8552-0x000001D56CA60000-0x000001D56CABA000-memory.dmp family_zgrat_v1 behavioral1/memory/4992-8647-0x000001D56D960000-0x000001D56DBBE000-memory.dmp family_zgrat_v1 behavioral1/memory/8480-9001-0x000001D0F4DD0000-0x000001D0F4F64000-memory.dmp family_zgrat_v1 C:\Program Files\ReasonLabs\VPN\rsEngine.Core.dll family_zgrat_v1 behavioral1/memory/9128-11797-0x000001F81AA40000-0x000001F81AA94000-memory.dmp family_zgrat_v1 behavioral1/memory/9128-11972-0x000001F834030000-0x000001F83423E000-memory.dmp family_zgrat_v1 -
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
Processes:
taskmgr.exedescription pid process target process PID 3792 created 8388 3792 taskmgr.exe msedge.exe PID 3792 created 8388 3792 taskmgr.exe msedge.exe PID 3792 created 8008 3792 taskmgr.exe msedge.exe PID 3792 created 8008 3792 taskmgr.exe msedge.exe -
Contacts a large (762) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Downloads MZ/PE file
-
Drops file in Drivers directory 6 IoCs
Processes:
RAVEndPointProtection-installer.exeSaferWeb-installer.exedescription ioc process File created C:\Windows\system32\drivers\rsCamFilter020502.sys RAVEndPointProtection-installer.exe File created C:\Windows\system32\drivers\rsKernelEngine.sys RAVEndPointProtection-installer.exe File created C:\Windows\system32\drivers\rsElam.sys RAVEndPointProtection-installer.exe File opened for modification C:\Windows\system32\drivers\rsElam.sys RAVEndPointProtection-installer.exe File created C:\Windows\system32\drivers\rsDwf.sys SaferWeb-installer.exe File opened for modification C:\Windows\system32\drivers\rsDwf.sys SaferWeb-installer.exe -
Modifies Installed Components in the registry 2 TTPs 7 IoCs
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0" setup.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid process 5688 netsh.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0" MicrosoftEdgeUpdate.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
rsEngineSvc.exersEDRSvc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rsEngineSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rsEDRSvc.exe -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rsAppUI.exemsedge.exeopera.exeopera.exemsedge.exeopera.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeopera.exemsedge.exersAppUI.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exersAppUI.exemsedge.exeopera.exemsedge.exemsedge.exemsedge.exemsedge.exeprod0.exemsedge.exemsedge.exemsedge.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exemsedge.exemsedge.exemsedge.exemsedge.exeopera.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeopera.exeopera.exemsedge.exemsedge.exemsedge.exemsedge.exeopera.exemsedge.exemsedge.exemsedge.exemsedge.exeopera.exeBCILauncher.EXEmsedge.exemsedge.exemsedge.exeopera.exersAppUI.exemsedge.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation rsAppUI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation rsAppUI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation rsAppUI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation prod0.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation BCILauncher.EXE Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation opera.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation rsAppUI.exe Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation msedge.exe -
Executes dropped EXE 64 IoCs
Processes:
RobloxPlayerLauncher.exeRobloxPlayerLauncher.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_124.0.2478.97.exesetup.exesetup.exeMicrosoftEdgeUpdate.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exeGoogle.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeKiller 7_L-x1Qr1.exeKiller 7_L-x1Qr1.tmpprod0.exesaBSI.exeOperaSetup.exeOperaSetup.exeOperaSetup.exeOperaSetup.exewwlattsq.exeOperaSetup.exeRAVEndPointProtection-installer.exersSyncSvc.exersSyncSvc.exeqbittorrent.exeinstaller.exeinstaller.exeServiceHost.exeAssistant_109.0.5097.45_Setup.exe_sfx.exeUIHost.exeassistant_installer.exeassistant_installer.exeupdater.exeBGAUpdate.exeMicrosoftEdgeUpdate.exeBCILauncher.EXEBingChatInstaller.exepid process 4264 RobloxPlayerLauncher.exe 1632 RobloxPlayerLauncher.exe 1672 MicrosoftEdgeWebview2Setup.exe 5088 MicrosoftEdgeUpdate.exe 2964 MicrosoftEdgeUpdate.exe 4692 MicrosoftEdgeUpdate.exe 4916 MicrosoftEdgeUpdateComRegisterShell64.exe 4696 MicrosoftEdgeUpdateComRegisterShell64.exe 1044 MicrosoftEdgeUpdateComRegisterShell64.exe 4440 MicrosoftEdgeUpdate.exe 1316 MicrosoftEdgeUpdate.exe 1336 MicrosoftEdgeUpdate.exe 1532 MicrosoftEdgeUpdate.exe 5140 MicrosoftEdge_X64_124.0.2478.97.exe 5772 setup.exe 5892 setup.exe 4172 MicrosoftEdgeUpdate.exe 2648 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 1828 Google.exe 5972 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 5760 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 3248 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 3624 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 3580 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 5432 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 5540 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 1192 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 1584 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 2280 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 5492 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 4872 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 5196 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 4780 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 1600 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 5968 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 3408 369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe 4408 MicrosoftEdgeUpdate.exe 5044 MicrosoftEdgeUpdate.exe 5424 Killer 7_L-x1Qr1.exe 5456 Killer 7_L-x1Qr1.tmp 3620 prod0.exe 5816 saBSI.exe 2672 OperaSetup.exe 5108 OperaSetup.exe 5876 OperaSetup.exe 4996 OperaSetup.exe 6032 wwlattsq.exe 4536 OperaSetup.exe 2892 RAVEndPointProtection-installer.exe 4176 rsSyncSvc.exe 4932 rsSyncSvc.exe 2800 qbittorrent.exe 2716 installer.exe 2312 installer.exe 7264 ServiceHost.exe 7364 Assistant_109.0.5097.45_Setup.exe_sfx.exe 8012 UIHost.exe 8132 assistant_installer.exe 8184 assistant_installer.exe 8048 updater.exe 7564 BGAUpdate.exe 8180 MicrosoftEdgeUpdate.exe 6496 BCILauncher.EXE 7200 BingChatInstaller.exe -
Loads dropped DLL 64 IoCs
Processes:
MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeKiller 7_L-x1Qr1.tmpOperaSetup.exeOperaSetup.exeOperaSetup.exeOperaSetup.exeOperaSetup.exewwlattsq.exeregsvr32.exeregsvr32.exeServiceHost.exeregsvr32.exeregsvr32.exeUIHost.exeassistant_installer.exeassistant_installer.exeRAVEndPointProtection-installer.exeMicrosoftEdgeUpdate.exersEDRSvc.exersEDRSvc.exersEngineSvc.exe3mmcwwuu.exeRAVVPN-installer.exersVPNSvc.exersAppUI.exeMicrosoftEdgeUpdate.exepid process 5088 MicrosoftEdgeUpdate.exe 2964 MicrosoftEdgeUpdate.exe 4692 MicrosoftEdgeUpdate.exe 4916 MicrosoftEdgeUpdateComRegisterShell64.exe 4692 MicrosoftEdgeUpdate.exe 4696 MicrosoftEdgeUpdateComRegisterShell64.exe 4692 MicrosoftEdgeUpdate.exe 1044 MicrosoftEdgeUpdateComRegisterShell64.exe 4692 MicrosoftEdgeUpdate.exe 4440 MicrosoftEdgeUpdate.exe 1316 MicrosoftEdgeUpdate.exe 1336 MicrosoftEdgeUpdate.exe 1336 MicrosoftEdgeUpdate.exe 1316 MicrosoftEdgeUpdate.exe 1532 MicrosoftEdgeUpdate.exe 4172 MicrosoftEdgeUpdate.exe 4408 MicrosoftEdgeUpdate.exe 5044 MicrosoftEdgeUpdate.exe 5044 MicrosoftEdgeUpdate.exe 4408 MicrosoftEdgeUpdate.exe 5456 Killer 7_L-x1Qr1.tmp 5456 Killer 7_L-x1Qr1.tmp 5456 Killer 7_L-x1Qr1.tmp 2672 OperaSetup.exe 5108 OperaSetup.exe 5876 OperaSetup.exe 4996 OperaSetup.exe 4536 OperaSetup.exe 6032 wwlattsq.exe 7080 regsvr32.exe 8020 regsvr32.exe 7264 ServiceHost.exe 6612 regsvr32.exe 7264 ServiceHost.exe 7264 ServiceHost.exe 7264 ServiceHost.exe 7264 ServiceHost.exe 7724 regsvr32.exe 7264 ServiceHost.exe 8012 UIHost.exe 8132 assistant_installer.exe 8132 assistant_installer.exe 8184 assistant_installer.exe 8184 assistant_installer.exe 8012 UIHost.exe 7264 ServiceHost.exe 2892 RAVEndPointProtection-installer.exe 2892 RAVEndPointProtection-installer.exe 8180 MicrosoftEdgeUpdate.exe 8480 rsEDRSvc.exe 8480 rsEDRSvc.exe 6616 rsEDRSvc.exe 6616 rsEDRSvc.exe 3636 rsEngineSvc.exe 6616 rsEDRSvc.exe 4516 3mmcwwuu.exe 2272 RAVVPN-installer.exe 3456 rsVPNSvc.exe 3636 rsEngineSvc.exe 3636 rsEngineSvc.exe 8540 rsAppUI.exe 8540 rsAppUI.exe 7204 MicrosoftEdgeUpdate.exe 7204 MicrosoftEdgeUpdate.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 64 IoCs
Processes:
MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exeMicrosoftEdgeUpdateComRegisterShell64.exeregsvr32.exeregsvr32.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeinstaller.exeMicrosoftEdgeUpdateComRegisterShell64.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\notification_click_helper.exe\"" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{117151a5-951b-477e-91a4-699c7d9d66a2}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\109.0.5097.80\\notification_helper.exe\"" installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\notification_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32\ThreadingModel = "Apartment" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ServerExecutable = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\notification_click_helper.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ThreadingModel = "Apartment" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\notification_helper.exe\"" setup.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32 installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.171.39\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.187.37\\psmachine_64.dll" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8B15189E-5465-4166-933D-1EABAD9648CB}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32\ = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\PdfPreview\\PdfPreviewHandler.dll" setup.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\WOW6432Node\CLSID\{E7629152-0A34-4487-B787-5D1144304455}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\109.0.5097.80\\notification_helper.exe" installer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
rundll32.exeBingChatInstaller.exeassistant_installer.exeopera.exeopera.exeopera.exeBGAUpdate.exerundll32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\!BCILauncher = "C:\\Windows\\Temp\\MUBSTemp\\BCILauncher.exe bgaupmi=54CD468A37DE4FE691A9914214B4F423" BingChatInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Browser Assistant = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\assistant\\browser_assistant.exe" assistant_installer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe" opera.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe" opera.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Opera Stable = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Opera\\opera.exe" opera.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\!BCILauncher = "\"C:\\Windows\\Temp\\MUBSTemp\\BCILauncher.EXE\" bgaupmi=54CD468A37DE4FE691A9914214B4F423" BGAUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" rundll32.exe -
Checks for any installed AV software in registry 1 TTPs 6 IoCs
Processes:
Killer 7_L-x1Qr1.tmpdescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\AVG\AV\Dir Killer 7_L-x1Qr1.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast Killer 7_L-x1Qr1.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast Killer 7_L-x1Qr1.tmp Key opened \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\AVAST Software\Avast Killer 7_L-x1Qr1.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir Killer 7_L-x1Qr1.tmp Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir Killer 7_L-x1Qr1.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
msedge.exeRobloxPlayerLauncher.exeRobloxPlayerLauncher.exersEDRSvc.exemsedge.exemsedge.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msedge.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerLauncher.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msedge.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msedge.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msedge.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates connected drives 3 TTPs 55 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
OperaSetup.exemsiexec.exemsiexec.exersEngineSvc.exeqbittorrent.exeOperaSetup.exeinstaller.exersEDRSvc.exedescription ioc process File opened (read-only) \??\D: OperaSetup.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\F: rsEngineSvc.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\F: OperaSetup.exe File opened (read-only) \??\F: qbittorrent.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\D: OperaSetup.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\F: OperaSetup.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\F: rsEDRSvc.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\D: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\P: msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
setup.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects setup.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
AndroidAssistServer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum AndroidAssistServer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 AndroidAssistServer.exe -
Modifies powershell logging option 1 TTPs
-
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\ProgramData\ReasonLabs\EPP\SignaturesYFS.dat.tmp autoit_exe C:\ProgramData\ReasonLabs\EPP\SignaturesYSS.dat.tmp autoit_exe -
Checks system information in the registry 2 TTPs 47 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
msedge.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedge.exemsedge.exeopera.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedge.exeopera.exeMicrosoftEdgeUpdate.exersEDRSvc.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeopera.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer opera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer opera.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer MicrosoftEdgeUpdate.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName msedge.exe -
Drops file in System32 directory 64 IoCs
Processes:
rsEngineSvc.exersEDRSvc.exesetup.exersScanner_v3.9.1.exersSyncSvc.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_79CFD3DF2894C4BFDA2ADFD6675FA18B rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_0A36A03C09DCEEA388C024E3D20B14B7 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3AA0DCD5A74331FBD6F344550EC48B87_AD29AB0C5CE75CC82783A6DDDEF1E075 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FC68FB72D4FBC7E0F151BC2282D75E47_367FA2447481C3DB640CE44BE2E5A181 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07A7CCFBD28A674D95D3BF853C9007C6 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_66F532634EB780F86B16CC279B9366A2 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\303572DF538EDD8B1D606185F1D559B8 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk setup.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_0A36A03C09DCEEA388C024E3D20B14B7 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0343D08A98AFAA7CAA7068BD558BE887 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_FCC3094F2742476FF700A8833794D0E1 rsEngineSvc.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rsScanner_v3.9.1.exe.log rsScanner_v3.9.1.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_927B32810B2981070A638BBD38117305 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\303572DF538EDD8B1D606185F1D559B8 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_178C086B699FD6C56B804AF3EF759CB5 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66AE3BFDF94A732B262342AD2154B86E_A89204531497D3661ACEDB6FB93ECB4C rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66AE3BFDF94A732B262342AD2154B86E_A89204531497D3661ACEDB6FB93ECB4C rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517 rsSyncSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5F26A2159BA21EA573A1C5E3DE2CF211_E3375A509D9058F6A8FFB74D3B4E6F77 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894 rsSyncSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_8280ADFA5CEF4E7A7D18EDB173D117BD rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\49855FCDFA62840A2838AEF1EFAC3C9B rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_330B78668586CC1C5060B7886AA9A046 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_3A58CFC115108405B8F1F6C1914449B7 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7850C7BAFAC9456B4B92328A61976502_6A5F08240159C584DE485971DE45D01F rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517 rsSyncSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_10534D407DF32865AC15C5208A74F233 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C46E7B0F942663A1EDC8D9D6D7869173_6043FC604A395E1485AF7AC16D16B7CE rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_E3A0B2E345AA9F5A174687564C886046 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5F26A2159BA21EA573A1C5E3DE2CF211_E3375A509D9058F6A8FFB74D3B4E6F77 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_3A58CFC115108405B8F1F6C1914449B7 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\74FBF93595CFC8459196065CE54AD928 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_A925FAB5FFC3CEDB8E62B2DCCBBBB4F2 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42B9A473B4DAF01285A36B4D3C7B1662_38924EDF39D8802D6946FB22E5DD0835 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\206932163209AD483A44477E28192474 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77FBC64BA73370EC2F659BAD977FF2AD_9767A5403B067D539A02E2AD0F3C2C4A rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\18E6B4A57A6BC7EC9B861CDF2D6D0D02_C3B142D2C5374581DC2FDFFDEDBDEDDB rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\AEACCDA8653DD8D7B2EA32F21D15D44F_D5824721AFCD338CB437BB54334D6F98 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7850C7BAFAC9456B4B92328A61976502_6A5F08240159C584DE485971DE45D01F rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\206932163209AD483A44477E28192474 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_726B8EFFBCA6C6A70214A4BA651CA9C6 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\AEACCDA8653DD8D7B2EA32F21D15D44F_16AF0EAEDE417D2EF9B4FAE6020C5F20 rsEngineSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_2CDE88B3CC9A35A2EA16DC0201366139 rsEDRSvc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D97B1EC1F43DD6ED4FE7AB95E144BC_330B78668586CC1C5060B7886AA9A046 rsEDRSvc.exe -
Suspicious use of SetThreadContext 27 IoCs
Processes:
63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exedescription pid process target process PID 7156 set thread context of 9836 7156 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 10632 set thread context of 11116 10632 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 5992 set thread context of 7056 5992 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 2044 set thread context of 9632 2044 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 1776 set thread context of 8092 1776 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe msedge.exe PID 11252 set thread context of 7088 11252 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 5032 set thread context of 4388 5032 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 4348 set thread context of 6468 4348 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 1840 set thread context of 8932 1840 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 4044 set thread context of 11208 4044 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 2956 set thread context of 6020 2956 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 9436 set thread context of 10096 9436 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 10236 set thread context of 2888 10236 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 10452 set thread context of 9808 10452 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 732 set thread context of 776 732 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 5452 set thread context of 2192 5452 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 10480 set thread context of 3500 10480 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 2508 set thread context of 10448 2508 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 7716 set thread context of 2008 7716 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 10340 set thread context of 9468 10340 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe opera.exe PID 4524 set thread context of 10548 4524 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe opera.exe PID 9476 set thread context of 9580 9476 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 8600 set thread context of 2596 8600 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 5392 set thread context of 9924 5392 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 5156 set thread context of 11240 5156 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 4624 set thread context of 5996 4624 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe PID 8856 set thread context of 8096 8856 63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe RegAsm.exe -
Drops file in Program Files directory 64 IoCs
Processes:
RobloxPlayerLauncher.exeinstaller.exesetup.exemsedge.exeMicrosoftEdgeWebview2Setup.exemsedge.exeinstaller.exesetup.exeRAVEndPointProtection-installer.exeServiceHost.exedescription ioc process File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\core\utils\stringutils.luc installer.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-es-ES.js installer.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Emotes\TenFoot\SelectedLine.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\AnimationEditor\img_eventMarker_border.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\AnimationEditor\img_scalebar_arrows_border.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\DefaultController\[email protected] RobloxPlayerLauncher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Locales\hu.pak setup.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-dwtoast.html installer.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3708_1535086814\json\i18n-mobile-hub\id\strings.json msedge.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\DPadSheet.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\GuiImagePlaceholder.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\PlayStationController\PS4\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB3DF.tmp\msedgeupdateres_sk.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\mwb\wa-mwb-checklist.html installer.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping8388_203762979\hyph-cy.hyb msedge.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Settings\Players\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\VoiceChat\MicDark\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaApp\icons\ic-more-help.png RobloxPlayerLauncher.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-sv-SE.js installer.exe File created C:\Program Files\McAfee\WebAdvisor\analyticsmanager.dll installer.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\configs\DateTimeLocaleConfigs\zh-tw.json RobloxPlayerLauncher.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\new-tab-res-toast-pt-PT.js installer.exe File opened for modification C:\Program Files\McAfee\Temp4134757966\lookupmanager.cab installer.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\LegacyRbxGui\M1Side.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB3DF.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe MicrosoftEdgeWebview2Setup.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Trust Protection Lists\Mu\LICENSE setup.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-hu-HU.js installer.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\GameSettings\ScrollBarTop_Wide.png RobloxPlayerLauncher.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-nb-NO.js installer.exe File created C:\Program Files\ReasonLabs\EPP\EDR\System.Runtime.dll RAVEndPointProtection-installer.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaChat\icons\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB3DF.tmp\msedgeupdateres_ca.dll MicrosoftEdgeWebview2Setup.exe File created C:\Program Files\McAfee\WebAdvisor\telemetry\dimensions\handlers\bingpartnercode.luc installer.exe File created C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_mosaic_api_v2.js ServiceHost.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\configs\DateTimeLocaleConfigs\es-es.json RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\InspectMenu\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.80\Locales\ca-Es-VALENCIA.pak setup.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\StudioSharedUI\DEPRECATED_pending_withbg.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\TerrainTools\mt_convert_part.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\VoiceChat\MicLight\Unmuted20.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\PlayStationController\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\VoiceChat\SpeakerDark\Muted.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\124.0.2478.97\Locales\nb.pak setup.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-sk-SK.js installer.exe File created C:\Program Files\ReasonLabs\Common\Client\v1.4.2\locales\et.pak RAVEndPointProtection-installer.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\xboxX.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\DesignSystem\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\ExtraContent\textures\ui\LuaApp\graphic\Auth\logo_white_luobu.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\particles\fire_color.dds RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\StudioToolbox\ArrowDownIconWhite.png RobloxPlayerLauncher.exe File created C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.X509Certificates.dll RAVEndPointProtection-installer.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\Controls\DefaultController\[email protected] RobloxPlayerLauncher.exe File created C:\Program Files\ReasonLabs\EPP\EDR\System.Security.Cryptography.Csp.dll RAVEndPointProtection-installer.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3708_1932102521\Filtering Rules msedge.exe File created C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-cs-CZ.js installer.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\icudtl.dat setup.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping3708_1535086814\json\i18n-hub\el\strings.json msedge.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\fonts\GothamSSm-Bold.otf RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\content\textures\ui\scrollbuttonUp_ovr.png RobloxPlayerLauncher.exe File created C:\Program Files (x86)\Microsoft\Temp\EUB3DF.tmp\NOTICE.TXT MicrosoftEdgeWebview2Setup.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\124.0.2478.97\Locales\ca.pak setup.exe -
Drops file in Windows directory 8 IoCs
Processes:
msiexec.exedescription ioc process File opened for modification C:\Windows\Installer\e6042ba.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{59C2C3AC-4B4D-49AC-8E31-C7DB8FD718B1} msiexec.exe File opened for modification C:\Windows\Installer\MSI767C.tmp msiexec.exe File created C:\Windows\Installer\e6042bc.msi msiexec.exe File created C:\Windows\Installer\e6042ba.msi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 26 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
rsEDRSvc.exevssvc.exetaskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service rsEDRSvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters rsEDRSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 rsEDRSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\DeviceDesc rsEDRSvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 rsEDRSvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters rsEDRSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters rsEDRSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\Control rsEDRSvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003f3ccc8c3b3921e10000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003f3ccc8c0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003f3ccc8c000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3f3ccc8c000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003f3ccc8c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\Control rsEDRSvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000\LogConf rsEDRSvc.exe -
Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
runonce.exersEDRSvc.exemsedge.exeKiller 7_L-x1Qr1.tmprunonce.exetaskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rsEDRSvc.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rsEDRSvc.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Killer 7_L-x1Qr1.tmp Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ Killer 7_L-x1Qr1.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rsEDRSvc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 msedge.exe Key opened \Registry\Machine\Hardware\Description\System\CentralProcessor rsEDRSvc.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rsEDRSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 27 IoCs
Processes:
RobloxPlayerLauncher.exeopera.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeopera.exeopera.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerLauncher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer opera.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer opera.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerLauncher.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName opera.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS opera.exe -
Kills process with taskkill 2 IoCs
Processes:
Taskkill.exeTaskkill.exepid process 8508 Taskkill.exe 3576 Taskkill.exe -
Processes:
RobloxPlayerLauncher.exesetup.exeassistant_installer.exeSearchApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\browser_assistant.exe = "9000" assistant_installer.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations setup.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Software\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29} setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\BHO" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\BHO" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe" setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerLauncher.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\GPU SearchApp.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute setup.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode setup.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
setup.exeMicrosoftEdgeUpdate.exeupdater.exersEDRSvc.exeupdater.exersWSC.exeupdater.exeMicrosoftEdgeUpdate.exersEngineSvc.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeServiceHost.exersSyncSvc.exersScanner_v3.9.1.exemsedge.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 931f0304e78106b1d2e0526dbbda06e6a3bc212c1392a9a89cefd0d25673d078 setup.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA rsEDRSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rsWSC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust rsEDRSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates rsWSC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rsEngineSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rsWSC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rsEngineSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust rsWSC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs ServiceHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed rsEDRSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs updater.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" rsSyncSvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rsSyncSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ServiceHost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" rsScanner_v3.9.1.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My rsEDRSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs rsEngineSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root updater.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing rsWSC.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" rsEngineSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rsEDRSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot rsEDRSvc.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople rsWSC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdgeUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs updater.exe -
Modifies registry class 64 IoCs
Processes:
setup.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeinstaller.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeRobloxPlayerLauncher.exeqbittorrent.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4A749F25-A9E2-4CBE-9859-CF7B15255E14}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\124.0.2478.80\\notification_click_helper.exe\"" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\image/svg+xml setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ = "IAppWeb" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF}\NumMethods\ = "41" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\CLASSES\MIME\Database setup.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\OperaStable\shell\open\ddeexec\Topic installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\Elevation MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1D3747B6-FED9-4795-BB56-E077C582FB69}\InprocHandler32 MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ = "Microsoft Edge Update Broker Class Factory" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\.html setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{8B15189E-5465-4166-933D-1EABAD9648CB}" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\ELEVATION MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32 MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CLSID\ = "{B5977F34-9264-4AC3-9B31-1224827FF6E8}" MicrosoftEdgeUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods\ = "17" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4F4A7E-977C-4E23-AD8F-626A491715DF} MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods\ = "4" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{837E40DA-EB1B-440C-8623-0F14DF158DC0}\NumMethods\ = "24" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods\ = "24" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\OperaStable\DefaultIcon installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp" MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ProxyStubClsid32 MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ = "ICoCreateAsync" MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D} MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83} MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerLauncher.exe Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\magnet\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\is-BPOK5.tmp\\qbittorrent.exe\",1" qbittorrent.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerLauncher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusSvc\ = "Google Update Policy Status Class" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\ = "IPolicyStatusValue" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\ProgID MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TypeLib\Version = "1.0" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CoreClass\CurVer\ = "MicrosoftEdgeUpdate.CoreClass.1" MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E50ED6A-8A46-4CB9-9E77-B99CBFED1E68}\InProcServer32\ThreadingModel = "Both" MicrosoftEdgeUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE} MicrosoftEdgeUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ProgID\ = "MicrosoftEdgeUpdate.CoreMachineClass.1" MicrosoftEdgeUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods MicrosoftEdgeUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E3D94CEB-EC11-46BE-8872-7DDCE37FABFA}\InprocHandler32 MicrosoftEdgeUpdateComRegisterShell64.exe -
Processes:
saBSI.exeServiceHost.exersEDRSvc.exersEngineSvc.exersWSC.exersEngineSvc.exeinstaller.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f ServiceHost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rsEDRSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c953000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df1400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3617e000000010000000800000000c0032f2df8d6016800000001000000000000000300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a rsEngineSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rsWSC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf50f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 rsEngineSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rsEDRSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E rsWSC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 5c000000010000000400000000080000190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e56800000001000000000000007e000000010000000800000000c0032f2df8d6011d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331336200000001000000200000009acfab7e43c8d880d06b262a94deeee4b4659989c3d0caf19baf6405e41ab7df09000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000006300000030613021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c9040000000100000010000000cb17e431673ee209fe455793f30afa1c2000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a rsEngineSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD ServiceHost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 rsEngineSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5 rsEngineSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c0000000100000004000000001000001900000001000000100000009f687581f7ef744ecfc12b9cee6238f1030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 rsEngineSvc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E rsEDRSvc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd rsWSC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f ServiceHost.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82 saBSI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 installer.exe -
NTFS ADS 2 IoCs
Processes:
msedge.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 571793.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 341525.crdownload:SmartScreen msedge.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 359 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
qbittorrent.exepid process 2800 qbittorrent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RobloxPlayerLauncher.exeMicrosoftEdgeUpdate.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepid process 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 5088 MicrosoftEdgeUpdate.exe 5088 MicrosoftEdgeUpdate.exe 2916 msedge.exe 2916 msedge.exe 4368 msedge.exe 4368 msedge.exe 508 identity_helper.exe 508 identity_helper.exe 6028 msedge.exe 6028 msedge.exe 5760 msedge.exe 5760 msedge.exe 5088 MicrosoftEdgeUpdate.exe 5088 MicrosoftEdgeUpdate.exe 5088 MicrosoftEdgeUpdate.exe 5088 MicrosoftEdgeUpdate.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe 4264 RobloxPlayerLauncher.exe -
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
Processes:
7zFM.exeqbittorrent.exe7zFM.exetaskmgr.exe7zFM.exepid process 5572 7zFM.exe 2800 qbittorrent.exe 8880 7zFM.exe 3792 taskmgr.exe 10368 7zFM.exe -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
fltmc.exepid process 8996 fltmc.exe 652 652 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
Processes:
msedge.exepid process 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MicrosoftEdgeUpdate.exe7zFM.exeGoogle.exeMicrosoftEdgeUpdate.exeprod0.exeRAVEndPointProtection-installer.exeqbittorrent.exeBCILauncher.EXEwevtutil.exefltmc.exewevtutil.exersWSC.exersWSC.exersEngineSvc.exersEDRSvc.exersEDRSvc.exersEngineSvc.exeRAVVPN-installer.exersVPNSvc.exedescription pid process Token: SeDebugPrivilege 5088 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 5088 MicrosoftEdgeUpdate.exe Token: SeRestorePrivilege 5572 7zFM.exe Token: 35 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeDebugPrivilege 1828 Google.exe Token: SeDebugPrivilege 1828 Google.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeSecurityPrivilege 5572 7zFM.exe Token: SeDebugPrivilege 4408 MicrosoftEdgeUpdate.exe Token: SeDebugPrivilege 3620 prod0.exe Token: SeDebugPrivilege 2892 RAVEndPointProtection-installer.exe Token: SeShutdownPrivilege 2892 RAVEndPointProtection-installer.exe Token: SeCreatePagefilePrivilege 2892 RAVEndPointProtection-installer.exe Token: 33 2800 qbittorrent.exe Token: SeIncBasePriorityPrivilege 2800 qbittorrent.exe Token: SeDebugPrivilege 2892 RAVEndPointProtection-installer.exe Token: SeDebugPrivilege 6496 BCILauncher.EXE Token: SeSecurityPrivilege 8256 wevtutil.exe Token: SeBackupPrivilege 8256 wevtutil.exe Token: SeLoadDriverPrivilege 8996 fltmc.exe Token: SeSecurityPrivilege 7284 wevtutil.exe Token: SeBackupPrivilege 7284 wevtutil.exe Token: SeDebugPrivilege 3912 rsWSC.exe Token: SeDebugPrivilege 5264 rsWSC.exe Token: SeDebugPrivilege 4992 rsEngineSvc.exe Token: SeDebugPrivilege 4992 rsEngineSvc.exe Token: SeDebugPrivilege 4992 rsEngineSvc.exe Token: SeBackupPrivilege 4992 rsEngineSvc.exe Token: SeRestorePrivilege 4992 rsEngineSvc.exe Token: SeLoadDriverPrivilege 4992 rsEngineSvc.exe Token: SeDebugPrivilege 8480 rsEDRSvc.exe Token: SeDebugPrivilege 6616 rsEDRSvc.exe Token: SeDebugPrivilege 3636 rsEngineSvc.exe Token: SeDebugPrivilege 3636 rsEngineSvc.exe Token: SeDebugPrivilege 3636 rsEngineSvc.exe Token: SeBackupPrivilege 3636 rsEngineSvc.exe Token: SeRestorePrivilege 3636 rsEngineSvc.exe Token: SeLoadDriverPrivilege 3636 rsEngineSvc.exe Token: SeDebugPrivilege 6616 rsEDRSvc.exe Token: SeDebugPrivilege 6616 rsEDRSvc.exe Token: SeDebugPrivilege 2272 RAVVPN-installer.exe Token: SeShutdownPrivilege 2272 RAVVPN-installer.exe Token: SeCreatePagefilePrivilege 2272 RAVVPN-installer.exe Token: SeShutdownPrivilege 3636 rsEngineSvc.exe Token: SeCreatePagefilePrivilege 3636 rsEngineSvc.exe Token: SeDebugPrivilege 2272 RAVVPN-installer.exe Token: SeDebugPrivilege 9128 rsVPNSvc.exe Token: SeDebugPrivilege 9128 rsVPNSvc.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exe7zFM.exepid process 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 5572 7zFM.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exeqbittorrent.exepid process 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 4368 msedge.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe -
Suspicious use of SetWindowsHookEx 63 IoCs
Processes:
qbittorrent.exeSearchApp.exemsedge.exeinstaller.exepid process 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 2800 qbittorrent.exe 9044 SearchApp.exe 9044 SearchApp.exe 9044 SearchApp.exe 9044 SearchApp.exe 9044 SearchApp.exe 9044 SearchApp.exe 10420 msedge.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe 1080 installer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
RobloxPlayerLauncher.exeRobloxPlayerLauncher.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedge.exedescription pid process target process PID 3032 wrote to memory of 4828 3032 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 3032 wrote to memory of 4828 3032 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 3032 wrote to memory of 4828 3032 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 3032 wrote to memory of 4264 3032 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 3032 wrote to memory of 4264 3032 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 3032 wrote to memory of 4264 3032 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 4264 wrote to memory of 1632 4264 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 4264 wrote to memory of 1632 4264 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 4264 wrote to memory of 1632 4264 RobloxPlayerLauncher.exe RobloxPlayerLauncher.exe PID 4264 wrote to memory of 1672 4264 RobloxPlayerLauncher.exe MicrosoftEdgeWebview2Setup.exe PID 4264 wrote to memory of 1672 4264 RobloxPlayerLauncher.exe MicrosoftEdgeWebview2Setup.exe PID 4264 wrote to memory of 1672 4264 RobloxPlayerLauncher.exe MicrosoftEdgeWebview2Setup.exe PID 1672 wrote to memory of 5088 1672 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 1672 wrote to memory of 5088 1672 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 1672 wrote to memory of 5088 1672 MicrosoftEdgeWebview2Setup.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 2964 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 2964 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 2964 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 4692 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 4692 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 4692 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4692 wrote to memory of 4916 4692 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 4692 wrote to memory of 4916 4692 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 4692 wrote to memory of 4696 4692 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 4692 wrote to memory of 4696 4692 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 4692 wrote to memory of 1044 4692 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 4692 wrote to memory of 1044 4692 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdateComRegisterShell64.exe PID 5088 wrote to memory of 4440 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 4440 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 4440 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 1316 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 1316 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 5088 wrote to memory of 1316 5088 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1336 wrote to memory of 1532 1336 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1336 wrote to memory of 1532 1336 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 1336 wrote to memory of 1532 1336 MicrosoftEdgeUpdate.exe MicrosoftEdgeUpdate.exe PID 4368 wrote to memory of 4268 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 4268 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe PID 4368 wrote to memory of 2264 4368 msedge.exe msedge.exe -
System policy modification 1 TTPs 8 IoCs
Processes:
msedge.exemsedge.exesetup.exemsedge.exemsedge.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedge.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\ setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedge.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection msedge.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exeC:\Users\Admin\AppData\Local\Temp\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://upload.crashes.rbxinfra.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=3b50cd7a1711a7bcc79000fcd87d819e29d4aca7 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x6e4,0x634,0x7b8,0x774,0x7c0,0x32eff4,0x32f004,0x32f0142⤵PID:4828
-
-
C:\Users\Admin\AppData\Local\Temp\RBX-CD3A33AD\RobloxPlayerLauncher.exe"C:\Users\Admin\AppData\Local\Temp\RBX-CD3A33AD\RobloxPlayerLauncher.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\RBX-CD3A33AD\RobloxPlayerLauncher.exeC:\Users\Admin\AppData\Local\Temp\RBX-CD3A33AD\RobloxPlayerLauncher.exe --crashpad --no-rate-limit --database=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --metrics-dir=C:\Users\Admin\AppData\Local\Temp\crashpad_roblox --url=https://uploads.backtrace.rbx.com/post --annotation=RobloxChannel=production --annotation=RobloxGitHash=ce85e2d3116edeac8759c2321c39314dee13b8a2 --annotation=UploadAttachmentKiloByteLimit=100 --annotation=UploadPercentage=100 --annotation=format=minidump --annotation=token=a2440b0bfdada85f34d79b43839f2b49ea6bba474bd7d126e844bc119271a1c3 --initial-client-data=0x554,0x570,0x574,0x544,0x588,0xc86bfc,0xc86c0c,0xc86c1c3⤵
- Executes dropped EXE
PID:1632
-
-
C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exeMicrosoftEdgeWebview2Setup.exe /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\Microsoft\Temp\EUB3DF.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUB3DF.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2964
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4916
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4696
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1044
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0Y4REEzQkUtNDc0Ny00MEE0LTk5MjItMDY5Q0M0NzZBRkQ2fSIgdXNlcmlkPSJ7MEY5MkYwMzMtRDIwNS00NEYxLTlBNzQtMkY0MzgyRDVDMkExfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InszNjFCMjc0Qi04QzcwLTQzRDEtQkI5QS0wNzEwMDVGQjRFMzF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RHhPYmpIR2ErblJhMmF0QzN3bytJRXBDNzgrWlllQVVia1hwREMyY2o3VT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NTM4NTY0NzIiIGluc3RhbGxfdGltZV9tcz0iNzkxIi8-PC9hcHA-PC9yZXF1ZXN0Pg5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4440
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{3F8DA3BE-4747-40A4-9922-069CC476AFD6}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0Y4REEzQkUtNDc0Ny00MEE0LTk5MjItMDY5Q0M0NzZBRkQ2fSIgdXNlcmlkPSJ7MEY5MkYwMzMtRDIwNS00NEYxLTlBNzQtMkY0MzgyRDVDMkExfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins4REI1NjVBNC1ERjAyLTQwQjktOUVDRi0yOTlGRTNFNEQzN0J9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTEwLjAuNTQ4MS4xMDQiIG5leHR2ZXJzaW9uPSIxMTAuMC41NDgxLjEwNCIgbGFuZz0iZW4iIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjUiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NTc5NjY1MjciLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:1532
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05D726BC-F72F-454B-AD16-D78E42BA2953}\MicrosoftEdge_X64_124.0.2478.97.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05D726BC-F72F-454B-AD16-D78E42BA2953}\MicrosoftEdge_X64_124.0.2478.97.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
PID:5140 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05D726BC-F72F-454B-AD16-D78E42BA2953}\EDGEMITMP_28E2D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05D726BC-F72F-454B-AD16-D78E42BA2953}\EDGEMITMP_28E2D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05D726BC-F72F-454B-AD16-D78E42BA2953}\MicrosoftEdge_X64_124.0.2478.97.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5772 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05D726BC-F72F-454B-AD16-D78E42BA2953}\EDGEMITMP_28E2D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05D726BC-F72F-454B-AD16-D78E42BA2953}\EDGEMITMP_28E2D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.201 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{05D726BC-F72F-454B-AD16-D78E42BA2953}\EDGEMITMP_28E2D.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.97 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff72cd588c0,0x7ff72cd588cc,0x7ff72cd588d84⤵
- Executes dropped EXE
PID:5892
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0Y4REEzQkUtNDc0Ny00MEE0LTk5MjItMDY5Q0M0NzZBRkQ2fSIgdXNlcmlkPSJ7MEY5MkYwMzMtRDIwNS00NEYxLTlBNzQtMkY0MzgyRDVDMkExfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntDQzNBODg5Qi00MTg3LTRFRUQtODUyNS01RUM1NjZEQTNCRDB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTI0LjAuMjQ3OC45NyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNDg2ODg2NjM5OSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4Njg5MTYzMTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjU1ODQ2MjU0IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8zMjc5OThlMy00MTM0LTRlYjEtYThlZi0xYTY3N2ZlMGIyNTk_UDE9MTcxNjA0MjUwOCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1IQTJLSGxSclQ4UlFNckxpenBjS1JoTTlJOE84M3hZc2lYSFhkQmJ4ejY5MnhFSVNDU0hDeiUyYnAweGlSNzY1MjdVdWhZY2RoN1BndEFpUGVWMDI5dmZ3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyODIxMDY0IiB0b3RhbD0iMTcyODIxMDY0IiBkb3dubG9hZF90aW1lX21zPSIzMDc2NiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUyNTYwNTYyMTMiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MjczODg2NTg0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NzM4NjA2NDg2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNzIzIiBkb3dubG9hZF90aW1lX21zPSIzODcwOCIgZG93bmxvYWRlZD0iMTcyODIxMDY0IiB0b3RhbD0iMTcyODIxMDY0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI0NjQ2NyIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:4172
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffbf7dc46f8,0x7ffbf7dc4708,0x7ffbf7dc47182⤵PID:4268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:2264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:82⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵PID:1724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵PID:2844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:12⤵PID:3644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:12⤵PID:4972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:82⤵PID:1044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:12⤵PID:692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵PID:4428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:12⤵PID:5276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:12⤵PID:5500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:5768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4884 /prefetch:82⤵PID:6020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:12⤵PID:5176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:12⤵PID:5380
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:12⤵PID:5420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:12⤵PID:5644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:12⤵PID:5808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6260 /prefetch:82⤵PID:5736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:12⤵PID:5740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6196 /prefetch:22⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:12⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 /prefetch:82⤵PID:5436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2780 /prefetch:12⤵PID:5676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:12⤵PID:5140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:12⤵PID:5692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:12⤵PID:764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:12⤵PID:4304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:1668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:12⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:12⤵PID:5140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:12⤵PID:5188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1812 /prefetch:12⤵PID:5240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:12⤵PID:3444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:12⤵PID:4744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:12⤵PID:6016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:12⤵PID:5840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:12⤵PID:1192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7564 /prefetch:82⤵PID:2196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6324 /prefetch:82⤵PID:3948
-
-
C:\Users\Admin\Downloads\Killer 7_L-x1Qr1.exe"C:\Users\Admin\Downloads\Killer 7_L-x1Qr1.exe"2⤵
- Executes dropped EXE
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\is-1T0RJ.tmp\Killer 7_L-x1Qr1.tmp"C:\Users\Admin\AppData\Local\Temp\is-1T0RJ.tmp\Killer 7_L-x1Qr1.tmp" /SL5="$100428,13603942,780800,C:\Users\Admin\Downloads\Killer 7_L-x1Qr1.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:5456 -
C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod0.exe"C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod0.exe" -ip:"dui=310807ab-751f-4d81-ae09-b202eaf21e19&dit=20240511143343&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=d267&a=100&b=em&se=true" -vp:"dui=310807ab-751f-4d81-ae09-b202eaf21e19&dit=20240511143343&oc=ZB_RAV_Cross_Tri_NCB&p=d267&a=100&oip=26&ptl=7&dta=true" -dp:"dui=310807ab-751f-4d81-ae09-b202eaf21e19&dit=20240511143343&oc=ZB_RAV_Cross_Tri_NCB&p=d267&a=100" -i -v -d -se=true4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\wwlattsq.exe"C:\Users\Admin\AppData\Local\Temp\wwlattsq.exe" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\nswCC52.tmp\RAVEndPointProtection-installer.exe"C:\Users\Admin\AppData\Local\Temp\nswCC52.tmp\RAVEndPointProtection-installer.exe" "C:\Users\Admin\AppData\Local\Temp\wwlattsq.exe" /silent6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -i -bn:ReasonLabs -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -dt:107⤵
- Executes dropped EXE
PID:4176
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngine.inf7⤵
- Adds Run key to start application
PID:9120 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r8⤵
- Checks processor information in registry
PID:9164 -
C:\Windows\Temp\MUBSTemp\BCILauncher.EXE"C:\Windows\Temp\MUBSTemp\BCILauncher.EXE" bgaupmi=54CD468A37DE4FE691A9914214B4F4239⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6496 -
C:\Windows\Temp\MUBSTemp\BingChatInstaller.exe"C:\Windows\Temp\MUBSTemp\BingChatInstaller.exe" BGAUPMI=54CD468A37DE4FE691A9914214B4F42310⤵
- Executes dropped EXE
- Adds Run key to start application
PID:7200
-
-
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o9⤵PID:5864
-
-
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\x64\rsKernelEngineEvents.xml7⤵
- Suspicious use of AdjustPrivilegeToken
PID:8256
-
-
C:\Windows\SYSTEM32\fltmc.exe"fltmc.exe" load rsKernelEngine7⤵
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:8996
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" im C:\Program Files\ReasonLabs\EPP\elam\evntdrv.xml7⤵
- Suspicious use of AdjustPrivilegeToken
PID:7284
-
-
C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe" -i -i7⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe" -i -i7⤵PID:7440
-
-
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe" -i -i7⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe" -i -i7⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:8480
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3mmcwwuu.exe"C:\Users\Admin\AppData\Local\Temp\3mmcwwuu.exe" /silent5⤵
- Loads dropped DLL
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\nsc97E0.tmp\RAVVPN-installer.exe"C:\Users\Admin\AppData\Local\Temp\nsc97E0.tmp\RAVVPN-installer.exe" "C:\Users\Admin\AppData\Local\Temp\3mmcwwuu.exe" /silent6⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2272 -
C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe" -i -i7⤵PID:2536
-
-
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe" -i -i7⤵
- Suspicious use of AdjustPrivilegeToken
PID:9128
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\rp5vokfk.exe"C:\Users\Admin\AppData\Local\Temp\rp5vokfk.exe" /silent5⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\nsh252B.tmp\SaferWeb-installer.exe"C:\Users\Admin\AppData\Local\Temp\nsh252B.tmp\SaferWeb-installer.exe" "C:\Users\Admin\AppData\Local\Temp\rp5vokfk.exe" /silent6⤵
- Drops file in Drivers directory
PID:6264 -
\??\c:\windows\system32\rundll32.exe"c:\windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Program Files\ReasonLabs\DNS\rsDwf.inf7⤵
- Adds Run key to start application
PID:10116 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r8⤵
- Checks processor information in registry
PID:10144 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o9⤵PID:10216
-
-
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe" -i -i7⤵PID:3492
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe" -i -service install7⤵PID:5980
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe" -service install7⤵PID:8584
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe" -i -i7⤵PID:2676
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod1_extract\saBSI.exe"C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod1_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:5816 -
C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod1_extract\installer.exe"C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod1_extract\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade5⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2716 -
C:\Program Files\McAfee\Temp4134757966\installer.exe"C:\Program Files\McAfee\Temp4134757966\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies system certificate store
PID:2312 -
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"7⤵PID:1052
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\WSSDep.dll"8⤵
- Loads dropped DLL
PID:7080
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\WSSDep.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
PID:8020
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"7⤵PID:7252
-
C:\Windows\SysWOW64\regsvr32.exe/s "C:\Program Files\McAfee\WebAdvisor\win32\DownloadScan.dll"8⤵
- Loads dropped DLL
PID:6612
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\McAfee\WebAdvisor\x64\DownloadScan.dll"7⤵
- Loads dropped DLL
- Registers COM server for autorun
PID:7724
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod2_extract\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod2_extract\OperaSetup.exe" --silent --allusers=0 --otd=utm.medium:apb,utm.source:ais,utm.campaign:opera_new_b4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod2_extract\OperaSetup.exeC:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod2_extract\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2c4,0x2c8,0x2cc,0x29c,0x2d0,0x6d96e1d0,0x6d96e1dc,0x6d96e1e85⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5108
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5876
-
-
C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod2_extract\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod2_extract\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=2672 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240511143356" --session-guid=f09fea7b-2c80-48b1-964c-1b6430511926 --server-tracking-blob=ZmE5YzFmMDNlZTRmNmYwZjgwOTY1ODc4MWYzOGRiNDg3YWIzOTYxNzg1ZTM4MGM1YzZjZDU0OTM4MWRlZTQxMjp7ImNvdW50cnkiOiJJTCIsImVkaXRpb24iOiJjZGYiLCJpbnN0YWxsZXJfbmFtZSI6Ik9wZXJhU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmEifSwicXVlcnkiOiIvZWRpdGlvbi9jZGY/dXRtX2NvbnRlbnQ9Y2RmJnV0bV9tZWRpdW09cGIiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTI0NzU3NzIuMDk1MiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjMuMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6Im9wZXJhX25ld19iIiwiY29udGVudCI6ImNkZiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6ImFpcyJ9LCJ1dWlkIjoiNGQ1NTg2MjEtNjlkNy00Nzk0LTk5ZDMtY2NmODEwMjY4YTg3In0= --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=2C050000000000005⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod2_extract\OperaSetup.exeC:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\prod2_extract\OperaSetup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.38 --initial-client-data=0x2bc,0x2c0,0x2d0,0x298,0x2d4,0x6ce2e1d0,0x6ce2e1dc,0x6ce2e1e86⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4536
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\installer.exe" --backend --initial-pid=2672 --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --show-intro-overlay --package-dir="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561" --session-guid=f09fea7b-2c80-48b1-964c-1b6430511926 --server-tracking-blob=ZmE5YzFmMDNlZTRmNmYwZjgwOTY1ODc4MWYzOGRiNDg3YWIzOTYxNzg1ZTM4MGM1YzZjZDU0OTM4MWRlZTQxMjp7ImNvdW50cnkiOiJJTCIsImVkaXRpb24iOiJjZGYiLCJpbnN0YWxsZXJfbmFtZSI6Ik9wZXJhU2V0dXAuZXhlIiwicHJvZHVjdCI6eyJuYW1lIjoib3BlcmEifSwicXVlcnkiOiIvZWRpdGlvbi9jZGY/dXRtX2NvbnRlbnQ9Y2RmJnV0bV9tZWRpdW09cGIiLCJzeXN0ZW0iOnsicGxhdGZvcm0iOnsiYXJjaCI6Ing4Nl82NCIsIm9wc3lzIjoiV2luZG93cyIsIm9wc3lzLXZlcnNpb24iOiIxMCIsInBhY2thZ2UiOiJFWEUifX0sInRpbWVzdGFtcCI6IjE3MTI0NzU3NzIuMDk1MiIsInVzZXJhZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMjMuMC4wLjAgU2FmYXJpLzUzNy4zNiIsInV0bSI6eyJjYW1wYWlnbiI6Im9wZXJhX25ld19iIiwiY29udGVudCI6ImNkZiIsIm1lZGl1bSI6ImFwYiIsInNvdXJjZSI6ImFpcyJ9LCJ1dWlkIjoiNGQ1NTg2MjEtNjlkNy00Nzk0LTk5ZDMtY2NmODEwMjY4YTg3In0= --silent --desktopshortcut=1 --install-subfolder=109.0.5097.806⤵
- Registers COM server for autorun
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1080 -
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ffbeee47c80,0x7ffbeee47c8c,0x7ffbeee47c987⤵PID:5240
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --copyonly=0 --allusers=07⤵
- Adds Run key to start application
- Modifies Internet Explorer settings
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x666038,0x666044,0x6660508⤵PID:10648
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --ran-launcher --install-extension="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\be76331b95dfc399cd776d2fc68021e0db03cc4f.crx"7⤵
- Adds Run key to start application
- Checks system information in the registry
- Enumerates system info in registry
PID:9416 -
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7ffbc5b7d650,0x7ffbc5b7d660,0x7ffbc5b7d6708⤵PID:11128
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2000,i,6045522665134418991,12415803652984952630,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:28⤵PID:2716
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=1956,i,6045522665134418991,12415803652984952630,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:38⤵PID:3028
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2336,i,6045522665134418991,12415803652984952630,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:88⤵PID:5008
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized7⤵PID:11160
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7ffbc5b7d650,0x7ffbc5b7d660,0x7ffbc5b7d6708⤵PID:10048
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\Assistant_109.0.5097.45_Setup.exe_sfx.exe"5⤵
- Executes dropped EXE
PID:7364
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\assistant_installer.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8132 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x10f6038,0x10f6044,0x10f60506⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8184
-
-
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\qbittorrent.exe "qBittorrent" ENABLE4⤵
- Modifies Windows Firewall
PID:5688
-
-
C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\qbittorrent.exe"C:\Users\Admin\AppData\Local\Temp\is-BPOK5.tmp\qbittorrent.exe" magnet:?xt=urn:btih:C8714B5F4799A6B30BADA30033FFF7F4FABF1FA14⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2800
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:6696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:12⤵PID:6880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:12⤵PID:8844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 /prefetch:82⤵PID:896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7472 /prefetch:82⤵PID:4016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6988 /prefetch:82⤵PID:6684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7660 /prefetch:82⤵PID:2812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=7108 /prefetch:82⤵PID:9356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6860 /prefetch:82⤵PID:8708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:12⤵PID:4528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:12⤵PID:10200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:7064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:12⤵PID:9056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:12⤵PID:2564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7656 /prefetch:12⤵PID:6580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:12⤵PID:1856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:9020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:12⤵PID:7532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:12⤵PID:3552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:12⤵PID:8452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8360 /prefetch:82⤵PID:8264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8496 /prefetch:12⤵PID:10032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8584 /prefetch:12⤵PID:10080
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8808 /prefetch:12⤵PID:9780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8584 /prefetch:12⤵PID:5472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:12⤵PID:5996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:9420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8416 /prefetch:12⤵PID:7880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:12⤵PID:3496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8704 /prefetch:12⤵PID:9812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:12⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8520 /prefetch:12⤵PID:9624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7584 /prefetch:12⤵PID:9064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8140 /prefetch:12⤵PID:9356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8508 /prefetch:12⤵PID:8296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:12⤵PID:9776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8012 /prefetch:12⤵PID:9704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8744 /prefetch:12⤵PID:212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9140 /prefetch:12⤵PID:9700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8764 /prefetch:12⤵PID:9768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:12⤵PID:8556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8552 /prefetch:12⤵PID:5188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:12⤵PID:6176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8560 /prefetch:12⤵PID:3792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6716 /prefetch:12⤵PID:528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9280 /prefetch:12⤵PID:3580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9208 /prefetch:12⤵PID:3508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9296 /prefetch:12⤵PID:8168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9364 /prefetch:12⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7984 /prefetch:12⤵PID:6684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9472 /prefetch:12⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:12⤵PID:9960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9344 /prefetch:12⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9884 /prefetch:12⤵PID:9368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9956 /prefetch:12⤵PID:5876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:12⤵PID:10128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9388 /prefetch:12⤵PID:9232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵PID:7668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10232 /prefetch:12⤵PID:3628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9260 /prefetch:12⤵PID:1284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7884 /prefetch:12⤵PID:4936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:9348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10188 /prefetch:12⤵PID:6652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8128 /prefetch:12⤵PID:10088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10196 /prefetch:12⤵PID:9896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9944 /prefetch:12⤵PID:9264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10024 /prefetch:12⤵PID:7716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8128 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9644 /prefetch:82⤵PID:9956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9640 /prefetch:12⤵PID:9776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9840 /prefetch:82⤵PID:5644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9736 /prefetch:12⤵PID:4048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9368 /prefetch:12⤵PID:5696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9400 /prefetch:12⤵PID:8972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9472 /prefetch:12⤵PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9888 /prefetch:12⤵PID:3616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10112 /prefetch:12⤵PID:4888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10120 /prefetch:12⤵PID:8700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8760 /prefetch:12⤵PID:5232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9260 /prefetch:12⤵PID:4420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10212 /prefetch:12⤵PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10004 /prefetch:12⤵PID:10028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:12⤵PID:7276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9556 /prefetch:12⤵PID:3264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10284 /prefetch:12⤵PID:4952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10736 /prefetch:12⤵PID:7384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10416 /prefetch:12⤵PID:10180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10480 /prefetch:82⤵PID:8412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10876 /prefetch:12⤵PID:5068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6684 /prefetch:12⤵PID:8816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10824 /prefetch:12⤵PID:7044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10908 /prefetch:12⤵PID:9384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11052 /prefetch:12⤵PID:9728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8344 /prefetch:12⤵PID:8604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:12⤵PID:5356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=8776 /prefetch:82⤵PID:6684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=156 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10960 /prefetch:12⤵PID:9644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4124 /prefetch:82⤵PID:2280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵PID:10984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=160 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:12⤵PID:1036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7024 /prefetch:12⤵PID:11088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=164 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:12⤵PID:2856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=165 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9920 /prefetch:12⤵PID:4776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=166 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7720 /prefetch:12⤵PID:4340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=168 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7988 /prefetch:12⤵PID:6668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=169 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:12⤵PID:10848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11784 /prefetch:82⤵PID:8340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3060 /prefetch:82⤵PID:1596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2948 /prefetch:22⤵PID:10532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6328 /prefetch:82⤵PID:10748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6680 /prefetch:22⤵PID:8908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=11796 /prefetch:82⤵PID:10512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,3955852250848559712,15707686509428572347,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=8900 /prefetch:82⤵PID:2720
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3704
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4080
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2132
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5572 -
C:\Users\Admin\AppData\Local\Temp\7zO4C5A018A\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5A018A\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc ONLOGON /RL HIGHEST /tn LimeRAT-Admin /tr "'C:\Users\Admin\AppData\Local\Temp\system\Google.exe'"3⤵
- Creates scheduled task(s)
PID:1956
-
-
C:\Users\Admin\AppData\Local\Temp\system\Google.exe"C:\Users\Admin\AppData\Local\Temp\system\Google.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5ED5AA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5ED5AA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:5972
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5A1ADA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5A1ADA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:5760
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5409DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5409DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:3248
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5E08DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5E08DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:3624
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C580FDA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C580FDA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:3580
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C536EDA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C536EDA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:5432
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5BBCDA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5BBCDA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:5540
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5173DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5173DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:1192
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5862DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5862DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5341DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5341DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:2280
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5DB7DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5DB7DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:5492
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C54A6DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C54A6DA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:4872
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C512BCA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C512BCA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:5196
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C597ACA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C597ACA\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:4780
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5D18AB\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5D18AB\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C545FAB\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C545FAB\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:5968
-
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5FBDAB\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"C:\Users\Admin\AppData\Local\Temp\7zO4C5FBDAB\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe"2⤵
- Executes dropped EXE
PID:3408
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious use of AdjustPrivilegeToken
PID:4408
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:5044 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0374AC67-8791-49B1-B224-8E637682414C}\BGAUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{0374AC67-8791-49B1-B224-8E637682414C}\BGAUpdate.exe" --edgeupdate-client --system-level2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:7564
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MzVFRDAzMUYtM0NCQS00N0RCLUExOTktQUEzQ0QyNENFRjc2fSIgdXNlcmlkPSJ7MEY5MkYwMzMtRDIwNS00NEYxLTlBNzQtMkY0MzgyRDVDMkExfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntGMUYwRkM2QS0yODk3LTQwNkUtODU3Qi1BOUIxNkEwMTMyMTl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7MUZBQjhDRkUtOTg2MC00MTVDLUE2Q0EtQUE3RDEyMDIxOTQwfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMi4wLjAuMzQiIGxhbmc9IiIgYnJhbmQ9IkVVRkkiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iLTEiIGluc3RhbGxkYXRlPSItMSI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3ODUyMTk2NDQ1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzg1MjI2NjQ0MCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTQ5MTY2NTMyIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWYxOTU2MTItMzg0YS00OGVhLTg0MDgtYjRlZGU5ZGM1NmJiP1AxPTE3MTYwNDI4MDYmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RldvZjdQJTJmNiUyZldXUUJybnlaMlFRbnFYVmRidkpMM2pXNjFwamVrZndHZjd2cWI5aTRURXRsTzNBeHZlS2FGNlIyUkM3enV6cXN2bkNaYllZdzlJNlp3JTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTQ5MTg2MzgwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy81ZjE5NTYxMi0zODRhLTQ4ZWEtODQwOC1iNGVkZTlkYzU2YmI_UDE9MTcxNjA0MjgwNiZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1GV29mN1AlMmY2JTJmV1dRQnJueVoyUVFucVhWZGJ2Skwzalc2MXBqZWtmd0dmN3ZxYjlpNFRFdGxPM0F4dmVLYUY2UjJSQzd6dXpxc3ZuQ1piWVl3OUk2WnclM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxODA0NDQ0OCIgdG90YWw9IjE4MDQ0NDQ4IiBkb3dubG9hZF90aW1lX21zPSI2NDAzOSIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1NTAxNDYzODkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTY0MjA2MzQ1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODU2NzA4NjU3NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjU5OCIgZG93bmxvYWRfdGltZV9tcz0iNjk2NzciIGRvd25sb2FkZWQ9IjE4MDQ0NDQ4IiB0b3RhbD0iMTgwNDQ0NDgiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjI4NiIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
PID:8180
-
-
C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:101⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4932 -
C:\Program Files\ReasonLabs\rsScanner_v3.9.1.exe"C:\Program Files\ReasonLabs\Common\..\rsScanner_v3.9.1.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:10204 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Program Files\ReasonLabs\rsScanner_v3.9.1.exe"3⤵PID:7524
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵PID:5720
-
-
-
-
C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:7264 -
C:\Program Files\McAfee\WebAdvisor\UIHost.exe"C:\Program Files\McAfee\WebAdvisor\UIHost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul2⤵PID:6876
-
-
C:\Program Files\McAfee\WebAdvisor\updater.exe"C:\Program Files\McAfee\WebAdvisor\updater.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:8048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul2⤵PID:780
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul2⤵PID:6000
-
-
C:\Program Files\McAfee\WebAdvisor\updater.exe"C:\Program Files\McAfee\WebAdvisor\updater.exe"2⤵
- Modifies data under HKEY_USERS
PID:1320
-
-
C:\Program Files\McAfee\WebAdvisor\updater.exe"C:\Program Files\McAfee\WebAdvisor\updater.exe"2⤵
- Modifies data under HKEY_USERS
PID:5544
-
-
C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5264
-
C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"C:\Program Files\ReasonLabs\EPP\rsClientSvc.exe"1⤵PID:3076
-
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3636 -
\??\c:\program files\reasonlabs\epp\rsHelper.exe"c:\program files\reasonlabs\epp\rsHelper.exe"2⤵PID:8484
-
-
\??\c:\program files\reasonlabs\EPP\ui\EPP.exe"c:\program files\reasonlabs\EPP\ui\EPP.exe" --minimized --first-run2⤵PID:7564
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\EPP\ui\app.asar" --engine-path="c:\program files\reasonlabs\EPP" --minimized --first-run3⤵
- Checks computer location settings
PID:3676 -
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2256 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵PID:8084
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2580 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵PID:6296
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2832 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Checks computer location settings
PID:8868
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3828 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵
- Checks computer location settings
PID:4564 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4564 -s 12805⤵PID:5132
-
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4348 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵PID:2608
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3028 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵PID:4420
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3024 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵PID:6864
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4204 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:10264
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4548 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:3196
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3008 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:10216
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3000 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:1028
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4888 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:10964
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4432 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:2160
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3020 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:1332
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2396 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:6632
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4984 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:10772
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5196 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:6812
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5332 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:9836
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5488 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:5252
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4352 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:6088
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=3888 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:2432
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5816 --field-trial-handle=2260,i,1833324760904124392,2941377732458146258,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:9640
-
-
-
-
C:\program files\reasonlabs\epp\rsLitmus.A.exe"C:\program files\reasonlabs\epp\rsLitmus.A.exe"2⤵PID:10076
-
-
C:\Users\Admin\AppData\Local\Temp\REASON~2.EXE"C:\Users\Admin\AppData\Local\Temp\REASON~2.EXE" /silentwithprogressbar2⤵PID:4112
-
C:\Windows\TEMP\nsbFFB7.tmp\ReasonVpnInstaller.exe"C:\Windows\TEMP\nsbFFB7.tmp\ReasonVpnInstaller.exe" /silentwithprogressbar3⤵PID:4452
-
C:\Windows\TEMP\nsbEF.tmp\RAVVPN-installer.exe"C:\Windows\TEMP\nsbEF.tmp\RAVVPN-installer.exe" "C:\Windows\TEMP\nsbFFB7.tmp\ReasonVpnInstaller.exe" /silentwithprogressbar4⤵PID:9388
-
C:\Windows\system32\Tskill.exe"C:\Windows\system32\Tskill.exe" 85405⤵PID:10096
-
-
C:\Windows\system32\Taskkill.exe"C:\Windows\system32\Taskkill.exe" /f /pid 85405⤵
- Kills process with taskkill
PID:8508
-
-
C:\Windows\system32\Tskill.exe"C:\Windows\system32\Tskill.exe" 79805⤵PID:9372
-
-
C:\Windows\system32\Taskkill.exe"C:\Windows\system32\Taskkill.exe" /f /pid 79805⤵
- Kills process with taskkill
PID:3576
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\REASON~1.EXE"C:\Users\Admin\AppData\Local\Temp\REASON~1.EXE" /silentwithprogressbar2⤵PID:10492
-
C:\Windows\TEMP\nsb5.tmp\ReasonSaferWebInstaller.exe"C:\Windows\TEMP\nsb5.tmp\ReasonSaferWebInstaller.exe" /silentwithprogressbar3⤵PID:10912
-
C:\Windows\TEMP\nsrFF.tmp\SaferWeb-installer.exe"C:\Windows\TEMP\nsrFF.tmp\SaferWeb-installer.exe" "C:\Windows\TEMP\nsb5.tmp\ReasonSaferWebInstaller.exe" /silentwithprogressbar4⤵PID:1188
-
-
-
-
C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe"1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Checks system information in the registry
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:6616
-
C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"1⤵PID:7188
-
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"1⤵
- Loads dropped DLL
PID:3456 -
\??\c:\program files\reasonlabs\VPN\ui\VPN.exe"c:\program files\reasonlabs\VPN\ui\VPN.exe" --minimized --focused --first-run2⤵PID:8196
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\VPN\ui\app.asar" --engine-path="c:\program files\reasonlabs\VPN" --minimized --focused --first-run3⤵
- Loads dropped DLL
PID:8540 -
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2212 --field-trial-handle=2216,i,7184140120074210723,10589574119823190043,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵PID:5408
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --mojo-platform-channel-handle=2664 --field-trial-handle=2216,i,7184140120074210723,10589574119823190043,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵PID:2032
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --app-user-model-id=com.reasonlabs.vpn --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2744 --field-trial-handle=2216,i,7184140120074210723,10589574119823190043,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:7980
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --app-user-model-id=com.reasonlabs.vpn --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3872 --field-trial-handle=2216,i,7184140120074210723,10589574119823190043,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:4856
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3428 --field-trial-handle=2216,i,7184140120074210723,10589574119823190043,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵PID:5524
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2116
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:7204 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{56E08843-1A17-4A86-A222-9629484928D6}\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{56E08843-1A17-4A86-A222-9629484928D6}\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe" /update /sessionid "{DA592171-D90D-4FCF-9055-C9B8E3F24A6D}"2⤵PID:8908
-
C:\Program Files (x86)\Microsoft\Temp\EU345.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EU345.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{DA592171-D90D-4FCF-9055-C9B8E3F24A6D}"3⤵
- Sets file execution options in registry
- Checks system information in the registry
PID:8976 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc4⤵
- Modifies registry class
PID:10164
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver4⤵
- Modifies registry class
PID:4100 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Registers COM server for autorun
- Modifies registry class
PID:7348
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Registers COM server for autorun
- Modifies registry class
PID:8684
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.187.37\MicrosoftEdgeUpdateComRegisterShell64.exe"5⤵
- Registers COM server for autorun
- Modifies registry class
PID:6708
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REE1OTIxNzEtRDkwRC00RkNGLTkwNTUtQzlCOEUzRjI0QTZEfSIgdXNlcmlkPSJ7MEY5MkYwMzMtRDIwNS00NEYxLTlBNzQtMkY0MzgyRDVDMkExfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7RkI3NzgyRkMtQ0Y1MS00RkQxLUI3NjgtMjM4N0U1MTUwM0U4fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNzEuMzkiIG5leHR2ZXJzaW9uPSIxLjMuMTg3LjM3IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMiIgaW5zdGFsbGRhdGV0aW1lPSIxNzE1MTk1MzQ0Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5Njg2MTQxOTU3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg4⤵
- Checks system information in the registry
PID:5800
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7REE1OTIxNzEtRDkwRC00RkNGLTkwNTUtQzlCOEUzRjI0QTZEfSIgdXNlcmlkPSJ7MEY5MkYwMzMtRDIwNS00NEYxLTlBNzQtMkY0MzgyRDVDMkExfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9IntDNUI4NDEyQy1FRkIxLTQxMTItQTJEMi0zQUJGNERDMzhFMkF9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE3MS4zOSIgbmV4dHZlcnNpb249IjEuMy4xODcuMzciIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPS10YXJnZXRfZGV2O1Byb2R1Y3RzVG9SZWdpc3Rlcj0lN0IxRkFCOENGRS05ODYwLTQxNUMtQTZDQS1BQTdEMTIwMjE5NDAlN0QiIGluc3RhbGxhZ2U9IjIiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjkxMjA5MDY0OTYiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTEyMTI1NjI2MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTYxODY3MTg1NSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzFkZjQyMDgzLTE3YTEtNDRiOS05NDVhLTQxNjg3MTE0NjhjMj9QMT0xNzE2MDQyOTMzJmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUlLZ2RLJTJiUXppdWdJWVZ6dmZ2R3ROcCUyZjNUb25uM0tGOEVWJTJiJTJmbWclMmJxVzlPRFZkZDF4QmFWZVB2enJ0UVZlZFk5V2x3RkE2Y2pOeGFwJTJiOUdrUWkxbzdBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjYiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTYxODcwMTg5MiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMWRmNDIwODMtMTdhMS00NGI5LTk0NWEtNDE2ODcxMTQ2OGMyP1AxPTE3MTYwNDI5MzMmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9SUtnZEslMmJReml1Z0lZVnp2ZnZHdE5wJTJmM1Rvbm4zS0Y4RVYlMmIlMmZtZyUyYnFXOU9EVmRkMXhCYVZlUHZ6cnRRVmVkWTlXbHdGQTZjak54YXAlMmI5R2tRaTFvN0ElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNjIyMDcyIiB0b3RhbD0iMTYyMjA3MiIgZG93bmxvYWRfdGltZV9tcz0iNDkzMDciLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iOTYxODczMTk5NiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5NjIzOTEyMTk5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iMyIgcmQ9IjYzMzciIHBpbmdfZnJlc2huZXNzPSJ7MkY4OTMxNEItMDVFRS00QjVBLThGNUUtMjBGNEQwMjJDMDFEfSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIyIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM1OTkxMTMyNTYzMTI0MjAiPjx1cGRhdGVjaGVjay8-PHBpbmcgYWN0aXZlPSIxIiBhPSIzIiByPSIzIiBhZD0iNjMzNyIgcmQ9IjYzMzciIHBpbmdfZnJlc2huZXNzPSJ7NjdDRTBDNjEtNTA5MC00NjAzLUEwODMtMUU5QUZCREExRTIyfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMjQuMC4yNDc4Ljk3IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGU9IjYzMzUiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins4QzU2QTAyMS0wOUMxLTQ4QTUtQkE1MS1DQUVBREE5RUQ0OUV9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
PID:7212
-
-
C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSClientSvc.exe"1⤵PID:5072
-
C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"C:\Program Files\ReasonLabs\DNS\rsDNSResolver.exe"1⤵PID:4344
-
C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe"C:\Program Files\ReasonLabs\DNS\rsDNSSvc.exe"1⤵PID:6964
-
\??\c:\program files\reasonlabs\DNS\ui\DNS.exe"c:\program files\reasonlabs\DNS\ui\DNS.exe" --minimized --focused --first-run2⤵PID:3408
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" "c:\program files\reasonlabs\DNS\ui\app.asar" --engine-path="c:\program files\reasonlabs\DNS" --minimized --focused --first-run3⤵
- Checks computer location settings
PID:5016 -
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2356 --field-trial-handle=2360,i,3597154175100690155,2448506014526648790,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵PID:9268
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --mojo-platform-channel-handle=2580 --field-trial-handle=2360,i,3597154175100690155,2448506014526648790,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:84⤵PID:9168
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --app-user-model-id=com.reasonlabs.dns --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2740 --field-trial-handle=2360,i,3597154175100690155,2448506014526648790,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:14⤵PID:9116
-
-
C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\ReasonLabs\DNS" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3836 --field-trial-handle=2360,i,3597154175100690155,2448506014526648790,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:24⤵PID:9708
-
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:10028
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1612
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5604
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\44d9ca8ec43a253091b8994afd3fb22a78f892f201eaf7b21cc5252843b6326a.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:8880 -
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\7zO0B279E6F\44d9ca8ec43a253091b8994afd3fb22a78f892f201eaf7b21cc5252843b6326a.msi"2⤵
- Enumerates connected drives
PID:4524
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:4316 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:2432
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DA435EC694A67F1DBC9E68581D5FF4142⤵PID:8812
-
-
C:\Users\Admin\AppData\Local\Programs\GiliSoft AI Community\AndroidAssistServer.exe"C:\Users\Admin\AppData\Local\Programs\GiliSoft AI Community\AndroidAssistServer.exe"2⤵PID:3312
-
C:\Users\Admin\AppData\Local\Programs\Magic Inventor Factory Suite\AndroidAssistServer.exe"C:\Users\Admin\AppData\Local\Programs\Magic Inventor Factory Suite\AndroidAssistServer.exe"3⤵
- Maps connected drives based on registry
PID:3948
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:5736
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x304 0x4a81⤵PID:5504
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:10164
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵PID:8612
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Checks system information in the registry
- Modifies data under HKEY_USERS
PID:9468 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDZEQzVFREYtMTc4OC00MjAzLTlCQzUtRjVENkQ1MEExOTFCfSIgdXNlcmlkPSJ7MEY5MkYwMzMtRDIwNS00NEYxLTlBNzQtMkY0MzgyRDVDMkExfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NDNDMEI0NkMtRDI4Ni00MTc0LTlFMkYtNDAwQjEwMjQ0MUYyfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0R4T2JqSEdhK25SYTJhdEMzd28rSUVwQzc4K1pZZUFVYmtYcERDMmNqN1U9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjExMC4wLjU0ODEuMTA0IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIzIiBpbnN0YWxsZGF0ZXRpbWU9IjE3MTUxNzEyMzUiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM1OTY2ODkzOTQwNjc5MTAiIGZpcnN0X2ZyZV9zZWVuX3RpbWU9IjEzMzU5OTExNjE1Nzc1MjI5MCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIzMTA2NzYiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMDI5NzI2NDM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
PID:9340
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\MicrosoftEdge_X64_124.0.2478.80.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\MicrosoftEdge_X64_124.0.2478.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable2⤵PID:10920
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\MicrosoftEdge_X64_124.0.2478.80.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable3⤵
- Modifies Installed Components in the registry
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- System policy modification
PID:6264 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7d26988c0,0x7ff7d26988cc,0x7ff7d26988d84⤵PID:9972
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Drops file in System32 directory
PID:10924 -
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{29C062D3-8BA3-4E99-8034-30740342D7AA}\EDGEMITMP_F8C7D.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff7d26988c0,0x7ff7d26988cc,0x7ff7d26988d85⤵PID:9056
-
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODcuMzciIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDZEQzVFREYtMTc4OC00MjAzLTlCQzUtRjVENkQ1MEExOTFCfSIgdXNlcmlkPSJ7MEY5MkYwMzMtRDIwNS00NEYxLTlBNzQtMkY0MzgyRDVDMkExfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InswNjEzMDQyQS01RTFDLTQwRjYtQjM1OC1DQjg1NTNFMDY5MUJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE4Ny4zNyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9LXRhcmdldF9kZXY7UHJvZHVjdHNUb1JlZ2lzdGVyPSU3QjFGQUI4Q0ZFLTk4NjAtNDE1Qy1BNkNBLUFBN0QxMjAyMTk0MCU3RCIgaW5zdGFsbGFnZT0iMiIgY29ob3J0PSJycmZAMC40MyI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNjM0MCIgcGluZ19mcmVzaG5lc3M9IntFOTIxMkI2MC00OTY5LTRDQUYtQkE4Qi03OTM0N0I1NkE4RjB9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkyLjAuOTAyLjY3IiBuZXh0dmVyc2lvbj0iMTI0LjAuMjQ3OC44MCIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSIyIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNTk5MTEzMjU2MzEyNDIwIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzA0MjY1NjI2MyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMzA0MjcwNjIzMyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM3MzYwOTEwOTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImRvIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy80NDRhZjMwZS1mMmU3LTQwYmQtYjQ1Yi01OGQ1OWQwMDA0NDk_UDE9MTcxNjA0MzMyNSZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1VMnFIbEJFcDRuNXdNM2RYbGR5Vnlsdk5Ccm1ud2h2d3NCQVV0VDBWWHN2aE5sSExkczJWdXU5UGRHdGtIb2FVa0wlMmJ3RWdmSGE3azNxWDd1b0NJNzdnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjkiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTM3MzYxMjExODYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzQ0NGFmMzBlLWYyZTctNDBiZC1iNDViLTU4ZDU5ZDAwMDQ0OT9QMT0xNzE2MDQzMzI1JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVUycUhsQkVwNG41d00zZFhsZHlWeWx2TkJybW53aHZ3c0JBVXRUMFZYc3ZoTmxITGRzMlZ1dTlQZEd0a0hvYVVrTCUyYndFZ2ZIYTdrM3FYN3VvQ0k3N2clM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzI3OTY0NzIiIHRvdGFsPSIxNzI3OTY0NzIiIGRvd25sb2FkX3RpbWVfbXM9IjYxNjA4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNzM2MTUxMTMzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNzUzNDYxMTMzIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDU3OTMzMTg4OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9Ijc4OSIgZG93bmxvYWRfdGltZV9tcz0iNjkzMjQiIGRvd25sb2FkZWQ9IjE3Mjc5NjQ3MiIgdG90YWw9IjE3Mjc5NjQ3MiIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iODI1ODUiLz48cGluZyBhY3RpdmU9IjEiIGFkPSI2MzQwIiByZD0iNjM0MCIgcGluZ19mcmVzaG5lc3M9IntBNDg3NEUxOC0xNkIyLTRDMzktQkQ5MC05NDQxNDdBQjNFMDJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjEyNC4wLjI0NzguOTciIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIwIiBpbnN0YWxsZGF0ZT0iNjMzNSIgY29ob3J0PSJycmZAMC43MCI-PHVwZGF0ZWNoZWNrLz48cGluZyByZD0iNjM0MCIgcGluZ19mcmVzaG5lc3M9Ins5QTBCQ0IxNy00OUYwLTRCN0MtOTY3Qy0wQkZFMjZGODZFOEN9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Checks system information in the registry
PID:10632
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:9044
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
PID:3792
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4132
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:11064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffc074f46f8,0x7ffc074f4708,0x7ffc074f47182⤵PID:10780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,1312892284621434366,17649649688818728740,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:22⤵PID:3912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,1312892284621434366,17649649688818728740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:32⤵PID:11168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end2⤵
- Checks whether UAC is enabled
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- System policy modification
PID:8388 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffbfa13ceb8,0x7ffbfa13cec4,0x7ffbfa13ced03⤵
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
PID:10540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2080,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:23⤵PID:5328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1984,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:33⤵PID:8032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2484,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:83⤵PID:4544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3380,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:13⤵PID:9528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3368,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:13⤵
- Checks computer location settings
PID:9372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4680,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:23⤵PID:9660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3356,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:83⤵PID:9488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5408,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:23⤵PID:10592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5712,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:83⤵PID:6088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5892,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:83⤵PID:9484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=6044,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:83⤵PID:2960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5556,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:83⤵PID:5224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6424,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:83⤵PID:1836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1988,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:13⤵
- Checks computer location settings
PID:6684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6568,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:13⤵
- Checks computer location settings
PID:9636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5620,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:13⤵
- Checks computer location settings
PID:10424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5756,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:13⤵PID:6700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5336,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:13⤵PID:3280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=7560,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:13⤵
- Checks computer location settings
PID:2328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=7676,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:13⤵
- Checks computer location settings
PID:11200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7908,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:83⤵PID:5944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=8076,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:83⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=8076,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8096 /prefetch:83⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7856,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:83⤵PID:7432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8340,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:83⤵PID:8436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5544,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:83⤵PID:4868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=8180,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:13⤵
- Checks computer location settings
PID:10116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=8312,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8748 /prefetch:13⤵PID:10964
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.dab7dfe128bdd3dc > \\.\pipe\chrome.nativeMessaging.out.dab7dfe128bdd3dc3⤵PID:9592
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:3228
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.ee8099232b4b3209 > \\.\pipe\chrome.nativeMessaging.out.ee8099232b4b32093⤵PID:10068
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:1624
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8536,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:83⤵PID:5656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4812,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:83⤵PID:5624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=9068,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:83⤵PID:11260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8768,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9108 /prefetch:83⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=3880,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:13⤵PID:10332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=9248,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:13⤵
- Checks computer location settings
PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=9404,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9424 /prefetch:13⤵
- Checks computer location settings
PID:10460
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=564,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:83⤵PID:4520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5008,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9584 /prefetch:83⤵PID:7836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=9668,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9672 /prefetch:83⤵PID:4084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4976,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7984 /prefetch:83⤵PID:9420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5824,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9940 /prefetch:83⤵PID:8684
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.9a9080e28a51f474 > \\.\pipe\chrome.nativeMessaging.out.9a9080e28a51f4743⤵PID:6072
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:6908
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.860ee03475dbb8b5 > \\.\pipe\chrome.nativeMessaging.out.860ee03475dbb8b53⤵PID:4332
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:5868
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=9908,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9240 /prefetch:13⤵
- Checks computer location settings
PID:3864
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.a9dd139ddb1927a9 > \\.\pipe\chrome.nativeMessaging.out.a9dd139ddb1927a93⤵PID:5572
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:2540
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8644,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:83⤵PID:5116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=10228,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8204 /prefetch:13⤵
- Checks computer location settings
PID:7668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=7756,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:13⤵
- Checks computer location settings
PID:10728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=7824,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:13⤵
- Checks computer location settings
PID:7252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=7344,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10404 /prefetch:13⤵
- Checks computer location settings
PID:752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=10560,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:13⤵
- Checks computer location settings
PID:9440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=7336,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10640 /prefetch:13⤵
- Checks computer location settings
PID:8176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=9444,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10820 /prefetch:13⤵
- Checks computer location settings
PID:7260
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=10268,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10968 /prefetch:13⤵PID:9040
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.95093f524b04d840 > \\.\pipe\chrome.nativeMessaging.out.95093f524b04d8403⤵PID:10328
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:8432
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.68f647ea907b707a > \\.\pipe\chrome.nativeMessaging.out.68f647ea907b707a3⤵PID:8604
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:8092
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=8068,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:13⤵PID:9596
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.6a9d67d86b36278a > \\.\pipe\chrome.nativeMessaging.out.6a9d67d86b36278a3⤵PID:10444
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4332
-
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:11024
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7296,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:83⤵PID:10572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4004,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:23⤵PID:5164
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.6ff9467c767ead48 > \\.\pipe\chrome.nativeMessaging.out.6ff9467c767ead483⤵PID:8120
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:4048
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=0" < \\.\pipe\chrome.nativeMessaging.in.7624873ea76a8573 > \\.\pipe\chrome.nativeMessaging.out.7624873ea76a85733⤵PID:5508
-
\??\c:\program files\reasonlabs\epp\rsExtensionHost.exe"c:\program files\reasonlabs\epp\rsExtensionHost.exe" chrome-extension://jcpgbnbdnakoblgfkbgggankeidkfcdl/ --parent-window=04⤵PID:4044
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=3928,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:83⤵PID:9100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4276,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:23⤵PID:9320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7052,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:83⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7052,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:83⤵PID:9836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=2052,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:13⤵
- Checks computer location settings
PID:9960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=10688,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10700 /prefetch:83⤵PID:7152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=10744,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10692 /prefetch:13⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --field-trial-handle=10668,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:83⤵PID:10728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=3452,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:13⤵PID:1248
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=9852,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10100 /prefetch:13⤵
- Checks computer location settings
PID:2880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=10448,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:13⤵PID:3904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --field-trial-handle=2200,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4036 /prefetch:83⤵PID:5616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=10232,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8272 /prefetch:13⤵
- Checks computer location settings
PID:9580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=9976,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:83⤵PID:4636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=10936,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10412 /prefetch:13⤵
- Checks computer location settings
PID:3684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6508,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:83⤵PID:10664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4596,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:83⤵PID:988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6004,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:83⤵PID:10532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6192,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:83⤵PID:760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=6852,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:13⤵
- Checks computer location settings
PID:5640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --field-trial-handle=8720,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:13⤵
- Checks computer location settings
PID:11016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --field-trial-handle=7500,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8264 /prefetch:13⤵
- Checks computer location settings
PID:7984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=9316,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9512 /prefetch:83⤵PID:9244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=8272,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9416 /prefetch:83⤵PID:10440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=8272,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=9416 /prefetch:83⤵PID:7948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1020,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:83⤵PID:7156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1020,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:83⤵PID:5716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --field-trial-handle=9424,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:13⤵PID:9388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6936,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:83⤵PID:4312
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --field-trial-handle=6300,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:13⤵
- Checks computer location settings
PID:1216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=10884,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10896 /prefetch:83⤵PID:7812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --field-trial-handle=5396,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:13⤵PID:9856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --field-trial-handle=6836,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:13⤵
- Checks computer location settings
PID:10304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --field-trial-handle=9968,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:13⤵PID:1340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5332,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:83⤵PID:11100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4100,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:83⤵PID:11024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7728,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:83⤵PID:9472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --field-trial-handle=6868,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:13⤵
- Checks computer location settings
PID:7016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4688,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10384 /prefetch:83⤵PID:10332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --field-trial-handle=9860,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:13⤵
- Checks computer location settings
PID:8880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --field-trial-handle=8248,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=10748 /prefetch:13⤵
- Checks computer location settings
PID:10856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --field-trial-handle=5180,i,13087803623337944939,15898611259369040734,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:13⤵
- Checks computer location settings
PID:10680
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:7372
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --rename-msedge-exe --system-level --verbose-logging --msedge --channel=stable2⤵PID:7672
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x284,0x288,0x28c,0x260,0x290,0x7ff716b788c0,0x7ff716b788cc,0x7ff716b788d83⤵PID:8516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --msedge --channel=stable --delete-old-versions --system-level --verbose-logging3⤵
- Modifies data under HKEY_USERS
PID:9792 -
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x234,0x238,0x23c,0x210,0x240,0x7ff716b788c0,0x7ff716b788cc,0x7ff716b788d84⤵PID:4036
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level3⤵PID:8952
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff716b788c0,0x7ff716b788cc,0x7ff716b788d84⤵PID:8492
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:6080
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:10808
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:6496
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:8340
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x304 0x4a81⤵PID:11096
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\67f6c2c8d96d4731a511cee690bd949e /t 6712 /p 83881⤵PID:9072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Checks whether UAC is enabled
- Checks system information in the registry
- Enumerates system info in registry
- System policy modification
PID:8008 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffbfa13ceb8,0x7ffbfa13cec4,0x7ffbfa13ced02⤵PID:9496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2116,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:22⤵PID:5996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2216,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:32⤵PID:8816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2588,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:82⤵PID:9356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3528,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:12⤵
- Checks computer location settings
PID:10980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3512,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:12⤵
- Checks computer location settings
PID:10180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4028,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:12⤵PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5484,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:12⤵
- Checks computer location settings
PID:180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5588,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:12⤵PID:10096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5628,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:12⤵PID:4256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6064,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:82⤵PID:2432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5184,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:82⤵PID:9340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=6436,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:82⤵PID:3936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=6448,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:82⤵PID:9628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7088,i,3417850608359384949,6552996127838558166,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:82⤵PID:11084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:5944
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\d7bf126171914a4fac9176d4e9061cfd /t 536 /p 80081⤵PID:9616
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Checks system information in the registry
- Drops file in Program Files directory
- Enumerates system info in registry
- System policy modification
PID:3708 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e0,0x7ffbfa13ceb8,0x7ffbfa13cec4,0x7ffbfa13ced02⤵PID:10688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2816,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:22⤵PID:10116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1996,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:32⤵PID:11124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:82⤵PID:9392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3484,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:12⤵
- Checks computer location settings
PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3492,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:12⤵
- Checks computer location settings
PID:2400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5132,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:82⤵PID:3492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5216,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:82⤵PID:6708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5016,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:5900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5420,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:82⤵PID:6068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5960,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:82⤵PID:5008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5960,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:82⤵PID:5288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6116,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:82⤵PID:9568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6488,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:82⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=6456,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:12⤵PID:3308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4788,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:82⤵PID:5400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=6084,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:12⤵
- Checks computer location settings
PID:9160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6224,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:82⤵PID:6744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7128,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:82⤵PID:2268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6900,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:12⤵
- Checks computer location settings
PID:8588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6440,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:82⤵PID:636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6996,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:82⤵PID:8036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7016,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:82⤵PID:4448
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7028,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:82⤵PID:6020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --field-trial-handle=3580,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:82⤵PID:10964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6836,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:82⤵
- Suspicious use of SetWindowsHookEx
PID:10420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=5344,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:12⤵
- Checks computer location settings
PID:7824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5184,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:82⤵PID:9668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6988,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:82⤵PID:508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --field-trial-handle=5896,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:82⤵PID:10896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=7408,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12⤵
- Checks computer location settings
PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7400,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:82⤵PID:2848
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6332,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:82⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3676,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:82⤵PID:8464
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6036,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:82⤵PID:10652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3572,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:82⤵PID:5876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7896,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:82⤵PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7952,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:82⤵PID:9492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7920,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:82⤵PID:1948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=4688,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:12⤵
- Checks computer location settings
PID:8588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=7948,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:12⤵
- Checks computer location settings
PID:9284
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --field-trial-handle=7644,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:82⤵PID:10276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=7548,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:12⤵PID:10760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7524,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:82⤵PID:5952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7792,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:82⤵PID:9820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8232,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:82⤵PID:10860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8400,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8408 /prefetch:82⤵PID:2780
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8428,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:82⤵PID:1624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=864,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8508 /prefetch:82⤵PID:10704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7676,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:82⤵PID:9436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5976,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:82⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6772,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8412 /prefetch:82⤵PID:9964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8100,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:82⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=8000,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:12⤵
- Checks computer location settings
PID:2188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7596,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:82⤵PID:4356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7488,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8576 /prefetch:82⤵PID:2108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=8224,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8468 /prefetch:82⤵PID:1336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8088,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:82⤵PID:5624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6724,i,4241828631124251315,2569731445076945135,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:82⤵PID:10028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:7016
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:10368 -
C:\Users\Admin\AppData\Local\Temp\7zO0882D6CE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0882D6CE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:7156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9836
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO08893CBE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO08893CBE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:10632 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9668
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:4800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:5132
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:11116
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO08870BBE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO08870BBE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:5992 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9576
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:7056
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088D1ABE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088D1ABE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:8856 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:8096
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088488BE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088488BE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:1776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:6116
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:8092
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088297AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088297AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:11252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:7088
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088896AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088896AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:2044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9632
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0881D2AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0881D2AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:5032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:4388
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088B61AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088B61AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:4348 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:6468
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088320AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088320AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:1840 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2180
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:8932
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088CAFAE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088CAFAE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:4044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:11208
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0884BBAE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0884BBAE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:2956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:6020
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088C4AAE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088C4AAE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:9436 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:10096
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088E2AAE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088E2AAE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:10236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:4880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2888
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0887E8AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0887E8AE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:10452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3000
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9808
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088E129E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088E129E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:732 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:776
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0884619E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0884619E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:5452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2192
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0880509E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0880509E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:10480 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:3500
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO08888C9E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO08888C9E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:2508 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:10448
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0882489E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0882489E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:7716 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2008
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0882958E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0882958E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:10340 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9468
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0886E38E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0886E38E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:4524 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:10548
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO08888F8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO08888F8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:9476 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9580
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO08833E8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO08833E8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:8600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2596
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO08896D8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO08896D8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:5156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:11240
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0885BC8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0885BC8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:5392 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9924
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO08827B8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO08827B8E\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵
- Suspicious use of SetThreadContext
PID:4624 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:5996
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO08804AD2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO08804AD2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵PID:3044
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:11040
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:6924
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088E59D2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088E59D2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵PID:1376
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:8400
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088638D2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088638D2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵PID:1524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:9472
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:8016
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088536C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088536C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵PID:2596
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:1284
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088005C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088005C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵PID:6828
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:2004
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:10876
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088AB3C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088AB3C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵PID:8432
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:10764
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO088B01C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO088B01C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵PID:6728
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:11180
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zO0887B8C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"C:\Users\Admin\AppData\Local\Temp\7zO0887B8C2\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe"2⤵PID:6052
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵PID:11240
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:4572
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe" --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" --run-assistant --allusers=01⤵PID:5044
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\assistant\assistant_installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.45 --initial-client-data=0x244,0x248,0x24c,0x218,0x250,0xb86038,0xb86044,0xb860502⤵PID:2268
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe"2⤵PID:6084
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --stream3⤵PID:11244
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffbc5b7d650,0x7ffbc5b7d660,0x7ffbc5b7d6704⤵PID:7704
-
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --show-intro-overlay --start-maximized --lowered-browser1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks system information in the registry
- Enumerates system info in registry
PID:4548 -
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x284,0x288,0x28c,0x280,0x290,0x7ffbd5a7d650,0x7ffbd5a7d660,0x7ffbd5a7d6702⤵PID:4500
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2024,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:2556
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=1892,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:32⤵PID:5888
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2332,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:82⤵PID:11044
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2820,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:82⤵PID:9804
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3140,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:82⤵PID:3976
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3152,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:82⤵PID:10232
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3160,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:82⤵PID:4104
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3180,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:82⤵PID:4692
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3832,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:12⤵
- Checks computer location settings
PID:4592
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3840,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:12⤵PID:8352
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_gx_splash.exe"C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_gx_splash.exe" --instance-name=dbff851fa759ccb33e726f883720ae502⤵PID:6572
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4272,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:12⤵
- Checks computer location settings
PID:1696
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4348,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:22⤵PID:4980
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4628,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:12⤵
- Checks computer location settings
PID:8008
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4864,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:12⤵PID:9416
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4936,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:12⤵PID:4484
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=5044,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:22⤵
- Checks computer location settings
PID:10164
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3888,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:82⤵PID:1836
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5688,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:82⤵PID:4616
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3740,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:82⤵PID:6696
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5768,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:82⤵PID:6048
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5772,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:82⤵PID:11236
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5760,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:82⤵PID:8824
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3412,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:82⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3728,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:82⤵PID:9480
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3704,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:82⤵PID:9840
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3692,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:82⤵PID:4560
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=4632,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:82⤵PID:2256
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=6524,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:82⤵PID:8976
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=7100,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:82⤵PID:7064
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=7120,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:82⤵PID:10772
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=7272,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:82⤵PID:2120
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=7400,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:82⤵PID:7212
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5676,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:82⤵PID:5460
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\installer.exe"C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\installer.exe" --fix-taskbar-pins2⤵PID:9504
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\installer.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\installer.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ffbeb657c80,0x7ffbeb657c8c,0x7ffbeb657c983⤵PID:10632
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=7920,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:82⤵PID:6084
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=6424,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:82⤵PID:688
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=7908,i,11457974177307041093,9627579593979233333,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:82⤵PID:6008
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --bypasslauncher --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c12⤵PID:6164
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63eaae7f4,0x7ff63eaae800,0x7ff63eaae8103⤵PID:4532
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Checks system information in the registry
- Enumerates system info in registry
- System policy modification
PID:5328 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffbf603ceb8,0x7ffbf603cec4,0x7ffbf603ced02⤵PID:6768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2768,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:22⤵PID:6456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1948,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:32⤵PID:7680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:82⤵PID:9708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3396,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:12⤵
- Checks computer location settings
PID:8828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3404,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵
- Checks computer location settings
PID:7044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4164,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:82⤵PID:5836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5396,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:82⤵PID:10824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4784,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:82⤵PID:10276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=4808,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:82⤵PID:3364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5632,i,6932651959483782617,1065548772702371228,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:82⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:4580
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher --requesttype=automatic --scheduledtask --bypasslauncher --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d7644762171⤵PID:5304
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:10088
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"1⤵PID:6220
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7ffbd5a7d650,0x7ffbd5a7d660,0x7ffbd5a7d6702⤵PID:2212
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --lowered-browser1⤵
- Checks computer location settings
- Adds Run key to start application
- Checks system information in the registry
- Enumerates system info in registry
PID:1620 -
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x268,0x288,0x28c,0x26c,0x290,0x7ffbd5a7d650,0x7ffbd5a7d660,0x7ffbd5a7d6702⤵PID:9356
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1984,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:22⤵PID:11128
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2044,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:32⤵PID:10472
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2052,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:82⤵PID:2652
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3012,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:82⤵PID:6896
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3020,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:82⤵PID:64
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3028,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:82⤵PID:4744
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3036,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:82⤵PID:8612
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3044,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:82⤵PID:4580
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3940,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:12⤵
- Checks computer location settings
PID:444
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3956,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:22⤵
- Checks computer location settings
PID:10460
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4712,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:9700
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5236,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:12⤵
- Checks computer location settings
PID:6128
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5392,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:12⤵
- Checks computer location settings
PID:4336
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5616,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:82⤵PID:9196
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5968,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:82⤵PID:2496
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=6356,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:22⤵
- Checks computer location settings
PID:11040
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5920,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:12⤵PID:4540
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=6068,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:82⤵PID:5572
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=6136,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:82⤵PID:6792
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=6736,i,9322896584793246868,14952411170654774839,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:82⤵PID:4768
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --bypasslauncher --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c12⤵PID:4620
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63eaae7f4,0x7ff63eaae800,0x7ff63eaae8103⤵PID:6664
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher --requesttype=automatic --scheduledtask --bypasslauncher --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d7644762171⤵PID:11236
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63eaae7f4,0x7ff63eaae800,0x7ff63eaae8102⤵PID:10120
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"1⤵PID:7252
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x284,0x288,0x28c,0x280,0x290,0x7ffbd5a7d650,0x7ffbd5a7d660,0x7ffbd5a7d6702⤵PID:11248
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --lowered-browser1⤵PID:752
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x284,0x288,0x28c,0x280,0x290,0x7ffbd5a7d650,0x7ffbd5a7d660,0x7ffbd5a7d6702⤵PID:4692
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:22⤵PID:1036
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=1896,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:32⤵PID:2288
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2372,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:82⤵PID:11048
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2932,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:82⤵PID:10820
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2940,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:82⤵PID:10172
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2948,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:82⤵PID:10216
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2956,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:82⤵PID:8600
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2964,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:82⤵PID:6756
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3824,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:12⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3832,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:22⤵PID:8772
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4940,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:12⤵PID:1564
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5236,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:12⤵PID:9468
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5392,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:12⤵PID:10548
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5624,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:22⤵PID:3836
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5660,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:82⤵PID:5720
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5964,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:82⤵PID:1096
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6068,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:12⤵PID:4520
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=4444,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:82⤵PID:10064
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=6544,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:82⤵PID:2072
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=4464,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:82⤵PID:9568
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --bypasslauncher --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c12⤵PID:8996
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63eaae7f4,0x7ff63eaae800,0x7ff63eaae8103⤵PID:6080
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5628,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:12⤵PID:5748
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6396,i,8665498465400314202,12162585113193464044,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:12⤵PID:9864
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher --requesttype=automatic --scheduledtask --bypasslauncher --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d7644762171⤵PID:9196
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63eaae7f4,0x7ff63eaae800,0x7ff63eaae8102⤵PID:1620
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:6116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffbeef0ceb8,0x7ffbeef0cec4,0x7ffbeef0ced02⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2828,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:22⤵PID:8076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1904,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:32⤵PID:9240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2268,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:82⤵PID:3220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3436,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:12⤵PID:8092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3448,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:10048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4192,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:82⤵PID:6632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5176,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:82⤵PID:3800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5480,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:82⤵PID:9256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3760,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:82⤵PID:2568
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5764,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:82⤵PID:5204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5096,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:82⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5836,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:82⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5824,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:82⤵PID:11036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6184,i,6483785798898464579,12127226981874382166,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:82⤵PID:5420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:10896
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:6064
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7ffbfa83ceb8,0x7ffbfa83cec4,0x7ffbfa83ced02⤵PID:5348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2104,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:7560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1904,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:32⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:82⤵PID:6992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3460,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:3540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3476,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4520,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:82⤵PID:11128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5044,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:82⤵PID:9892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5512,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:8092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5688,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:82⤵PID:6108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5692,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:82⤵PID:9188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5884,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:82⤵PID:9008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6420,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:82⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6420,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:82⤵PID:9988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6636,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:82⤵PID:10984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6340,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:82⤵PID:6036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6580,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:82⤵PID:8360
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7108,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:82⤵PID:10496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6804,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:82⤵PID:5808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7112,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:82⤵PID:11048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7404,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:82⤵PID:9840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4788,i,9002904495501501562,8842551080424846419,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:82⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:6080
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:1724
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2e8,0x7ffbfa83ceb8,0x7ffbfa83cec4,0x7ffbfa83ced02⤵PID:7388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2276,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:22⤵PID:5268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1976,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:32⤵PID:4280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2532,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:82⤵PID:6048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3392,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵PID:8684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3400,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:7364
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4284,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:82⤵PID:7728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4424,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:82⤵PID:5648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4148,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:12⤵PID:5800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5308,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:82⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5480,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:82⤵PID:5328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5532,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:82⤵PID:1984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4152,i,11861655341552714800,16732799683776167159,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:82⤵PID:3224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:9472
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:9040
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵PID:5280
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" "C:\Users\Admin\Downloads\Malwarebytes Premium v3.0.6.1469 Final + Keygen.torrent"2⤵PID:9364
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x284,0x288,0x28c,0x280,0x290,0x7ffbd73ad650,0x7ffbd73ad660,0x7ffbd73ad6703⤵PID:9004
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --lowered-browser "C:\Users\Admin\Downloads\Malwarebytes Premium v3.0.6.1469 Final + Keygen.torrent"1⤵PID:4832
-
C:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exeC:\Users\Admin\AppData\Local\Programs\Opera\109.0.5097.80\opera_crashreporter.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x284,0x288,0x28c,0x280,0x290,0x7ffbd73ad650,0x7ffbd73ad660,0x7ffbd73ad6702⤵PID:2044
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=gpu-process --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1996,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:22⤵PID:5520
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=1896,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:32⤵PID:6120
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2312,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:82⤵PID:9836
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3132,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:82⤵PID:4048
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3144,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:82⤵PID:6068
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3148,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:82⤵PID:9980
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=3052,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:82⤵PID:8084
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=2716,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:82⤵PID:560
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3904,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:12⤵PID:8352
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3080,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:22⤵PID:10744
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4936,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:12⤵PID:5184
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5328,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:1984
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5356,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:12⤵PID:10152
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5636,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:12⤵PID:10172
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --extension-process --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5828,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:22⤵PID:10344
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5836,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:82⤵PID:11132
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5772,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:82⤵PID:11040
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=6572,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:82⤵PID:8368
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=6768,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:82⤵PID:3136
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5372,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:82⤵PID:10612
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --start-stack-profiler --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6488,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:12⤵PID:5624
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=5488,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:82⤵PID:4024
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe"C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe" --bypasslauncher --user-data-dir="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" --pipeid=oauc_pipe2906202b27b41e4bd66c9238c4b575c12⤵PID:3172
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63eaae7f4,0x7ff63eaae800,0x7ff63eaae8103⤵PID:7824
-
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=4840,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:82⤵PID:6912
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=7256,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:82⤵PID:8016
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=renderer --user-agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 OPR/109.0.0.0 (Edition cdf)" --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=7280,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:12⤵PID:8088
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe"C:\Users\Admin\AppData\Local\Programs\Opera\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --no-appcompat-clear --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=on --with-feature:address-bar-keywords-monetization=on --with-feature:amazon-new-ids=on --with-feature:amp-requests-stats=on --with-feature:aria-command-line-in-extension=on --with-feature:aria-command-line-react=on --with-feature:campaigns-2024=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-maker-studio-integration=on --with-feature:gaming-api=on --with-feature:lucid-mode-hide-text=on --with-feature:native-crypto-wallet=on --with-feature:opera-startpage-special=on --with-feature:password-generator=off --with-feature:premium-valve-in=on --with-feature:proxy-switcher-ui-default-visible=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:shopping-corner=on --with-feature:sitecheck-age=on --with-feature:specific-keywords=on --with-feature:startpage-opening-animation=off --with-feature:startpage-sync-banner-ref=on --with-feature:installer-experiment-test=off --with-feature:installer-bypass-launcher=on --ab_tests=GROW-2836-test-1:GROW-2836 --field-trial-handle=7564,i,12897920351215186906,1884431015808362254,262144 --variations-seed-version --mojo-platform-channel-handle=7584 /prefetch:82⤵PID:7540
-
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --scheduledtask --bypasslauncher --requesttype=automatic --scheduledtask --bypasslauncher --pipeid=oauc_task_pipedcbb8f53eff625f232ff45d7644762171⤵PID:10484
-
C:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exeC:\Users\Admin\AppData\Local\Programs\Opera\autoupdate\opera_autoupdate.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktop --annotation=ver=109.0.5097.80 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff63eaae7f4,0x7ff63eaae800,0x7ff63eaae8102⤵PID:9096
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4104
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:4744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:10920
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffbfa8dceb8,0x7ffbfa8dcec4,0x7ffbfa8dced02⤵PID:9644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2432,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:22⤵PID:2288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1856,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:32⤵PID:10336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2076,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:82⤵PID:9840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3432,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:9712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3440,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:12⤵PID:9708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4300,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:82⤵PID:9264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5380,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:82⤵PID:2628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=5540,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:8940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=5336,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:82⤵PID:5028
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5652,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:82⤵PID:11104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6244,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:82⤵PID:1936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6244,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:82⤵PID:10772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6240,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:82⤵PID:10160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6492,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:82⤵PID:5720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6336,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:82⤵PID:9004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6672,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:82⤵PID:8236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6344,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:82⤵PID:10800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6480,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:82⤵PID:5600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6468,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:82⤵PID:8384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6376,i,14902326805593260427,10288978023939084184,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:82⤵PID:8600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:11200
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.zip"1⤵PID:9484
-
C:\Users\Admin\AppData\Local\Temp\7zOC054F523\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC054F523\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:9752
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC0568E13\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC0568E13\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:5628
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC05F5C13\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC05F5C13\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:4284
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC05B5DC3\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC05B5DC3\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:8812
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC0588934\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC0588934\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:3784
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC05F4214\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC05F4214\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:5096
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC055E114\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC055E114\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:9480
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC05F3714\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC05F3714\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:11112
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC054C414\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC054C414\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:9976
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC05DF514\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC05DF514\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:9400
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC055BA14\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC055BA14\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:9760
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC055D914\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC055D914\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:4920
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC05B9F14\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC05B9F14\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:9540
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC056EC14\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC056EC14\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC05CCD14\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC05CCD14\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:10744
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC05AC204\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC05AC204\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:10132
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC051D304\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC051D304\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:10068
-
-
C:\Users\Admin\AppData\Local\Temp\7zOC0588004\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"C:\Users\Admin\AppData\Local\Temp\7zOC0588004\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe"2⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:4544
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffbf6bfceb8,0x7ffbf6bfcec4,0x7ffbf6bfced02⤵PID:8976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2808,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:22⤵PID:688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1972,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:32⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2232,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:82⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3408,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵PID:10408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3416,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12⤵PID:8944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4280,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:82⤵PID:5976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3948,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:12⤵PID:6984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4984,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:82⤵PID:9720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5192,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:82⤵PID:10196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5808,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:82⤵PID:6484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5452,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:82⤵PID:9872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=6140,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:82⤵PID:6556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --field-trial-handle=6132,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:82⤵PID:5664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5440,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:82⤵PID:7044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5004,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:22⤵PID:9952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5816,i,18438953253885579445,14194301242128232808,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:12⤵PID:6724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:10188
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:6628
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:10832
-
C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"1⤵PID:3404
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵PID:10164
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=124.0.6367.118 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=124.0.2478.80 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2f0,0x7ffbf6bfceb8,0x7ffbf6bfcec4,0x7ffbf6bfced02⤵PID:8648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2660,i,17963410849461283090,13999716787790087904,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:22⤵PID:8488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1860,i,17963410849461283090,13999716787790087904,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:32⤵PID:6948
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,17963410849461283090,13999716787790087904,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:82⤵PID:6784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3376,i,17963410849461283090,13999716787790087904,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:7840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3384,i,17963410849461283090,13999716787790087904,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵PID:4632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4208,i,17963410849461283090,13999716787790087904,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:82⤵PID:10784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5520,i,17963410849461283090,13999716787790087904,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:82⤵PID:8560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5376,i,17963410849461283090,13999716787790087904,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:82⤵PID:5336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\124.0.2478.80\elevation_service.exe"1⤵PID:2212
-
C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe"1⤵PID:6708
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Browser Extensions
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
4Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
8Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.8MB
MD57171f56da52529073c2bda6dad0fdcfa
SHA1f29fb1d1182e46895bb3ccc38e05220087e92e93
SHA25632c87af491ca80fc5c5594aa995669161b466957d7b444f3c388ece97b730aee
SHA5128c81a87f1f77cbed95eff3986d14d7c05b919cdaeabfba0a1335331adadc1e97495332cb6d3969242a9d19f48aa9eb890f22b81f504af615ea5ff64b27c13c73
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{1FAB8CFE-9860-415C-A6CA-AA7D12021940}\2.0.0.34\BGAUpdate.exe
Filesize17.2MB
MD53f208f4e0dacb8661d7659d2a030f36e
SHA107fe69fd12637b63f6ae44e60fdf80e5e3e933ff
SHA256d3c12e642d4b032e2592c2ba6e0ed703a7e43fb424b7c3ab5b2e51b53d1d433b
SHA5126c8fce43d04dd7e7f5c8bf275ba01e24a76531e89cc02f4b2f23ab2086f7cf70f485c4240c5ea41bf61cb7ceee471df7e7bdc1b17dfdd54c22e4b02ff4e14740
-
Filesize
12KB
MD5369bbc37cff290adb8963dc5e518b9b8
SHA1de0ef569f7ef55032e4b18d3a03542cc2bbac191
SHA2563d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3
SHA5124f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1
-
Filesize
179KB
MD57a160c6016922713345454265807f08d
SHA1e36ee184edd449252eb2dfd3016d5b0d2edad3c6
SHA25635a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9
SHA512c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e
-
Filesize
201KB
MD54dc57ab56e37cd05e81f0d8aaafc5179
SHA1494a90728d7680f979b0ad87f09b5b58f16d1cd5
SHA25687c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718
SHA512320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b
-
Filesize
212KB
MD560dba9b06b56e58f5aea1a4149c743d2
SHA1a7e456acf64dd99ca30259cf45b88cf2515a69b3
SHA2564d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112
SHA512e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7
-
Filesize
257KB
MD5c044dcfa4d518df8fc9d4a161d49cece
SHA191bd4e933b22c010454fd6d3e3b042ab6e8b2149
SHA2569f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2
SHA512f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c
-
Filesize
4KB
MD56dd5bf0743f2366a0bdd37e302783bcd
SHA1e5ff6e044c40c02b1fc78304804fe1f993fed2e6
SHA25691d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5
SHA512f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e
-
Filesize
2.0MB
MD5965b3af7886e7bf6584488658c050ca2
SHA172daabdde7cd500c483d0eeecb1bd19708f8e4a5
SHA256d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19
SHA5121c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4
-
Filesize
28KB
MD5567aec2d42d02675eb515bbd852be7db
SHA166079ae8ac619ff34e3ddb5fb0823b1790ba7b37
SHA256a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c
SHA5123a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3
-
Filesize
24KB
MD5f6c1324070b6c4e2a8f8921652bfbdfa
SHA1988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf
SHA256986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717
SHA51263092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100
-
Filesize
26KB
MD5570efe7aa117a1f98c7a682f8112cb6d
SHA1536e7c49e24e9aa068a021a8f258e3e4e69fa64f
SHA256e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01
SHA5125e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8
-
Filesize
28KB
MD5a8d3210e34bf6f63a35590245c16bc1b
SHA1f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693
SHA2563b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766
SHA5126e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a
-
Filesize
29KB
MD57937c407ebe21170daf0975779f1aa49
SHA14c2a40e76209abd2492dfaaf65ef24de72291346
SHA2565ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9
SHA5128670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7
-
Filesize
29KB
MD58375b1b756b2a74a12def575351e6bbd
SHA1802ec096425dc1cab723d4cf2fd1a868315d3727
SHA256a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105
SHA512aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19
-
Filesize
29KB
MD5a94cf5e8b1708a43393263a33e739edd
SHA11068868bdc271a52aaae6f749028ed3170b09cce
SHA2565b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c
SHA512920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7
-
Filesize
29KB
MD57dc58c4e27eaf84ae9984cff2cc16235
SHA13f53499ddc487658932a8c2bcf562ba32afd3bda
SHA256e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98
SHA512bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc
-
Filesize
28KB
MD5e338dccaa43962697db9f67e0265a3fc
SHA14c6c327efc12d21c4299df7b97bf2c45840e0d83
SHA25699b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04
SHA512e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9
-
Filesize
29KB
MD52929e8d496d95739f207b9f59b13f925
SHA17c1c574194d9e31ca91e2a21a5c671e5e95c734c
SHA2562726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df
SHA512ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957
-
Filesize
30KB
MD539551d8d284c108a17dc5f74a7084bb5
SHA16e43fc5cec4b4b0d44f3b45253c5e0b032e8e884
SHA2568dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07
SHA5126fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2
-
Filesize
28KB
MD516c84ad1222284f40968a851f541d6bb
SHA1bc26d50e15ccaed6a5fbe801943117269b3b8e6b
SHA256e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b
SHA512d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e
-
Filesize
28KB
MD534d991980016595b803d212dc356d765
SHA1e3a35df6488c3463c2a7adf89029e1dd8308f816
SHA256252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e
SHA5128a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed
-
Filesize
28KB
MD5d34380d302b16eab40d5b63cfb4ed0fe
SHA11d3047119e353a55dc215666f2b7b69f0ede775b
SHA256fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f
SHA51245ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538
-
Filesize
30KB
MD5aab01f0d7bdc51b190f27ce58701c1da
SHA11a21aabab0875651efd974100a81cda52c462997
SHA256061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c
SHA5125edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e
-
Filesize
30KB
MD5ac275b6e825c3bd87d96b52eac36c0f6
SHA129e537d81f5d997285b62cd2efea088c3284d18f
SHA256223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0
SHA512bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679
-
Filesize
27KB
MD5d749e093f263244d276b6ffcf4ef4b42
SHA169f024c769632cdbb019943552bac5281d4cbe05
SHA256fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e
SHA51248d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9
-
Filesize
27KB
MD54a1e3cf488e998ef4d22ac25ccc520a5
SHA1dc568a6e3c9465474ef0d761581c733b3371b1cd
SHA2569afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011
SHA512ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245
-
Filesize
29KB
MD528fefc59008ef0325682a0611f8dba70
SHA1f528803c731c11d8d92c5660cb4125c26bb75265
SHA25655a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d
SHA5122ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed
-
Filesize
28KB
MD59db7f66f9dc417ebba021bc45af5d34b
SHA16815318b05019f521d65f6046cf340ad88e40971
SHA256e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819
SHA512943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952
-
Filesize
28KB
MD5b78cba3088ecdc571412955742ea560b
SHA1bc04cf9014cec5b9f240235b5ff0f29dbdb22926
SHA256f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085
SHA51204c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf
-
Filesize
28KB
MD5a7e1f4f482522a647311735699bec186
SHA13b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd
SHA256e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4
SHA51222131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57
-
Filesize
27KB
MD5cbe3454843ce2f36201460e316af1404
SHA10883394c28cb60be8276cb690496318fcabea424
SHA256c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59
SHA512f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73
-
Filesize
28KB
MD5d45f2d476ed78fa3e30f16e11c1c61ea
SHA18c8c5d5f77cd8764c4ca0c389daee89e658dfd5e
SHA256acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2
SHA5122a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b
-
Filesize
29KB
MD57c66526dc65de144f3444556c3dba7b8
SHA16721a1f45ac779e82eecc9a584bcf4bcee365940
SHA256e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d
SHA512dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f
-
Filesize
30KB
MD5b534e068001e8729faf212ad3c0da16c
SHA1999fa33c5ea856d305cc359c18ea8e994a83f7a9
SHA256445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511
SHA512e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb
-
Filesize
30KB
MD564c47a66830992f0bdfd05036a290498
SHA188b1b8faa511ee9f4a0e944a0289db48a8680640
SHA256a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961
SHA512426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5
-
Filesize
28KB
MD53b8a5301c4cf21b439953c97bd3c441c
SHA18a7b48bb3d75279de5f5eb88b5a83437c9a2014a
SHA256abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0
SHA512068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a
-
Filesize
30KB
MD5c90f33303c5bd706776e90c12aefabee
SHA11965550fe34b68ea37a24c8708eef1a0d561fb11
SHA256e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c
SHA512b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a
-
Filesize
28KB
MD584a1cea9a31be831155aa1e12518e446
SHA1670f4edd4dc8df97af8925f56241375757afb3da
SHA256e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57
SHA5125f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51
-
Filesize
28KB
MD5f9646357cf6ce93d7ba9cfb3fa362928
SHA1a072cc350ea8ea6d8a01af335691057132b04025
SHA256838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150
SHA512654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528
-
Filesize
28KB
MD534cbaeb5ec7984362a3dabe5c14a08ec
SHA1d88ec7ac1997b7355e81226444ec4740b69670d7
SHA256024c5eae16e45abe2237c2a5d868563550ac596f1f7d777e25234c17d9461dd9
SHA512008c8443a3e93c4643a9e8735a1c59c24ba2f7a789606a86da54c921c34cbc0cb11c88594544d8509a8e71b6a287c043b1ffe2d39b90af53b4cde3847d891ba8
-
Filesize
29KB
MD50b475965c311203bf3a592be2f5d5e00
SHA1b5ff1957c0903a93737666dee0920b1043ddaf70
SHA25665915ad11b9457d145795a1e8d151f898ec2dcb8b136967e6592884699867eb0
SHA512bec513125f272c24477b9ddbaa5706d1e1bb958babac46829b28df99fa1dd82f3f1e3c7066dc2fe3e59118c536675a22fc2128de916ca4c478950b9992372007
-
Filesize
29KB
MD5f4976c580ba37fc9079693ebf5234fea
SHA17326d2aa8f6109084728323d44a7fb975fc1ed3f
SHA256b16755fdbcc796ef4eb937759fe2c3518c694f5d186970d55a5a5e5d906cb791
SHA512e43636d8c947e981258e649712ad43f37c1aab01916539b93c082959fb5c6764c9c44979650092202839e812e6f252c6c3eaf66d3d195c1efd39c74c81ad1981
-
Filesize
27KB
MD503d4c35b188204f62fc1c46320e80802
SHA107efb737c8b072f71b3892b807df8c895b20868c
SHA256192585d7f4a8a0cd95e338863c14233cdd8150f9f6f7dd8a405da0670110ee95
SHA5127e67ea953ea58ff43e049ce519ae077eec631325604896479526627d688f2fa3bfc855a55ac23a76b1c9ef8cd75274265b8238423b95a2437be7250db0db31b1
-
Filesize
28KB
MD55664c7a059ceb096d4cdaae6e2b96b8f
SHA1bf0095cd7470bf4d7c9566ba0fd3b75c8b9e57ec
SHA256a3a2947064267d17474c168d3189b0d372e36e53bf0efb9c228d314fc802d98e
SHA512015dcb17b297a0aaad41c7b0b2199187e435855fd3977d16402be774622cc4f6b55d04ba9159a89e26e350c5602928c76dd9386be3974437b41888a0cfdddfa8
-
Filesize
30KB
MD5497ca0a8950ae5c8c31c46eb91819f58
SHA101e7e61c04de64d2df73322c22208a87d6331fc8
SHA256abe2360a585b6671ec3a69d14077b43ae8f9e92b6077b80a147dfe36792bb1b7
SHA512070398af980f193ff90b4afaecb3822534ef3171eca7228bce395af11ca38364bc47cab7df1e71187ef291f90978bdc37a8611d2992b1800cd1de6aa7fda09d9
-
Filesize
25KB
MD545e971cdc476b8ea951613dbd96e8943
SHA18d87b4edfce31dfa4eebdcc319268e81c1e01356
SHA256fd5ba39c8b319c6ba2febf896c6947a0a7bae6aa0b4957bd124d55589f41849d
SHA512f1c9fccf742fa450be249dbbf7e551a426c050ae4af3d2e909f9750068a2bdc801f618eb77a6a82d13421d27949c9f2a9681a44bcb410ccdeec66b24a70f6a9a
-
Filesize
5.7MB
MD5fdee8211f69dce1343ca0dbd2a8ed61e
SHA14b255d87aeb3ccb381208631edc77ab97c8825d6
SHA2562bbcf80c909a561a790584f25219afa8e3f4b7f2ed57b4de453185f1f267dfb9
SHA512fecd0fc36e622744f7aa8035d8f1cfa98dda119745e3407a6f62483a891274f78cf8e48b4576c0954c16d63a1d23bf998784f1d7db23091e0ef309efd0273f90
-
Filesize
5.3MB
MD55760bad46664c1c9079d37bdbc4bbbad
SHA1a67cf6f0c1a164940c1562be1f066e85415dfe32
SHA25670be452d5ca4dfaeec5fd02652dc8c4d3c76ac329148c2bbf358ae8c829d4d73
SHA512b75c8095cc7f9d092edaf32b51bcd5c4ce98315d73a4f8f244a0cc42edf091509a17db02bf7e8fe81a0975b0b008e2b6c44cdbcc48ac7d0dacf02514f353d2f7
-
C:\Program Files (x86)\Roblox\Versions\version-5e534e6db34e447e\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
Filesize1.5MB
MD5610b1b60dc8729bad759c92f82ee2804
SHA19992b7ae7a9c4e17a0a6d58ffd91b14cbb576552
SHA256921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08
SHA5120614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4
-
Filesize
73KB
MD56f97cb1b2d3fcf88513e2c349232216a
SHA1846110d3bf8b8d7a720f646435909ef80bbcaa0c
SHA2566a031052be1737bc2767c3ea65430d8d7ffd1c9115e174d7dfb64ad510011272
SHA5122919176296b953c9ef232006783068d255109257653ac5ccd64a3452159108890a1e8e7d6c030990982816166517f878f6032946a5558f8ae3510bc044809b07
-
Filesize
280B
MD5eb2daf6d1c0619ef9803d66483db3eb0
SHA1e52e93c51c92d261e2d4878e9f8cb6ac7eec8a2e
SHA25686bbd10aa5514bdf1d5b3e82f33c2646f251122b7a0d9f8267f9d5f9c01b1bf4
SHA5122448bb2b92ec808b4de2ae6bf22fd9630616e569d8fb3255088d9684d847ec2128ffdb44991d737c6a59a1d85b94f83f73b86bff81527fcbcf131c102414558e
-
Filesize
797KB
MD5ded746a9d2d7b7afcb3abe1a24dd3163
SHA1a074c9e981491ff566cd45b912e743bd1266c4ae
SHA256c113072678d5fa03b02d750a5911848ab0e247c4b28cf7b152a858c4b24901b3
SHA5122c273bf79988df13f9da4019f8071cf3b4480ecd814d3df44b83958f52f49bb668dd2f568293c29ef3545018fea15c9d5902ef88e0ecfebaf60458333fcaa91b
-
Filesize
248B
MD56002495610dcf0b794670f59c4aa44c6
SHA1f521313456e9d7cf8302b8235f7ccb1c2266758f
SHA256982a41364a7567fe149d4d720749927b2295f1f617df3eba4f52a15c7a4829ad
SHA512dfc2e0184436ffe8fb80a6e0a27378a8085c3aa096bbf0402a39fb766775624b3f1041845cf772d3647e4e4cde34a45500891a05642e52bae4a397bd4f323d67
-
Filesize
633B
MD5c80d4a697b5eb7632bc25265e35a4807
SHA19117401d6830908d82cbf154aa95976de0d31317
SHA256afe1e50cc967c3bb284847a996181c22963c3c02db9559174e0a1e4ba503cce4
SHA5128076b64e126d0a15f6cbde31cee3d6ebf570492e36a178fa581aaa50aa0c1e35f294fef135fa3a3462eedd6f1c4eaa49c373b98ee5a833e9f863fbe6495aa036
-
Filesize
109KB
MD5beae67e827c1c0edaa3c93af485bfcc5
SHA1ccbbfabb2018cd3fa43ad03927bfb96c47536df1
SHA256d47b3ddddc6aadd7d31c63f41c7a91c91e66cbeae4c02dac60a8e991112d70c5
SHA51229b8d46c6f0c8ddb20cb90e0d7bd2f1a9d9970db9d9594f32b9997de708b0b1ae749ce043e73c77315e8801fd9ea239596e6b891ef4555535bac3fe00df04b92
-
Filesize
628B
MD5789f18acca221d7c91dcb6b0fb1f145f
SHA1204cc55cd64b6b630746f0d71218ecd8d6ff84ce
SHA256a5ff0b9a9832b3f5957c9290f83552174b201aeb636964e061273f3a2d502b63
SHA512eae74f326f7d71a228cae02e4455557ad5ca81e1e28a186bbc4797075d5c79bcb91b5e605ad1d82f3d27e16d0cf172835112ffced2dc84d15281c0185fa4fa62
-
Filesize
388B
MD51068bade1997666697dc1bd5b3481755
SHA14e530b9b09d01240d6800714640f45f8ec87a343
SHA2563e9b9f8ed00c5197cb2c251eb0943013f58dca44e6219a1f9767d596b4aa2a51
SHA51235dfd91771fd7930889ff466b45731404066c280c94494e1d51127cc60b342c638f333caa901429ad812e7ccee7530af15057e871ed5f1d3730454836337b329
-
Filesize
633B
MD56895e7ce1a11e92604b53b2f6503564e
SHA16a69c00679d2afdaf56fe50d50d6036ccb1e570f
SHA2563c609771f2c736a7ce540fec633886378426f30f0ef4b51c20b57d46e201f177
SHA512314d74972ef00635edfc82406b4514d7806e26cec36da9b617036df0e0c2448a9250b0239af33129e11a9a49455aab00407619ba56ea808b4539549fd86715a2
-
Filesize
7KB
MD5362ce475f5d1e84641bad999c16727a0
SHA16b613c73acb58d259c6379bd820cca6f785cc812
SHA2561f78f1056761c6ebd8965ed2c06295bafa704b253aff56c492b93151ab642899
SHA5127630e1629cf4abecd9d3ddea58227b232d5c775cb480967762a6a6466be872e1d57123b08a6179fe1cfbc09403117d0f81bc13724f259a1d25c1325f1eac645b
-
Filesize
331KB
MD58556afbb1722951ddc64e7642ee7ac9c
SHA1f25a52b068eb3898dc1d018fd481af000ac9cc7d
SHA256325870bc55b57f0f018c6a572cddec8b339540a0b337ea5efd97014e8c00ad10
SHA51257d3c271752f6cd44edb43c2d79e7188b57561678057f05bcb145f23e2729715645f3c520eef8106221d7a981bb0f65b80e51a92f86c1f0de11932a92147a962
-
Filesize
19KB
MD58129c96d6ebdaebbe771ee034555bf8f
SHA19b41fb541a273086d3eef0ba4149f88022efbaff
SHA2568bcc210669bc5931a3a69fc63ed288cb74013a92c84ca0aba89e3f4e56e3ae51
SHA512ccd92987da4bda7a0f6386308611afb7951395158fc6d10a0596b0a0db4a61df202120460e2383d2d2f34cbb4d4e33e4f2e091a717d2fc1859ed7f58db3b7a18
-
Filesize
1.1MB
MD579a3316d934da771d43a0eb38b43b411
SHA1f4df6d0423d63f7e0792d1d55af6b36a94c7449a
SHA2562a96c5474735e92836286f33218d8338591c15b3441faf8672d3b687411f01af
SHA512b597cc7018ad0a9695c6ffeb3370e3c04e9d35d7090de176aa40531a6720e2bd0cb9f1ab1a8304ed17e0987982028a91b2d8d5cf3229a62c5d0fcd4ab1c6b700
-
Filesize
347KB
MD5b8f08b5a671b1d91bc615a1be333d037
SHA12d17004a8635d9c349b43aec7996384cc7b17a95
SHA256c5f855c4e6f7aac4547f4dfae4ec03b1d3ec51b18c69ae94d3402b27a32b562c
SHA512c0f75d936196b65fb2eea75de1d97b9cd6d9a6777553bbcd706e1c3a29248543cc6aa2f47b46142155482613f9106e84e5b8036c0fa46893600272043fc20335
-
Filesize
5KB
MD5517330c5959e0ea014cfb2ddadfae354
SHA182b72327a6d7304443e543d8bfb98f0849899a49
SHA256f30d03e6f8b8b8e1f4a1cb93507629e465b0dcc6c9e68982816d92b5819de6fd
SHA5122e1f95f16ff2a45e492f03a7df8a96cc984ec8965746320bac255861609a4759ab82d6b99935235dddd3c11c7e7001e495c16650be406b75fca726488f603dff
-
Filesize
257B
MD52afb72ff4eb694325bc55e2b0b2d5592
SHA1ba1d4f70eaa44ce0e1856b9b43487279286f76c9
SHA25641fb029d215775c361d561b02c482c485cc8fd220e6b62762bff15fd5f3fb91e
SHA5125b5179b5495195e9988e0b48767e8781812292c207f8ae0551167976c630398433e8cc04fdbf0a57ef6a256e95db8715a0b89104d3ca343173812b233f078b6e
-
Filesize
239B
MD51264314190d1e81276dde796c5a3537c
SHA1ab1c69efd9358b161ec31d7701d26c39ee708d57
SHA2568341a3cae0acb500b9f494bdec870cb8eb8e915174370d41c57dcdae622342c5
SHA512a3f36574dce70997943d93a8d5bebe1b44be7b4aae05ed5a791aee8c3aab908c2eca3275f7ce636a230a585d40896dc637be1fb597b10380d0c258afe4e720e9
-
Filesize
606B
MD543fbbd79c6a85b1dfb782c199ff1f0e7
SHA1cad46a3de56cd064e32b79c07ced5abec6bc1543
SHA25619537ccffeb8552c0d4a8e0f22a859b4465de1723d6db139c73c885c00bd03e0
SHA51279b4f5dccd4f45d9b42623ebc7ee58f67a8386ce69e804f8f11441a04b941da9395aa791806bbc8b6ce9a9aa04127e93f6e720823445de9740a11a52370a92ea
-
Filesize
2.2MB
MD5c128d7b407d111298c6fd54b5d1d30dc
SHA1f1b0a405660ddcef6a37155759f08b1bc50f27d3
SHA25660bb746a55444c32b1dd73555e4ed4e3d21a792c818279d4952f302553393a9d
SHA51217f4a4923166da9229bff98dacecb5d9824d435847c4d371d7eb441b6e836d36b92c187fba08666d3c26ce61eeeb7bd5ab675983d793ba9315c47d8d6ca8bce7
-
Filesize
278B
MD5b34182c090a30fe01d5c34f8da5b6f94
SHA186e92eeb33edd250cf34e7d407cdaae090bc8077
SHA256657f5512ee52e5e84a34dd5726d8235591a74ac7e8e60a6a3940258d20f9df9d
SHA512b416a728ab5fe7b5fa0d44f0fb39c00b205872f6716d13ab406cf0143f4e092ceb48a9997032c9e55e13cb6a618626890300f3bfd0550006907181df93fd7221
-
Filesize
279KB
MD5babb847fc7125748264243a0a5dd9158
SHA178430deab4dfd87b398d549baf8e94e8e0dd734e
SHA256bd331dd781d8aed921b0be562ddec309400f0f4731d0fd0b0e8c33b0584650cd
SHA5122a452da179298555c6f661cb0446a3ec2357a99281acae6f1dbe0cc883da0c2f4b1157affb31c12ec4f6f476075f3cac975ec6e3a29af46d2e9f4afbd09c8755
-
Filesize
7KB
MD587868193626dc756d10885f46d76f42e
SHA194a5ce8ed7633ed77531b6cb14ceb1927c5cae1f
SHA256b5728e42ea12c67577cb9188b472005ee74399b6ac976e7f72b48409baee3b41
SHA51279751330bed5c16d66baf3e5212be0950f312ffd5b80b78be66eaea3cc7115f8a9472d2a43b5ce702aa044f3b45fd572775ff86572150df91cc27866f88f8277
-
Filesize
19KB
MD5c757503bc0c5a6679e07fe15b93324d6
SHA16a81aa87e4b07c7fea176c8adf1b27ddcdd44573
SHA25691ebea8ad199e97832cf91ea77328ed7ff49a1b5c06ddaacb0e420097a9b079e
SHA512efd1507bc7aa0cd335b0e82cddde5f75c4d1e35490608d32f24a2bed0d0fbcac88919728e3b3312665bd1e60d3f13a325bdcef4acfddab0f8c2d9f4fb2454d99
-
Filesize
26KB
MD5d765f43cbea72d14c04af3d2b9c8e54b
SHA1daebe266073616e5fc931c319470fcf42a06867a
SHA25689c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0
SHA512ff83225ed348aa8558fb3055ceb43863bad5cf775e410ed8acda7316b56cd5c9360e63ed71abbc8929f7dcf51fd9a948b16d58242a7a2b16108e696c11d548b2
-
Filesize
7KB
MD541884571579f88540326252b81d0a9f8
SHA1cfd0ba5db827d21e4fa71663c045b5676d303d6e
SHA256a461b764e248d3e59a1a730ff94af7e61121f5a02004e02b3b866ac8fd1689be
SHA5123eeeffc02998c73a11d4a0988fe3823b52ce560f8cb40c76ab810d5ea78dd42811cf30ae35bf11d55f17b3804154ddb483acff2f11261bfc382b5e18eb42688b
-
Filesize
18KB
MD5ad8a5cbec4f83ae4f850c793713ee770
SHA1bee00a5037d4f1232837d27bca21658efcff1750
SHA256878c1b205887b61906f6f4f8da5783d2bb8756d0a39359288d09f65f983b27c2
SHA5125e88ce1ba2c1dc17e04d26d9afaa97987e61d1c57c97bb1e8a07561b33f763052d0e4bddd184e11ac19e514c7041f9750a6dc576f27161a136765fd1240e5327
-
Filesize
22KB
MD5f49967c396969b71c3a72537db03a68b
SHA1f59d3a5d2afd85fbb9fb36f1411c767be2bf96cf
SHA2563b1ff5252012d6e8a7dd6e4621ec43812510dca1a25a9a2e07288800f445dd41
SHA512cda4269b5a13e573469b3e3a75432117079c65279e06322519af704a80862e43bceb4cc9d6352dd19db00bb10d10f64b02eee6c5dc29f56fa5f99c89823a62e3
-
Filesize
325KB
MD596cbdd0c761ad32e9d5822743665fe27
SHA1c0a914d4aa6729fb8206220f84695d2f8f3a82ce
SHA256cc3f60b37fec578938ee12f11a6357c45e5a97bd3bccdeb8e5efb90b1649a50b
SHA5124dde7e5fb64ee253e07a40aaf8cbc4ddaaeeeafc6aeb33e96bc76c8110f26e2c3809a47266cb7503cbc981c6cb895f3eaae8743d07d6434997684e8d6a3d8eb0
-
Filesize
4KB
MD504be4fc4d204aaad225849c5ab422a95
SHA137ad9bf6c1fb129e6a5e44ddbf12c277d5021c91
SHA2566f8a17b8c96e6c748ebea988c26f6bcaad138d1fe99b9f828cd9ff13ae6a1446
SHA5124e3455a4693646cdab43aef34e67dd785fa90048390003fa798a5bfcde118abda09d8688214cb973d7bbdd7c6aefc87201dceda989010b28c5fffc5da00dfc26
-
Filesize
248B
MD55f2d345efb0c3d39c0fde00cf8c78b55
SHA112acf8cc19178ce63ac8628d07c4ff4046b2264c
SHA256bf5f767443e238cf7c314eae04b4466fb7e19601780791dd649b960765432e97
SHA512d44b5f9859f4f34123f376254c7ad3ba8e0716973d340d0826520b6f5d391e0b4d2773cc165ef82c385c3922d8e56d2599a75e5dc2b92c10dad9d970dce2a18b
-
Filesize
633B
MD5db3e60d6fe6416cd77607c8b156de86d
SHA147a2051fda09c6df7c393d1a13ee4804c7cf2477
SHA256d6cafeaaf75a3d2742cd28f8fc7045f2a703823cdc7acb116fa6df68361efccd
SHA512aec90d563d8f54ac1dbb9e629a63d65f9df91eadc741e78ba22591ca3f47b7a5ff5a105af584d3a644280ff95074a066781e6a86e3eb7b7507a5532801eb52ee
-
Filesize
430KB
MD54d7d8dc78eed50395016b872bb421fc4
SHA1e546044133dfdc426fd4901e80cf0dea1d1d7ab7
SHA256b20d4193fdf0fe9df463c9573791b9b8a79056812bb1bba2db1cf00dd2df4719
SHA5126c0991c3902645a513bdee7288ad30c34e33fca69e2f2f45c07711f7b2fdc341336d6f07652e0d9e40fbac39c35940eda0715e19ef9dfa552a46e09e23f56fdf
-
Filesize
3.5MB
MD57f014da8687ccd59759c8a984c1e7356
SHA19a0ce7660a23eccd645a41a5ee2973818d0cc35e
SHA2566c1a7887dda10eb8409c8d131e6b0a88ce7290f4c5aa9784d9dc35a51000f340
SHA512a4a15a141b64f5549d120ad8e09686448554c6c670ba56746c23abd58a71a7e8051d534d00255af973e974c084123b114027991be48f645acd7ec2ccb123107e
-
Filesize
118B
MD5ba4567388c38cd975fe4288633763434
SHA10cfdb35b199cac669fd61d4231657ed095b1e9bf
SHA256dd4f941794a9bf67fbdaba16e50b061fda3e08bf3128e9eda9c36fba7f1d7bef
SHA512d5bd2d0bdcf1f9225f4ae4047d97dbe29860bb432af61d907c8a60875bfe1735564d2df41a9101c80bc0b329f3b18f208756a3d86b8e35eb9b09548cfe7536fa
-
Filesize
176B
MD5fddb71f74816a6f4db6527559a0907e6
SHA1d78672ec9ed9f0eabd8def8618f61eef3ef63839
SHA256d44c624400e6d1802e878d69ff2ac38ac8d2ba73da60b45dd3e46bb1dd545717
SHA512e7739a7e9324a3a2a04b03502e0f562e3eaf70ee1607d0e3adddb3f4eb83adc2999dc2d5ca6cef79f47a65c5c1e1b0cc9c62c08edadbf9a06d7fd8a929c65f0e
-
Filesize
119B
MD5faae08d055ed123742bc415108373af6
SHA126f07cc260dce6c856c55c9da82c46795672c04e
SHA2567bc64209a8d58605fcb372c5c9a486a08102dce7a711f1c03368727c37448751
SHA5128c4ad38651a2bbc03427f6bab02a1fb4f4c18303457763c4d676ab7e5f767c11e03c92fd22ef6ed393a49164b7e73ca3eb2215d67a1e6b868b93ab6d65091880
-
Filesize
687B
MD50807cf29fc4c5d7d87c1689eb2e0baaa
SHA1d0914fb069469d47a36d339ca70164253fccf022
SHA256f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
SHA5125324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
-
Filesize
141KB
MD5677edd1a17d50f0bd11783f58725d0e7
SHA198fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA256c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
SHA512c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
-
Filesize
43B
MD555cf847309615667a4165f3796268958
SHA1097d7d123cb0658c6de187e42c653ad7d5bbf527
SHA25654f5c87c918f69861d93ed21544aac7d38645d10a890fc5b903730eb16d9a877
SHA51253c71b860711561015c09c5000804f3713651ba2db57ccf434aebee07c56e5a162bdf317ce8de55926e34899812b42c994c3ce50870487bfa1803033db9452b7
-
Filesize
194KB
MD5c18898ca5a97bc5807f3be336fb1338c
SHA183fbeaa1c4a4b69599cc6eb08f8958a6908f6b32
SHA2562e8375c8ba1c0f5379de54bf4bcb0af7ae0ef3c2a6af07409c8d007ff0685b71
SHA512f7163299688c9fdaae8882c38e5992cd23d90f48a6d36a307e756794c6c0541afbebf12b584c2e03464008e2e4927e775e57e3f982e412206b7d9db271976a93
-
Filesize
207B
MD5a2294db65c800d2e518ec4943a2dd187
SHA102e293150a096b6342d1c39ab57b27d5c0c8cd7a
SHA2567cd803353a8af5af891ddf63908e408d1667cfc4b4d2882c61a0fe734df919ec
SHA512115c2d5573795136eaf70cd9c89478d3b1c4dd95aa7189cfdf59319cbafc7f90a01e57c34050bfb24095bada13db3bae26515a1d4c2479f646ae52851dc41f53
-
Filesize
349KB
MD5fc3dafe25d5bc30a830ab92aefe52634
SHA12e1bda9bebb1539aadf6a2c6ca33c3b9ac8865fc
SHA25670b35d024405f6adfb37715e58cadeefab36e305158a73e8a4cc377bae1a4476
SHA512d9ec9ad58ef765de7fb1cf737e9d287453005edbb5c47524e19938161c14b16b59084e9b91a2b40389c43fe9204fb9fd41698aee68968fb2fb046a4cbeb73829
-
Filesize
217B
MD58fc4f4bf76a946d682606a6be94a822d
SHA13248c1d836e9eab63f0b647ed3249af2dc0e342f
SHA25669feb09a5aa11d2badb4cdf17c2ddf7861a97a1d3a6add0ded22e5e9e07defc5
SHA5125301c9918ed28c51ffa1d06796f897d7d7df3954a339718647aff9d11c7c96fb27fe1cb0fc7438c5ae1e86cc9a7322fea7b41b646ae03a4d51f70aa4bef6f488
-
Filesize
2KB
MD5bc9ad2740adac2c7538a79512cc82ed3
SHA1d9eccae7a5f764783cf24d1b99261a11916acc5d
SHA2564cc249edb3766c0785b0a6988860e976fba32f171190f77a61591dbe9b99f6e5
SHA51298a0638ecc793fbfa15cdc8358e4698f7a1adefd0acb0dc14a70bf3d7a2e2968d22408dbbd31543a9d02c597fe20b4ec9055f49cf04d4b636e6959d50c825a2e
-
Filesize
17KB
MD5a8a5d8011c0fba767fdb65e310d9d981
SHA1d38c43a3a4176d8847547d90c9b8be478a62ecbb
SHA256ec84d7f7829890d6b63ddeb85e964be66d9813aee6890f6510ac63ce4da66fba
SHA512ff800d2bc1a4d29908fd005d79ffbfa8a28f0415fc8502b10372800392f758ea8f84d5bf1049a9c999618deb9d7b2d774f2166853aded08a3feacaae5da5876d
-
Filesize
4KB
MD590bddbfa03f8a8932441184ef6f11117
SHA18bb1a36efb23a05631b06e590114ea68d7053c5a
SHA2562c2b7029fd8cbb88571d0b5cc876f538ab5c7dada9da9dffdbd144f69b730f83
SHA5122a1d74d4913d6ebd69831322e49d1673bc8f770fc48f543ad52234f0c3c6823395a0bf723c42b68ef2f8b9e99cd51dad9227967387b42f7baa9fbddf1709ed54
-
Filesize
1017B
MD56e4a780e1278568d87011e4fed4ef142
SHA162eb3727e23fccc57010fb9bf286028770b95c21
SHA2567a666745a440d20f0e5a8203421770ceb7e7276a90dab41b772854b5aeef5eee
SHA512794915765cab00aac1e0e59a0dd2d84808f815fcc9aef3be654c29ff8e33161933152fb64a532e5b27d68a1ee48d5024cafe57d1853f76d3bb0583f16e9762d0
-
Filesize
1KB
MD5170db61895e146501a69d45b3235949f
SHA16c79043d7196711b276591a7fc0015b971bd40c3
SHA256c22f0794774de173b94b60f08da9862480357777a863b7122cd28d6c6b3084ae
SHA512ba8f91a7b660feca735b00e79ba37edae0ddde4d949eae6ae4fe81571933123a1f70c50f2842f5510bb0d6f5007d04a0b9c4c4b5903784c43793e3e2ee05c011
-
Filesize
3KB
MD5ceed1a1b0978a87f21ce3551f6096603
SHA1bfec504a97710bee5549c3ce23e52fd79ae07e1c
SHA25603ffa863265d11e50f71e219eadee522536e150362b9281ac3d6a65c977b737f
SHA5125a7ed526c05f3abd787fe205cc8fbb0409c872d977be5fb05c1dbf1984219f6209779e0a1dcfd55515737703bb55096008ed2c55575d4b7ccd789cdc79bcfed5
-
Filesize
4KB
MD54bcf600532796fd8666d2efa9f440948
SHA15f5194bed841251d668d63e7b2b0151a6d203111
SHA256297efbbb7eb632f19e4d4a6d1579ee94bb8b2f8f317d0fd371cd236da4bbce05
SHA5124fd5e3c87e6d817ee1a8a315d6b374b9bb3ca5fd2c0e9bea94cbc523bd2947b2884c238f954069a1c88e58db231114feb1a094ec2b1d4a06e00083f33f4eadaa
-
Filesize
4KB
MD57bad020181231450bccbdd028bcdf1db
SHA120eccc604326598a7d1f00575a40720ce28aaf78
SHA2560e9a5783d7388e0ea9847d81a4270ed4ea06fb2d15614c9a337090336e1d0065
SHA512e8d71ee9348fe6e534b99e7694b13b9fb1c7d97db3126a93ff00a3d1ac63043bab9940efdfbc1f264be424682c634e22e7e58dee7548eb61a4d2147af402b747
-
Filesize
2KB
MD501b67a368041d42382ddd775fdc85cf2
SHA10083f6967a77edac9c01f9e5ef83845f0d9bbb87
SHA256f7c6971e321a1173614060ae9be24ccb8b6039fea616a219c0313d611a7b6f3f
SHA512bca3909e66c371db5b7ec1dc8578283af49ab529f8cb5ea75d4a375a030821827e9c3fc01ba2d4446d11b5284f0356dbf192788cf8186a7b54df7a765acd2b04
-
Filesize
4KB
MD581960cba68a62eda718f40cdf1c66dd9
SHA1dc30b93321338c24e38d3aaafd34c325bc7a13f8
SHA2564fc06b4a372000bc289a4368d06938d4f3ea9690742e87d0e1da84626a7689ec
SHA5127ce8b70d46b64f46b4eedb60b67ed9fde5e43c1bd0356112f7fefaedeaf4ff63df128eac058eb04b9e9540b39e80a238942614fd0bfd746d9ecd62cbcb20b7dc
-
Filesize
1KB
MD5d44179c38bd746e520cf16174305d72f
SHA1d2956d852508e9a172fd6dae12d3cf09de8e118c
SHA256571e846ba3555f75b4aa6271bb75309c9715a59685bdbeb7986cd46464ec9ddc
SHA512d29e76021a8fbb41dd09c6a4ae12393a52caf219435c804d439cc33a15fb169050845be248061471537ab45cdc8235014447b98bc2aeb4fe745b9bd4b8772f79
-
Filesize
1KB
MD51bc4fba9328415e1505c7a59f3d723b5
SHA1c8fe0898e5f8dd8eb73df0fa3b52362bf47eb048
SHA256644ac41847d77bdea58cfb6a4ea8ca4e83371ac06c6beb2f606b4172ae4b10b6
SHA5128833bb43a010c96b0d0de7a825a6cc8b35d78cbafbc6826dcd5b7c6780429d9b1896ee82c36b410c748ed416fd64b5f61010e791456ccb29a6a30164b7730aee
-
Filesize
4KB
MD5cba7c80b9a170e284d00cbd026d8ba3b
SHA108bbf621cd7884b29768257adf81777c579f2617
SHA25636fc7477473536f51b3186bb9283b70c73e64b25bd261a79b8b2c409b7db446f
SHA512c9a659a5e9ac3600b9976e466aefef7ba7974f9890f8e41397c642ac4da47a7b3b10ffd18b0d9e1773f346d83d15c6c3d9e6db50c42130a489165a62233d9d1b
-
Filesize
3KB
MD5bc7bdb5ad6a025e6711e4cbe6f8d15db
SHA11dd4a8bef40897fdd81ff8f2e00282a820cc4f6e
SHA256f540a721388dac50ab4beb759484b0e7f7809c5bdac8472249198f90210b4f6a
SHA512a9d1b8dd97a1e0a260eb433dbcb0cd742ec7b4e11f0df1c09fdc3dc6115fd552764b3e951732be158e746cf484a5fde4bd1ab2eaa34c11d5416badb9c6907fc7
-
Filesize
4KB
MD584963c1f3e75af6cafa8ef6e75af7165
SHA1dd3657a715e249d1d332a224e16df7d4604f3eb7
SHA25648005cb3f84f9fcdc6b3e29eff44e72685a19206813716b456df19d044ce6752
SHA512b40d1465f88196fd205d9f08894d929b0fed6afb99dcc39bb1831d1a95046b41c324eefa69891ef58fa4e92f420423d6502d13fb3edc74b7c54d83fd985bafe3
-
Filesize
1KB
MD56960239f9f404e3f9167f1a23a18a70c
SHA1fd59111f461a2219de6061044a44b6cf0bbb14cb
SHA2562441d1467d740e9984dc8b99ca943c028d6b513170012bfcd0d1d489e210839f
SHA5127eee72c2fcd253f6eac7e5a672540ffe9a75ab4c057397f0d42ce64d9fa3d5de790abbbaf24d0f6e5cd3a2a8c040395ecf112e749836f2c9d587ad804d26d462
-
Filesize
106KB
MD585d06a8a7ce1b9b486ca5d966f63eebb
SHA1e163788dca7e480a17990cd63413c1169c477ea4
SHA2564f6e5f6eaf996ea3c9de6a634c4f07ce2d9b08b47e0f47b3f9d3e7577e91df00
SHA5128db580fe3c679cd4bd0e7ffbce9e0f48a677698a880e4e23f55a4d5e4583f3ec924abf96fada49ee8f4fbe9ba26e9a200a0e6037ac50ac39853c0728b418a33a
-
Filesize
4KB
MD58fec3065ac07278d437813d3c7927c7e
SHA1acec832dcfd6a6bb2901cebd6796c9af1171e284
SHA256acecd6594bca4115afe4a0c88562879563dab9f1fd018391d7cf7b40b9b2fe54
SHA512c8b3f310ca18f150493415aa1f14b8704c4a2c31af5c060323769e724fcf898d8326909804d93ca09b83abf48fc9d956d0ffc5c0d49a3b5aa585669c21ff7bc7
-
Filesize
856B
MD58b785b636b6bff459eced726772235bb
SHA19e92fcb97d7e1f87fcc60245bfb0c0ca926e51f6
SHA256be30dc37b1597354526ced5f120b5a8ddfb109df3bdb63488910b6d740c00311
SHA512d0b190a46520c3f3befdd97deb45593128c5d10de0bdd2b093aa170711ca82f4dd023b83ff048c701eb6e41ab922da8cc5375058f629b7128a3d74d4a836a340
-
Filesize
3KB
MD5f6f6d831d560c82e90c3825a948eb0cb
SHA10bb2d90881b336c78fb575c85c86fe0a0b43a659
SHA25616c7db01b5549c863804499192d2053bc04feeb031c2bed9d8effb790d1a5689
SHA5122d128bf6146f5c05c23604ea4c67995ecd43be75632715ab13bdd83e270fd5726ec8eb752043f9604c7050ba99d2148d62b277bf03f580bad668b194d5c0c6a4
-
Filesize
3KB
MD5d9b00cb104aa54d5ef76f9c45a61e799
SHA141171a72ba101b8dfd07813fffbc25760aa8ef09
SHA256561f177acc08fe10503e16afdee9fd9f17310bdbc729777eeb3c1212e4433da3
SHA5122f7fb601b64cc44a4c6d31ff00db2438b50c1f5aeb011f3fb800368a38d96b64f10f7ffc847c1211af6135576d584f38682c515d3525b3d3529a2091d85897fc
-
Filesize
4KB
MD5c4e14980c7f03b0c170aeb8cdf27b0ac
SHA156f05454e5ebd96b838c9ada36eaba9b286fa5ee
SHA256bad677e58704db3466d665923c1cc1ac73f6c3652ff18cfd7b58acc256c3264c
SHA512211a4f32609cb4179a6b7e478080032d4e6b866811e36606745e3ff68ed25f4f662308d8f5373be900ccb185812f5eab42a97bac15e5b5624d441893730c0771
-
Filesize
2KB
MD5120d7e46e0fc01c23852c3bc3ce4e4c2
SHA1e5fa5ec8007e03ff8de66bbacd2e17448518ad2e
SHA25676211212b7b7751977ef062e01bf96819e2701dfb13cf42fcb95828a91d0d945
SHA512b86cf908f0cba3ed1d52a0a4b698e859dc1d7b0543aa37681d43ed17ed92e2c947b28dabe13ad222d327fa78234aa03b9f818e296391d6e8a15bc8f9ad9275b5
-
Filesize
1KB
MD59184cc84aba972c1901db92e2f6ce9b1
SHA1d85b2f3529cd1cccc52657dffdfa0dec5cf859e8
SHA25608ee78a858834e0d9af5d82f979f3f7af514d13e82c4dd1181566dc80ad9110c
SHA51280c83ccc8949ec383580104a4b8a3c866544b4f28e1075674e587e811c1581803b92aa30c2c7a86935895f15444d91c7bba985956c7ee0e02375f9ee38c8bf6d
-
Filesize
3.1MB
MD5781e128f2ac706d99235e322e706a834
SHA132b38a3f138d02abaa9c6c942622c76d7de8ef4d
SHA256d7f27f231bb7dd4c2a50ef3ed37643f920fa2f48f5fe4f97e68f714ed0c10ed8
SHA512f501800739974f14451c2371748053519d9b9d7544e71d914b082eb33fefd0f3db6e1aa4198fcc1f4f5e42515dfc18b1c985709631dd5036db892031b91e2ab3
-
Filesize
4KB
MD58cc9f2b12e5f84e9632ab0062869095c
SHA1e1a079d7506e448050c11a4ef5cfd1f8526d8258
SHA2560e4dbbef087cf014242885cfbf3225000c2d10c0c59d238a6a3ae93dda12a7b8
SHA512b74f2aca0588e2f31ea4891c1be1cfedb1bd4f53b94636ad5f4aca847a816435e4f37b495cd2ae73da2895a134e7fc0f86875efc94986881fbf7ba5e7dea0a87
-
Filesize
183KB
MD56c954a0c7d0d28beea1cac4c65632253
SHA1008957f6d1f4a65f21713eb84203825f1b82b789
SHA25668cbb1d6ee0dc57072e6d5c29a6f30ef2d2373a8fb6a5f17a1e860886267aad7
SHA512527dda878c68878e9570431d824c2a7bcb3bb56087576488e7a881012b6f5b1d5818779e5c5087aea4e262e57932c5bd9afec198fc7ce9a077a66c659c17cdf3
-
Filesize
5.1MB
MD5d13bddae18c3ee69e044ccf845e92116
SHA131129f1e8074a4259f38641d4f74f02ca980ec60
SHA2561fac07374505f68520aa60852e3a3a656449fceacb7476df7414c73f394ad9e0
SHA51270b2b752c2a61dcf52f0aadcd0ab0fdf4d06dc140aee6520a8c9d428379deb9fdcc101140c37029d2bac65a6cfcf5ed4216db45e4a162acbc7c8c8b666cd15dd
-
Filesize
131KB
MD5973a460ffffaa07b9591ce64f3301328
SHA1e3427ccb5682afdbe67fa22a77886b2204031af6
SHA256a2048698e2d32f61bf51b0b5c83d9bedb4013e2eccda047c6c249e0a82e70150
SHA5122ebb052fb0d18e06f422cd1e5e1d526aea77fb0f95bb2c9724210dc4ba6c79f6f156b2b5e5cc7e4934c072a83b20eed838de4324de3771915e5e0e690672a5cd
-
Filesize
2.9MB
MD510a8f2f82452e5aaf2484d7230ec5758
SHA11bf814ddace7c3915547c2085f14e361bbd91959
SHA25697bffb5fc024494f5b4ad1e50fdb8fad37559c05e5d177107895de0a1741b50b
SHA5126df8953699e8f5ccff900074fd302d5eb7cad9a55d257ac1ef2cb3b60ba1c54afe74aee62dc4b06b3f6edf14617c2d236749357c5e80c5a13d4f9afcb4efa097
-
Filesize
27KB
MD58de77a5ac1a0cb41f096b46ce93f86aa
SHA10f247215053bbe9799c18b5e2429d3e1f3f17c36
SHA256b8a4ec881932f0387aee3b5fdb50bcef6c28c1952e99e06ca6136cb8bc978a72
SHA512644bc1ce3ac4431dbc1efb67de09ed370d0dba488181ca334077f422c9493b8f1dd5006bb6dcbd02d4712998f6777b15d41e62ca429d2e4ffc3b24376b106fc1
-
Filesize
550KB
MD5afb68bc4ae0b7040878a0b0c2a5177de
SHA1ed4cac2f19b504a8fe27ad05805dd03aa552654e
SHA25676e6f11076cc48eb453abbdbd616c1c46f280d2b4c521c906adf12bb3129067b
SHA512ebc4c1f2da977d359791859495f9e37b05491e47d39e88a001cb6f2b7b1836b1470b6904c026142c2b1b4fe835560017641d6810a7e8a5c89766e55dd26e8c43
-
Filesize
122KB
MD5f1ebaaed07561200badff25c9eea5010
SHA1ed1a95703b6dc80668307e1efe3b93bf00dc55c6
SHA25670ca8aef3c32361a376e9687f2876cc166dbc5c429b70a1d01801c5a51e0ba78
SHA512f8b71d8658ac74a6b1830f1cb74a07636b26055585d178df35a4b76926bafd16d2cbfc3ce96da3f8fd6bfd93daa053d867b9023c0ffebe9955e980ff5d224318
-
Filesize
2.8MB
MD5f371cf8dbadd17e03393aa21f3963401
SHA18b7a906b5d6ab57a3bf7b32401a286e812327813
SHA256287e1aed9f449999e9852477960f8b67b2b77869463e1baabe63bec75142130a
SHA512d910f4d48f4f34c0d9a68a89fc846e9c776081975c8d0bb14478c7978d8be43e4e2666f957deca1ea411032d08b9b2bed19849fe284e4a2ef91806c730cc570a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
Filesize2KB
MD5194ed61537032c4b07d54342829fff87
SHA15f8647ac3c9f5930a5ce33d804992ba2f5e6d882
SHA256bf64d48c901fb3e87cc6cdccc3a03420ba207309fa76efe47ac65f81adf313a1
SHA51261ff7aad065d0632955a40922ea2c83dc9ef29ec63a203ee87eefb92931375a069ec7d259baf840b7ed30f49b544feeeae7cb2cd4bb07bf68dd9759d742656ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD5a26045c60badc3ea12344117b7bc4403
SHA1e042d0cb3844ca44869d5e01a2e427144b458556
SHA25669872c2a3c0bdca24598431943ea06f46d2a28bee615698ae09ba335b1cfa925
SHA5127b0e7562480066d929e4dce2201ced8be9e7d309d28ada04d7779a9ab232ee4bf5a8ba89317865eb382250f8f529c0c0b95d8eb80cff800e595280f2f395d7bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
Filesize488B
MD5dc6292626ebae9261042d46d8e4c9e2a
SHA1e9aa857681418344e17a2fa4a78aaaa457917eae
SHA256435bbe0c8350272bb4f7b66c78944f09c5a84fab1c559c2d5814bc06b96417dc
SHA5125422630d7cc3b044583eb5a7f4353fd7e2c2d8d46a2e093caa3e2e41150a9ec73a348cb9241422d1e90eac9b836632b222266c3285fe38fbdb96335995967901
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B
Filesize488B
MD5836632ed250ff475e6406959df1c1ee2
SHA11abdeae747e75f7c9d3c85add1ea521754be47b1
SHA256d8821d17ba17b9884bb107bb29aef1d5d5036859cd5005ef1e7cff30e395b632
SHA512116b1773c9a59648277d7fa4f8d8a170ad9ab391382ce9f901b7359e93288ac0a2aacca26e325628863768653fe23d7ca23f0d092c24de40ee28f5474de6a5dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD5db225070d364cb79d63c82797c70f346
SHA1496e703e2c4c45c662a22be4c38f9a7002d0dbad
SHA256a876e20c614b6ab5be77e5175309cf8098450285d5ebf321ddb4999263a9fffe
SHA5123e51ab25dcd48fd7a875b2b556ab90852c913e26e526013efb0240ea0b09ebe46d3de12ecc01fe79f8b481905fd0ea106e3d6ec37c84ac315b32d3e320ab7ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD597c5e7651dc2a52235d277bb0681d94b
SHA1b9876c20fbea293e3a868ac1e27c2bb001381ea5
SHA256cebacc3b2b73bf374d0ce58614fb64b920b88d610608b47ad0e2d92275e28132
SHA51297aa1e26373d7f957a0d76938ad666359dd74821ab2636da4b79ea6e59226ad9b29ede34023831b69c7bed312ace161612471f0b291d07f2d052b1628ce7c596
-
Filesize
4B
MD5f49655f856acb8884cc0ace29216f511
SHA1cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA2567852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
SHA512599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
-
Filesize
28KB
MD518aacb90203ebb75039cca11a041bef2
SHA188e2c9636580cda6034d373845f2e61eae08fd5f
SHA256577ad27acddf39ab77d155bb557931e3062d789377c7b0073b1f482d2781f3b6
SHA512462153c075795065d683aac8df58a8589b2e2c7065494d953719f90449fc3f7dca0ef03bb2757d1dd1ef6e535ca3efeb6bc029946d89837c3fbff01ea3130ed4
-
Filesize
280B
MD570445f6f531fa44fe68e040da14e9b6c
SHA1bc21ebaaec97cb8777d3dc81848385b82675ef60
SHA256b5ad071c121e87abdf95e20a248e943ab8d7cb74f9bfcbc92a508fdb1d57ba23
SHA512ef4cdf59cac37f54904b6945394d63e8bb243f713a26ec63ffbd111c2a45bf15d106e3b5304afb76628f03a2e6a1f21f11ab858b1ff412635fbb107dcbe28c3a
-
Filesize
280B
MD51a1d1588801eee3986550a34ee34b573
SHA17b4b33ee049d93ec1ded34f9ce40ec34176c5ab5
SHA2562be833e7f36ce9178f72ca162e8b4567ccaa44161d76e9d173d6a460c5b60560
SHA5126f0b5f18e66f90030f975ed1b745f707345c4fe8fd9e9559bb3685579f089a0e26f82af9877dbe5474fc02a674093548f519bb54e6cbe9ceb53bb512b4d25c0f
-
Filesize
280B
MD5722d02ca2fe6725165fc0abfb2ceb41c
SHA15aae4b64b80edeeea1790f099cc0e20232b5dacb
SHA25655a576e87a9e18e26cd5006bd8ac1e468ac9a0f836a11f5ef2c0da07418771c2
SHA512a74137ee20ff485566c824234ec9a3cf42f52e09c57b6b08b1a2bdbf1753bfaa09d1e8b931a3e63c8b243038a10a3c15b021c146ed7fae45216ed1360949fcd4
-
Filesize
280B
MD58ae0976d01968e8f89a9712f1b9230ee
SHA1a2ea019e555010466d29fac76c08398b258afd75
SHA256a1e965f3bda9c77b6c25656ee5056e08b90fb09cf4126ef23a4b859a576d0de0
SHA512b49f6ea120346025dce65fbccb6ad6dc6017baa4a70ce439c74fc9a6a7227c7d8f2e6fac28cda31cfddcc888ee8bb5e9ed2c3d722b05f869868b45403bf82867
-
Filesize
280B
MD5983bff20d77e80e51c45a97d8c863c04
SHA14e21e775ca13c16920efe354e5c8fac13618e389
SHA2562648fa860500ee4ce3459e2d1fac01ee8b8b32e6164a262b4ae453698491e460
SHA51289ce898914175d38e9816de5f7797bd5ddc7e91ad09efbdb12cf310093cbac00058cff1bb9cd311c31d8f22114ec324e0abd41a616796da8b9d28a67c2fa543c
-
Filesize
280B
MD5f2f878fa6483a891934bb9fdcae78904
SHA111c4ca8411052f323f751493203f1890205a8d5e
SHA25644d8eaf91b1210947fc05190d0135a006a6dd9c6acec03139d057ae1b56402c7
SHA51286b27ca91f5c7963e11e9f414c4e54a15e845f5f0887357727c1b70b53ff1b7d24bd83304f230e14e7bc676c0682ae9a6a881910b3b8bf69364a27fb3cdf2acb
-
Filesize
280B
MD59c266ba153239dec3dc66bab30e1661c
SHA1a88c62e90f222e176ba3b7e5fee884edfdcff889
SHA256f8db074b3c0556ab7caed6c1c86730782404ce82d393c8429094749f84e60bfb
SHA5122e23db7688e61e75bec328cda225e1f66cfb2cbd4210ee9f1e5a50785ee643a8e58fbe5595419de9cabe61a5d2603f40506dedc49f2843cce31b6ddc804c8c89
-
Filesize
280B
MD54224e4590cb0f8020274597ca08a96c5
SHA1dff0809a5abe0fc46bedb8c8d6d75013c9374101
SHA256cac321f8109cbbe3c2a8c2e83eb46fb4a130146787d756887d69eabea5e228f8
SHA512ddadd6c849f47f71b2d51004a37abc3aa725edef1dcdb3dad1d4986eb243c6c172e06c3da3f4861cd0439327d0dfbf601a302589c1451c4ac7acc96095fa023b
-
Filesize
280B
MD5c793b25e510abc926281ccc819635adb
SHA101df34a3a438066a4662296fb9f4d012d990738e
SHA256fe545ecceb416ab60509981b2005669aff6f9095f25511737b92b4b2bda1ec9c
SHA51290f6bf146b4532ea11a50bd62bf35d2267ee332654d88e841eab27b86c782e6d329e0a0d45ff2e14a12df36cfaa88ddaa5d6ce6537501e8d3ada55adfca5ccdb
-
Filesize
152B
MD5439b5e04ca18c7fb02cf406e6eb24167
SHA1e0c5bb6216903934726e3570b7d63295b9d28987
SHA256247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
SHA512d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
-
Filesize
152B
MD5a8e767fd33edd97d306efb6905f93252
SHA1a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA256c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
SHA51207b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\331bed41-2f2b-4f10-9192-8789cfcd70dc.tmp
Filesize124KB
MD57f28d5632a4cb70ba739caa2f57e26bb
SHA1864eaaeedce498b91f5904f5c9ba1de5dafc2935
SHA256b53af04f170a2abe8bf4ebbf97669f3d814668e87067151d72beec402c81d14b
SHA512e46de59c572095acea559193c4a22e8c57d643db800f28f7e1f1e1761b2491dfcb1a3b54de7accf9451f0b1813c938c92564a9f4a9c5033212b33c5bf629d8f1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fecda30-4189-45dd-9613-9b53c9561603.tmp
Filesize6KB
MD5a6eac6182953f29141ad12c7a6888fd9
SHA1aaf3525fc2ea315d5b98765ae62e00a01aba2cd1
SHA256fa9b83ef6c9d476901108598df99ba71f1932e9b59140dc4bd53c3a04bd0ff21
SHA5129b3b87ab04dec4e4f68a01053993c717442f79fa2b92727b6822a99fc74c25b05f334c54675ddfa6247de97247cc3b5f584a5ddee8dfb976dea94e3c5f85f591
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\95092e0e-1c34-46c7-8836-fe7a7c4ac02b.tmp
Filesize1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
32KB
MD5f48baec69cc4dc0852d118259eff2d56
SHA1e64c6e4423421da5b35700154810cb67160bc32b
SHA256463d99ca5448f815a05b2d946ddae9eed3e21c335c0f4cfe7a16944e3512f76c
SHA51206fdccb5d9536ab7c68355dbf49ac02ebccad5a4ea01cb62200fd67728a6d05c276403e588a5bdceacf5e671913fc65b63e8b92456ca5493dae5b5a70e4a8b37
-
Filesize
24KB
MD5f782de7f00a1e90076b6b77a05fa908a
SHA14ed15dad2baa61e9627bf2179aa7b9188ce7d4e1
SHA256d0b96d69ee7f70f041f493592de3805bfb338e50babdee522fcf145cb98fc968
SHA51278ec6f253e876d8f0812a9570f6079903d63dd000458f4f517ec44c8dd7468e51703ea17ecce2658d9ea1fdb5246c8db5887a16be80115bbf71fe53f439d8766
-
Filesize
56KB
MD578c2b586d013f22c00a7fba84f1b17dd
SHA1297e8185e03b95dc9ac1d3bd61d7fa6870af5e22
SHA256296967c3f68bf40c880602e4f9332488b55e6b901d7f9abb0190d391e2c1895e
SHA5126904ac1bc42db7d8e0b7470369dbd2de6936f90af3e00c247d773ef2b8c20cd4ba54ca6fd3983f37052f8d74faed449d14d790ba500ad0ac72a3d72dca82a077
-
Filesize
77KB
MD5b15db15f746f29ffa02638cb455b8ec0
SHA175a88815c47a249eadb5f0edc1675957f860cca7
SHA2567f4d3fd0a705dbf8403298aad91d5de6972e6b5d536068eba8b24954a5a0a8c7
SHA51284e621ac534c416cf13880059d76ce842fa74bb433a274aa5d106adbda20354fa5ed751ed1d13d0c393d54ceb37fe8dbd2f653e4cb791e9f9d3d2a50a250b05f
-
Filesize
74KB
MD5a06da7f0950f9dd366fc9db9d56d618a
SHA1509988477da79c146cb93fb728405f18e923c2de
SHA2565d9190292acdd48ba0fc35080f7e7448f3cdf0d79199a4d23f0f49b5341fdf29
SHA512b53d839c5464f7a2904cabcd1e7d6456e2ed1702254450833fc586f4b3a4e6dc07c24f443415a2710e241af8d2dda1b9c17f050045e76501e9b5aa2cb4801ea8
-
Filesize
64KB
MD5d6b36c7d4b06f140f860ddc91a4c659c
SHA1ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA25634013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
SHA5122a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
-
Filesize
69KB
MD5aac57f6f587f163486628b8860aa3637
SHA1b1b51e14672caae2361f0e2c54b72d1107cfce54
SHA2560cda72f2d9b6f196897f58d5de1fe1b43424ce55701eac625e591a0fd4ce7486
SHA5120622796aab85764434e30cbe78b4e80e129443744dd13bc376f7a124ed04863c86bb1dcd5222bb1814f6599accbd45c9ee2b983da6c461b68670ae59141a6c1a
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
39KB
MD58facf4d1ac6ff2520d3f9536ec0ba688
SHA105a661afe1d0f83e9566498cb4b895f1c90beae7
SHA256a7d8fbd8a9794a97d9ea3752e450a700c2e295a681b4fa7a21affedc4fdb1a9c
SHA5122cf271954eae3bc8766c3e19215732ee46591cbc3492b24d96cd26376be64dedb711c5d4962377b559b37c097aa267992ef380ad02bd5706435679076805a1d8
-
Filesize
65KB
MD556d57bc655526551f217536f19195495
SHA128b430886d1220855a805d78dc5d6414aeee6995
SHA256f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
SHA5127814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
-
Filesize
88KB
MD5b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1386ba241790252df01a6a028b3238de2f995a559
SHA256b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
SHA512546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
-
Filesize
33KB
MD53cd0f2f60ab620c7be0c2c3dbf2cda97
SHA147fad82bfa9a32d578c0c84aed2840c55bd27bfb
SHA25629a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b
SHA512ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb
-
Filesize
75KB
MD5cf989be758e8dab43e0a5bc0798c71e0
SHA197537516ffd3621ffdd0219ede2a0771a9d1e01d
SHA256beeca69af7bea038faf8f688bf2f10fda22dee6d9d9429306d379a7a4be0c615
SHA512f8a88edb6bcd029ad02cba25cae57fdf9bbc7fa17c26e7d03f09040eb0559bc27bd4db11025706190ae548363a1d3b3f95519b9740e562bb9531c4d51e3ca2b7
-
Filesize
22KB
MD53b5537dce96f57098998e410b0202920
SHA17732b57e4e3bbc122d63f67078efa7cf5f975448
SHA256a1c54426705d6cef00e0ae98f5ad1615735a31a4e200c3a5835b44266a4a3f88
SHA512c038c334db3a467a710c624704eb5884fd40314cd57bd2fd154806a59c0be954c414727628d50e41cdfd86f5334ceefcf1363d641b2681c1137651cbbb4fd55d
-
Filesize
93KB
MD5a65ecf7ff96b372459e2e0bcb1ec3613
SHA1436df866225b1ffd45666579908ddc8b83f184c6
SHA25640aff49d184a907b47aa3d0a7fe4ceaced1a2ce158fb9e4b3f39a67932847dec
SHA512853490892d3112ceb3c4e8e538258ec315c40818e90e80da758fec2fc86a6b3dec28623b802af667b94bff9e587dfeb637f91cc97b6b410c8c897d2ffad1c628
-
Filesize
40KB
MD53051c1e179d84292d3f84a1a0a112c80
SHA1c11a63236373abfe574f2935a0e7024688b71ccb
SHA256992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3
SHA512df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff
-
Filesize
53KB
MD568f0a51fa86985999964ee43de12cdd5
SHA1bbfc7666be00c560b7394fa0b82b864237a99d8c
SHA256f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f
SHA5123049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7
-
Filesize
199KB
MD5585ac11a4e8628c13c32de68f89f98d6
SHA1bcea01f9deb8d6711088cb5c344ebd57997839db
SHA256d692f27c385520c3b4078c35d78cdf154c424d09421dece6de73708659c7e2a6
SHA51276d2ed3f41df567fe4d04060d9871684244764fc59b81cd574a521bb013a6d61955a6aedf390a1701e3bfc24f82d92fd062ca9e461086f762a3087c142211c19
-
Filesize
21KB
MD5fef291823f143f0b6ab87ee2a459746b
SHA16f670fb5615157e3b857c1af70e3c80449c021aa
SHA2562ccc2b4c56b1bc0813719c2ded1ef59cff91e7aeb5d1f3a62058bb33772b24be
SHA512cf28068cc1c1da29583c39d06f21ffa67f2b9a9c4a23e22cbfe98aacae6ddc3dde1f8dab7eaef371dc0a2230d21cc8fd41653fc5d812b14c389e07f5ef7fd5c4
-
Filesize
111KB
MD52115f1067afc19d2045c7652f671712d
SHA1db393a68560156cf9ffe1129a74f13f7e6a078a2
SHA2564500506907e383f19ba0544ec94fa4d87b0aedeb5a0532b94709f8a425b31920
SHA5128792a39cf7a47051b1f660fbec268cd94a0c2c0717143f7a15a83d897de48fbaedf0690a6178e5f6f7205d6780ea36072dcd307de66bd83eb61176eb6baedaaf
-
Filesize
85KB
MD5531b945c783da57a8e6169a179367ed2
SHA19b76921414abaf64e4f4f7d7eeeaee45090f8712
SHA256f1f68df4fe7f8d1febbccd47b5b14d4d5a00b008e1d5a8ecf07f874c75d35cc9
SHA512a21dac2a2d3d2f8694e55fb920ca9fd15b8fb3b58255e2729f7fb88e0cb7aa153f5e667237b4ad4a4d9a402c226fde539194bbbcd57e9229857d8e5278dd6041
-
Filesize
229KB
MD5c6334512044b038e1299c4edd3654bb7
SHA1490f7cd5c7fdd875227c49344de31a2ca58f9335
SHA2563724e559397032d8851ed76802b57fe479e56925d63e5d760aff536b9249df47
SHA512b4c9d98a802525ee82dd8a0de6f07fc77c0243f7d001aca5d54b2ec71325119be45aa4e1ef5d1d035d6237ea9dcf2c976fa170550942c50b568326157d7bfd7e
-
Filesize
405KB
MD5924dfba2b59731f1c700d79bc712b98d
SHA150b3e3f43f5a03488250f20f3efd751da25e6029
SHA25680ec28061393b3f0c4d607a9a05c6c475cd898ad025c06439890b0a3291e60e1
SHA5120a18372a9c6674cb2d4f7c8031dccc87aee1b2b0392e6b776aa630a85cc5563ff25719719fbd3171838e11eb6848ee3efd73a662477ce5342be08a066d248671
-
Filesize
324KB
MD510af61f5da70af50291cb1a6d159893c
SHA173cfb407c74c452a49f5023105f4638ffff6cf4c
SHA2566de20b76ba67700793c9c659a9b9de37a7522e6775269974ab5c9d8e5ec8d89d
SHA5127bfa0747e91726c24db109db24fa7510835a8db62b61b7d3e4219ffb50461ac4f4e6d4b47c92f1e58f5302d5e2449b9e1806c6e3eafaf32943adb7662cd4bac2
-
Filesize
29KB
MD5f3dc9a2ae81a580a6378c5371082fc1d
SHA170f02e7dd9342dbc47583d11ad99c2e5f487c27d
SHA256230189617bfed9ee9f2ac01d11855b9a784d0b6481d3411693db7e1c10ade132
SHA512b1266043a310a5fe5834df6991537b61803ab14b737546a87dd422d2bce7277307973963a6cf4cac4a2a6030831611be9333f8ea4e56ec3d11b70313d30dc3d3
-
Filesize
1.2MB
MD5b76a36f694fd69b229872393bd33b65c
SHA1710ebf0e68bb65f2faa4356abe17f3d164e8b943
SHA2561942ea4d2f0b066d0bbf102d25490e01e3843a204b2cc3cf2b721a7f7ddb9712
SHA5128e4172f38b9b32658717de15c38f5b0c4dfcdbeb73424e6ba4f08981c868fdc240eb5776452f0a71395df2d0bc441f3f88ffaead5860fa672d992a94fb868a26
-
Filesize
49KB
MD5d9306ce36315a193530e5f312c86607a
SHA155924de5f3a8f4222259ae3493c0df633a4cfa29
SHA2564e25ffc3cf72ed5fafb68380c4e27da38b7f64dc9d4bec5162d010dfc4faf83b
SHA512c6a4e627b84f104da9921fca2d942bb23e9772af05feb9f99da26044c2387efd2abaad39a3b263f6cb9255c80a3413a6a28065dabffec6ef71d60df44f073cd0
-
Filesize
42KB
MD5b48651b8cbab85d2ab3057cb428b6015
SHA13aa11a74bb7e54b624362b1743702468dbdc0166
SHA256f9d6aaf6c090d0775c569cbbef7352c2a895f8050fa1daea56eed32ae66dbb42
SHA512ce1dab9c2dd5fcc43a09aa5ef6a43133aa015476196763ae810722bf5b191597dc54f1b3fcba9e225cf4053c936b988cb330a6c199ed8b357511d5e5566e8037
-
Filesize
39KB
MD5046aa7e156dee615b1f1906d2a9b229c
SHA144fb4ab90a9d91bce05924876452d4082970ff38
SHA256ff391caa02195704afe12e0b339af4f1c6c2fc524b00fdc897ceebf648e72c5c
SHA51283b9ad869636c5d6f11d43f302f4b9eeb557b3a630f40230bd3eae04d5cea0dd3bfab6a0822e73ea584d2551e8f312396f8d50eb600909e2ee54e546b15f7c1d
-
Filesize
36KB
MD57120a92101f715c571c8defa2670bed2
SHA1ee36fcc35a0d6919ab2f7b1a6138c2b33be37a3d
SHA256ffdfab06030723242bcddc956de6ebbc1f774e1c944969cb05f4ab9acfba7c99
SHA512431030134d1f0980b24ae4770e6e77c1b05df6a72c67a7772a99a3f868dc1d2cb93bef6f38dbae9c3d7de9b13379d248e7691313039cda379e541e26d3852e80
-
Filesize
40KB
MD546f6ff90b2d88b6e04673903de7bfd20
SHA13a028cc5dc58ba3d17a06c47741878ff68bff183
SHA256ef079a1af1e4614a51e4ab93871b3686167e3f0fa5ae713e5e7d5f4c1bed47b7
SHA5127532cd3dfa302b86e65bc302e993af4ea793884a686f244a181258accb6fe6e9785c40b455fa8cd83cfc4812f8457e1abfd0f34b4dc810aa0df170f29d9c334e
-
Filesize
34KB
MD5099e4aa84d0afada615dd48b28797ecd
SHA11a33dfbb5ade855907dee6335125cac682fd03fe
SHA25693658c19fc7f10933b93523dd87e3e00e15437e76f85acf374be890411c84331
SHA512b6c7dc1969ecda1564ac722677b291868951024f19c5037f06598d4304003b4af02f2e98ca102ced7b2af895068a241119302e59e645853d657b4b6a96edec18
-
Filesize
41KB
MD578f76538d6311abfb8090787446155cc
SHA110888e14597d3810decf913c1c40bece92c765af
SHA2562cf65cbcfbe983e300dc4197333544461ce0c6004092832d74c46b977e3d06b9
SHA51246a9103ee27592bf20e7e4272f1d9fdfca0b28e1cf439849637d521983823cf869e9b116bc09e788a057f5eaa11b2f5b4ba9e00e935d0dcb27d6026f181e01ca
-
Filesize
40KB
MD509f5d6efa1be16eb1e3f9685e56efc24
SHA1b713343bc0cb9820c8244a149c934815d3420235
SHA256285efc13c91dc05bddde281f01e374059e3c52def935e18ac405cef0d072a4d9
SHA512b230249e2cec40db9e764971e2d443d96b58db854872be305c989e277ff4757ade26b49f14c005db58df68e8b57f4a23a919f9fb80ce2f96bc419e594041b36c
-
Filesize
30KB
MD5b9a4e725a313c37c4d672c35f6a02b2b
SHA18664cb3a7ffdb535b8d23e9bae3682a1410448f0
SHA256f851998f6d208f5a4687cafda0f2132059007886fc34741cc1c786b4d8624cc7
SHA5126fb805e8e71b5e13d9704187f8957abe7767bff7c5b254e13b2f31308541bc6959ac44e2784f7ece713871af771dd86d15331a2885dc95d21dd6b51b01fcf4c0
-
Filesize
36KB
MD5727b059a422125bae66dfec9a8687201
SHA120bdedc8efed5a128ed83cea25ac87aa7b946175
SHA2564f21e360be774db9ed664d7d7b28e7e37b432e3307c19962a1179f1bad4308bb
SHA51264ed68a14649cca178cd8205b982bf1c64dd38cf7312a0730641aa9ccffd7737d7b42f2e973399e95598369a648d5057f048544e611d00d7b3678df6edfd5530
-
Filesize
22KB
MD5953a69f789c0f1f43ab87cbbb78d2613
SHA114a56a9ea8b2c9f9fa8cc64cdfa438b6e739181c
SHA25688e2a75fc6d3f46ad4c48b5e23ba3229facdf36a71bc15e70f0b89161dad4ebb
SHA5123ac5368f0c0917fe1ef0e4efa1aef46f986d4f1ba41231f95f0ebc7580671bc45ebde5ac0ec9c1105772d975c9df46696510dd65f6f50c7b71cbf9f90690f3a1
-
Filesize
42KB
MD5164be23d7264175ad016a13a0bcaf957
SHA1c35ce3510b46a12a5ad3f73edc9ac18eb1e8018c
SHA2564bb1ef87d7b93cb72976e936bca7f607d5dee5517dfa739fcf403a2cd130f6d7
SHA5127dcfeb8007467dec38af535e1240cbd15e951735720e66e5887d7c69404edc2b2737fce054a369726b46b5a2038bc296b136615dc981d56cad7a8d674cb88aba
-
Filesize
19KB
MD560bbffe154f32000fc62a2f69ddf86e5
SHA12bdbb79b9f673cc0cc480f2fe43422bc5a9aeeb1
SHA2564b0b29693eb602f23ada1e0ab452e07d16a3e137871810cca47afd9f9ccad62b
SHA5125d6a6270edfca675f6eae1a85d33efaab262e2be7dbbf4e0cf5bb72aff7c6ed71307bb6ef64a944e127b17d12d7f830ed97a994862a5591cd7cd57046853294c
-
Filesize
62KB
MD5be87ba7e57b063801210196bd07e078b
SHA10384f8cff41132e206882fde73a6d530e4345b6b
SHA2561c57b06c205d185ac807bb12d1962caf6c29bf331b852543bf2a6a80b2c341c8
SHA51242dcebe61edc9fe52ee8c863ce36e00132ab2f3e85a48f98440055996e0446d16d4034b68c2f60f3f7ec242bd455354f406c8e26f0e1ee380a0df79163f0f7dd
-
Filesize
56KB
MD5e6e260f516e4924afb6dccd078c49237
SHA1dfd227b0ea4c445329dbf2adbb224bb0bd1fa0d1
SHA256a6d74ddec36b586a5ebb0fa884635feb512e5b3a3a73dfceb930a2a6be4a20d5
SHA512193d9ce12564c1821542fc041f4f862819a8a3757e0903e5419889071a57c43a9e7a3e7f8c718aefcd0c45d60565cb3aa9d97bb6bc3ac8512e99cb20b0091f5c
-
Filesize
28KB
MD5314fd6de476c090fb3a460db973c13ae
SHA173bac1af55a9e3a8c4bddcb6f47dd33fba2883b1
SHA256470a893939ed6bfd9e81dfb23aae63d75bd5b46b0874bc3b887a4d73745230dc
SHA512ae7b2d51f39722e16a704008bc36d3bab206998bfb504da25ff70e228eddcf94f2a47e183ef8a60d46ef143aad648f83a49c8b0c377c7692dc6a9a4b1e93f784
-
Filesize
104KB
MD59613249e347fb8c6080d52265ab84391
SHA15a505c09ee94af6e709ac4d7e67c66f1149f9b6d
SHA2568d040aac44597212f97f4a2967e5f6659f4678d01c85bee4762e575661f82d05
SHA5128cb9f3416c0703e31595b4f1b175110299b198d83be44671404cff458caeeeb749a3d66728f038a0b584111b8e14bc354b7db2e8ff6ec405bcc2ab391a73b10c
-
Filesize
77KB
MD59ec41a95a527b31ebc55f9bf8d113509
SHA1fc92a7c1bf7aa3fc2a1b88d68b1a9841d4a5ecc1
SHA2564089a5d5027d9cbeb66ad4ff2e1c29580424c2fe28b585907393cc8ef06e86b2
SHA51295ebaa6222bd1586ea353793b4403fbd68baeec8a532404a3c644828576c939cf0468de19d75d8baa7f01a5fee2baa4280dddea332347f1f8cd00731f4b7133f
-
Filesize
85KB
MD5008d0ae10f41631bb124d78799baf5bb
SHA1cd5956db2574b3e718d8e87f3e4af79e2a3b5e0b
SHA256a0aee1664677fce87357ff299c236f12803be313c1838a312d779ccf1ce0e590
SHA512e4c1c5a8d88b6e0caa60b3c6ce02c05b0b2653c478a788d9d6c330d34439a5f91acecd67dc6baa4f40cf8f4cf21a684a13162562df8e2406cd06ac3145c6216e
-
Filesize
103KB
MD5e4945413184d65f94f64c59e9e43f686
SHA151bd126ccbd5e693c1441ffef1b3b51f6e46fe93
SHA2564eb24dc9c5191b3973b26d0677b18e0181a7b64507dc3ea80f4b960d4e3bdbaf
SHA5123bfadc9543769c21312a8e4542faf97cb41b7d1b2c6b5c8380d19adadb8a2c52d22a206479549ca4c929c02dfa08d6be6479860c5afb855dfed87ce3bc83b1b6
-
Filesize
18KB
MD5b4470ee179a4eddbb46805af908179b7
SHA1b261ee502f6ea6d00f16f5f504b6c80196791315
SHA2563b07d11331f77d30696cbfb8f32deea6d640836475b0cb552538803acdc20c5f
SHA5120ab09da443ebd063bad886e97c4acac9606ee8e6b3f96fceb19bad0f7f6eb1ab5a7f0985452a159f1f5baf162f24299ee28082092db587f4dfdc9b9f32bb2572
-
Filesize
16KB
MD5376f24bf1b83ee27257beb0235512fc4
SHA1da427c76c2df1072e82ca726d6112d418fb95454
SHA256aac40055a5812234bd6792432ce3cf84bf1004ec81c806374ec1c8947a9eb0b5
SHA5121f55bfc1af830b2c99d20b8adcf5bd9ba8f7c3e0593681567029e87c1778ed4b03284b6ba8e3bf2c71a378522a06d099610d6a37f71d0c244ae66646a473bd74
-
Filesize
54KB
MD5ebefb5a4b7753a36e45d54ab5331a771
SHA1e7b2ed71f9ff7c673e97d1f8b24e068ccd95e7bd
SHA2567a7df6c930705ab43fc7d6ae0d983f00231709f95a9d71e1a5302a4fd91a8cfe
SHA51248ecb72583a7fe1ac1b6206057f7466a3fdde31ee84ac7d6dba8d181947d1f15fbb2de83017a6b1c6b93c96ae35cabf88bb65e464fed32021aa87af41a13c707
-
Filesize
36KB
MD5fbb5185e91ca51ec15d59d9524ed242c
SHA1ed58ff0d711bcf05e4f9d35a000fbc27be9f2aed
SHA256c7605d715d771a53528de2f398c87c0af017fdd67c3944ee909a48ce1cfd2055
SHA5120d8957646da75b8de9ef77b7181f5295608794bc49e3d7331455733ed5096f2a92e3427f2f2b286a48023bd282d310ca162c5eb9d3f6a54ef0de9ba8b8f92f8d
-
Filesize
39KB
MD5ae90c799b3d116e1ca694cde8ad91790
SHA12b63c5008c026344e1a4b6956670c551c5308e32
SHA256a10b1c84adbf445db32b50be41805583948e37844589081fefae071e940aef7a
SHA512c7aaf6050f0751761af89e274fbf17283dafb5061bbffd28e4cbaff49a8e263a062cc4227e6c8f557a2775b64a2791c77f355e01745a9e022dcd0f2f71255956
-
Filesize
63KB
MD51219177d3815725847eb1fa7775a1d5f
SHA18ab97b7e97ef4c58c34d62fd5d4b5bfb30a3df08
SHA2568a76ac6ceea5b702a27bd36f729306fd2ec082d9273e692a822ec69a6b6e890d
SHA5123ff456f93c5ec920d33f4ef8a9b200c117e0f8ec531f107ac08ad88184c57e2c0fc20a9b4244e7cdd86a4cc788a7fcf8710d426914ab5b10ebdbad0ca7e954df
-
Filesize
37KB
MD5bae9ee6f38404ed97011ece8806029bc
SHA1a5d1ec3d13b667e4ff172e4857197c402401aaaf
SHA25692269531a729f71b989072ee93cd2e3a92a58387c1eda7de49ae94d3dbf9624f
SHA512bbf41a7b7314a53659894c6ef5288a0548d88018a09395e54001d6d7a5e896146e10adef1b676754a1453efcf64bff5abbf770450f434b5060cb65d11d9231a1
-
Filesize
21KB
MD50be899fab3070c69b1e576bb685a7086
SHA125d792078d5c89bab25329834d3f559f4c769d07
SHA2560ad796781ce215ed8bc7c87f83726d369103b255017ee33d6ef8e2204b9d7490
SHA512b810f036a709784a7414dd6c34e3e026af995a70d6510580534dec78e12dcaf1cfdc32a9693c964ab1dee08a4bfd099b9bb2f4e588f0ed30cf4dee4452ca018d
-
Filesize
66KB
MD5f03605bb149a9f361da89ef3db06b6f3
SHA1b2e4480b34fe96eca38268027c16c573ad1d5b19
SHA256f6d42a493c1b84f36f4d7d08a7f8d6fab60f0582a6fee521457c3b18720c9641
SHA512767ea419a38dec1e4222061b5cda5130e6149d194b36f023fae172e795fb2733355884813421a4ff44376079515bc5c411476127e83a13b88324a9a0d4bf2e97
-
Filesize
38KB
MD50696550978ea13d31ed1beb375dd8fb8
SHA15f34673d5e1b019ab13de31b27d27cafd760b63b
SHA256afa48264dfe6a552fd98e3d4980a9cf400ac38410d70220486c17a963356e5b9
SHA512a393039cff49792617da6851d98968fc4001c0fe20bf2df4e5c685e04f98fb2f7ea6f562803b0063242096f4d71cf137a08caf23a01b7b13d94b784205c724cd
-
Filesize
28KB
MD5b7d67666791a53606efdddbef1f1f9fe
SHA1f8ffb91fa4e1dd9f77fb6ee84815e36f08d3b2af
SHA2566088fdcafc23144745b43968c6fbeb339fd8b0d0be20bbdacf690ae4147ee0ef
SHA512667bf2c5b9d57beefd99a5077bc75b35413abedae5ac440f3ac837ddf95e08a56133f9a2ce1c41ddad748e05fe881bf629259c33ac8465a2e2b2c8bb7a261e65
-
Filesize
54KB
MD5e0b6332f49714161447ee4e96fd0eef8
SHA1ca162a539c36e4f2af86dfa431618cd7c979d7ad
SHA25693b289bc1767fd9fb88b93dcc1023989d406c5fb79be49f351fbfc324e875e12
SHA512547f0c90016e81c8d22672c91bf8a03587028b1d937e8fcf92398e1d0c06782a7e19b976f0ba8ff766df7ef242374d9ca7721040168bf9b4e59d316d347adc96
-
Filesize
71KB
MD5bf948b22881b1663b11d7afd24c2545b
SHA1ef88ea05816e34f3dd1369d2e173f5e1db054278
SHA2563f81c53c9c052b68f0fbea948153dd35d777c7073c396744a3722e5fe53226e2
SHA51286e4512dbd64d59c3f2419c8d3fe787f02ba5aef57e6539eda7cce0ee6871a7ce6fedc6ec31202efcb20dff3212f95902e115c7b3aff44608163f273772e5234
-
Filesize
18KB
MD54ae1a5ccd387503d2c9e7855172b89f4
SHA117f4a353132224a4640f0a13dd2e4781fd7e7920
SHA2560e65471c761bd50aea9e6b54ddee55c3d8c20b46c0153662cfc56f9441c4ca2d
SHA5122421021323ad35ba34a5e56ebf8f0cc0b0378da6a04cd5d1a230a8f52ca6fc4507087c1d724b44099c41f7ea9d7b7bab9bc2bd4909e8877b1e6eacf9dcfaa5c5
-
Filesize
78KB
MD5829dca755fabf0e153d9f9260901815f
SHA1e68320a61506551e7ddf946746c34e761e2e3faf
SHA256e65823c0201aa28460a9926f4062545d5ff14eb7987696096b3f472edcb263dc
SHA5127472deab3b633fbfbf032babe6520f1081b7c51fed0701874e3fdd37cf19440da9dc594258e9c493dd2f05ad58641d606969974bfabc0d1f3f08877ccb3d20b6
-
Filesize
116KB
MD5a93d15bb25db40af1c1064a1a1b9ef49
SHA1b4eda56b0f22082252b92376d0003280caa5fad4
SHA256d3448f7b8e4f90e35b8f7c4a3b585b096f262aad0f5098ac4edfb73f61c14260
SHA512f984573ba2298a13745c2d3d9c098459329c3a67683c6d0bee1b3e77259202a43f95f3d31f472f7bca2365ba9b8d1431d41a9dd9f13b1ac3f5539d2c0c5317ab
-
Filesize
22KB
MD581b5ce9be4006be6dae38e785b511ecc
SHA194e042d5a241f1fcc7477c73331b9fda04ea98d3
SHA25640829b8e2dfb4be7948d5280b00953733abd1a8e545d528883354bb6b11e1d8e
SHA512e6859ca84d44d48b75c2e1abb73806a3f58fc2b852703f1a1cdbf681ba40c3d4e83870bb43c371f83204b6fe8a4d80e693cbf3f83c87b61760ba6ffabee2627b
-
Filesize
34KB
MD5fd4e69761fac6ba888aeb1cc6118c50f
SHA1cfe3a006ff4bf410e61208e2b8f423a4afc40498
SHA2568c0886979b62d205ab8bfc4bd95498d003ef9a2d10969f79ddae23727c60dd82
SHA5123b997c287125de674617cb74d90d681c9b74333174b56c379c3e314ba0d1de92d0d176d12802656eb445c62d5a15bab5c2c3fd54d68800fc138772121332f204
-
Filesize
110KB
MD56fc5ac37b2f15c2fd15c57c9f8901831
SHA10bb76db03a7c479c1bbc0fe9fb73ae4d80fe0a56
SHA2561f288a6e8688f0eca9c627fdcf478cca76aa9276762ba2ed928a25d08b152916
SHA51211b1092e91029e72599b746eea5cfce3df87c10750fcb61dbe4c658c04f83f20cacfd4ecd4e4691041ea9f875d5c5415fdf2dc30b4bdac722bb13b044fe93f17
-
Filesize
18KB
MD56ed920e0f3a6447c3e5d86c552438db3
SHA14bd9cd1b552e1879e596c57e47b3813bd95dcafc
SHA256e513c909d83dcbbbb9ba1b54f1cc8e6d6044ed212d04583d1629afef46eacad6
SHA512ccd98e921f910e736fa59855a4aae6b170fed4fe359fc3790f92608b5f0ec03f2e92243fad55f51c8cb301003a4115d37c1ec4b7652e4109258b156744f3b1cb
-
Filesize
16KB
MD59bfc767ca4314006689ce473f56957c0
SHA157c0ffd00434d5a7d7de89dd76ab91206ed08800
SHA2562d580fcb389878f1de5a031c85f743a9134201213e75b06f8e4ba59186b68a6f
SHA512bc5b3fde3e9adb97cf1ca007382bf82f4bc71aba617a9a74470e380e515378d8006924d35704cd445afeb447e5316469181f5ed925c754e2b93d015a8b328c49
-
Filesize
126KB
MD5ffa065921211d2eb9ad6f5f973ec5b55
SHA11e1ee43801a43cdeb4896c2a590741e19d0bdeb8
SHA25695505c68116154b7a13efe4f80e5f26d44181fca34065124fd7700426a23e9b9
SHA5123c80cb34cd2837c46df90482dca7385c0423ecec756418d64aa70a8122b4d40c59582917dd88ad8edff9340ba9d94c9e7a63be704ae42a56978307a181805ad7
-
Filesize
36KB
MD562fd1704573f0a1ae4c7db83f9f5b470
SHA109d03a37492cfd0580ed3b819386bbc4ff64d960
SHA2563b14ad4d4df0e681fd5aba556473e39e52b31ab98f51dc3db4937bb641a6d667
SHA512c8108393f8bb91c018ee06ad51d746a33e24ad9041d5cd84792e4c59fb55639b8042ed5c1a424b47263652182ceafe516d0b6adab147e33bbf261d6aee1d3f84
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
1KB
MD55d9393ff0e1fcb6182ed607497cd7e32
SHA17f8c55b6039e1695f0a1877ed053d1ff19b232e1
SHA2563ff11329ff456b0d4a47405ce1021d576fd33a9f128800d5ef4ece22d53ac326
SHA512ab40678fe545540a92164e7441be38fe7caf7218a82dc18b2545a2d4390108ef9633b27b821be4668ae4714bb5900a3df5160c0b0461d20cf554e114cb0bc87d
-
Filesize
4KB
MD52d5981121ec5c1382363fd71df9d888f
SHA1169d0735460697bc5abc0fb7eb87025b008fb881
SHA2561e511a4a168eb0729f48e16137b79b5f0c6b26deee18fac2098f5baf95a0d6d9
SHA5125d465c6f2ecece6e2cee9e60b8617e113922f6e16eb5d3f60abacf97cce219b0dd121c1d72788c4c995658df0fa889fbf151db894de37b91f0722b8114b22a06
-
Filesize
2KB
MD516b61cdbb39772c27ff9b9e8c8aab83a
SHA145e66580fe702a91652dc650fd2f231d00c15156
SHA2569d665d079bc5c43c854ba00ff1dcd28d98d14b573584b7ef165230d590a6801a
SHA512e3a23ec4f7cddc9852470c27aecc65720ad772f6b3bfb98d789c2440e8cbcdf903449dc612f824382814040a67df371830c4909f510df333672866b0bc2617a2
-
Filesize
14KB
MD530b3d12df335a139112387050816e487
SHA1e2f4a16fff590a9cce2f6bce75449bfcc6f30508
SHA2563f4c03ae88acfbf9ccf87b00437bb72c8ad6a72f55c3e35b8285b65577d03424
SHA512cb45bbad62270db5b74c3f80213eb3258d9297ede8c2972cf516ec6d150f0300168a19cecb44966a78729f35899f6b3f13a75bcbc5b5f36f71e6aab004adaa7f
-
Filesize
2KB
MD515248a4591674ed2ff9ff90d5e82ea4e
SHA1a408aa9373af5132d8a037c76c193b9097bfe638
SHA256e44737f49e6d5e7432a136a2cffd0d984a4022700716e4521d3bb9c37a5906ef
SHA512907f072089a11e50b1bec13086d2990d2d505f5ef96bcbbf797bac6e937006059dc7797e07d999b553000a51f6c840ac29d46f41a0124d87c125a6abfacaebdf
-
Filesize
404KB
MD5baf08230181cb865db34e17a329d15cc
SHA1ea391a0916e33c95f70dd7ccd8d4175c5030798a
SHA256641c6adf250ba5bd8d325c946d08ed5e06234b002757a048c4678f7d3e86bcba
SHA512eabf9a55ecfb5cab1647a9ec6f710f61c7067205b38e096ab4640a232e2d33811eeb4869d30e090fb070164c0091f33d2290549e678894b33b993e32337fa022
-
Filesize
433KB
MD5a71ed346cc01fe1edc5b693166d100ac
SHA1d9a22d95c939e0dc49082a734838d83015d1d4e9
SHA25629751b42549d4574097e380b448012d8d817c117dcd4586d8cbcdce40ef17c87
SHA512a92eab60d6a86bdd420453391d58851d6b185de3fcb288a8e7e5e4b1908ad7eb78f55b0123a1f2fb6deb8bbc488887464991fc0e992dfa7d80f54a0312cafb10
-
Filesize
289KB
MD5f860a5eb157189819c3ca8d5351e4d49
SHA1cf528dc271948f06f7df1fce0ac8556f216f01b3
SHA2568b1221bf935683e3b5a625697bbc2127bdc19b3c0c4728e38755900fe0db7810
SHA5124ad89e589deb71ec8ef9f82ef8623e65226b946851a6d96a0714563b6af78c9787c9eda7aaba731e43c52283cc6f79929a11b605a21a233e5bcfab9b8c28c431
-
Filesize
3KB
MD5a1d769317914539bc25d1e00cb43406a
SHA1285b6a6cf9dd2b93898d8a86543a3d33ea213fb8
SHA256b0681a63e91c52e1e5cf7c987263a2b887e52f149826590191871196e90ee29a
SHA5127172b150fb934da20dabbbd80e46752a7b803623eed9eaf56cfccba16d32002c019e6df01e3a7c18b2b6fca005e676b1851cbe4e5b39174a54b7ff72eee6e462
-
Filesize
16KB
MD58f38e4485a83d27776334ebfa9b6c1f3
SHA13942827b5ecc61de655b15f1abb01fe81abb2d7a
SHA2565ba6731b513d5179626de4299772d9cdd89a217f758ec6f0ba87c46271fac2c9
SHA512ab7d90a5d55843fc327df56d8dc386a922d4ae084ef5a34ab25b09ac0ddd66d184d021834473c5cb692fda9856b81e4479d945f2e806d1530718ca721168e7ab
-
Filesize
1KB
MD57e12a2c1544139e6188574cf7ce67f6c
SHA16def282b7b4297ccc9ef9a5dfcc4e68200632620
SHA2561d4cd58a9cd2945432ad50881aaa5c8a07593a428b45846d877d1b9ad9429bf7
SHA5129b415b490689cdcb9fd534ef489b3670173044b8ad5b46987e66ece4f8ca9eca8c6f6d8d51046ed9129ac039ce90b842c3f9b4f66c29c591bdd0a9eae2c88973
-
Filesize
3KB
MD53446f779b89a17d7a3fb87e0678c46ed
SHA1e7e911137d1ce64f4267910f1b8aebd4cff7cef7
SHA256cfc8e44c07efebdbb8191f7f468dabff7d2373fc65aec076cfee49e1207e596a
SHA5120ed49b13db4f1b94acad65d48b3a060e2079e7b5f85f552295c7c5967efc835b5eddfb67fe8602a8df62da55d97b8373ba32a15f94d97e9232e74c568b154498
-
Filesize
1KB
MD570add45707241e67d5894758cc6fb363
SHA19c1f89094d8e5d3a2df7634b612c4fd46fcbb16b
SHA256926932a54ba2bea6544fa9a209ee7f94970e3a2594d0c4dcdc8604aef1f1ac12
SHA512fc8ef6f60f7a9eac2f149c2ccb57e28a83e30b11fcb5aff36a0eeb114242cdfc4eb6e2c2333fc1fdffd6bb197ce12dfba343c2085244f02102f44f23b20bb6d8
-
Filesize
5KB
MD544ef861dfaa2847270f6c6f6774f36f0
SHA1aabe0610405e59c2037725db2a3e37efffc8723c
SHA2569aa652339848f192ce062e9122aed8f5a5fabae5216d101b8b01eed2d23e60b0
SHA5121cc3b8778ab3e5a12ef8494e89f1266f9760b4b084628fdaa48c945242be5af0ed8fd386a3d7b5e102f81ab2591f160bb8478ff9927b128ab0bddc3bd096bcdd
-
Filesize
110KB
MD55171484ef8127a09bd2a06557b944c6f
SHA10feabd96401fa4be847a78fa5e33193a82c5479f
SHA25646d33d2f06e91f8f54109c4d62047c2cc28d45b8f9c44c259b4c1b8d09265518
SHA5127d6fc0774e62b444ba2dbacff9f703dfee3f722fc1dcc7904299ef048e33d91c406ea913315c6fbda337894e4d929844d16c668617e6d9c7311669792175c0ab
-
Filesize
259B
MD59cf7c5609bc27e243c8b2a6333e2cbea
SHA116107bc66c3eea050971ece3647b8e8fb3a856d4
SHA2563ea94c7b5e0b1b6ee573c748bd47ea8ae369acb93479367d3efda7adb4599c80
SHA512b1f5f58a41598d41c330dbda8efedd1fe523e953b54fbc05259c637dd9b6c055a2904c13a5c721ffab08374b11987e895f9970aaf45cc23bcd87069e3d012023
-
Filesize
1KB
MD5fe137fd30da42522e120cab803b4f074
SHA1b362f363f1db03953432081b41ff10b47803a47f
SHA2567b688cc1eb3c275e317d16a23b2e009c00b61b7cfaae28345c0a4b96e1d86264
SHA5122aa018bfc7be8633c7f9afde1c7fb2d8edc8a6da5716d133bc4bbd40b1f0202848432f6d7e579d50b027048e0d62c0fabfc3437a86153f4b1bed1d138f52d172
-
Filesize
262B
MD52bb92ba6c014eead1286551f6c654bb6
SHA1d6e7e24b5ef59ee8dd832b6089b483a9c2a3b4e8
SHA25612daf70c27953e533d431715a83f824d0def6cba6b18a018c6e2cdf0660e8b58
SHA51216609274b0f35e6c9b262b0a38b0708cfbc5c2743918a279f278e9dddf9dc4b7f09643a012b15deb68dc17d245862097bb1f76cfdeddcb3ff19b4ab29be34329
-
Filesize
1KB
MD50a65d42d6e9bb5fe86cf83c7cc9a74fe
SHA1d68acc8c888209274c8e02cf81cad39144deae54
SHA256f809b4265494b93e85a26cd4a1dabcdb0aad8e5890df48096c8f64c4019c13e7
SHA512827407d2f958992f7b08a2c5799c9e1bf742bfd61132ffe10cecfff1bda3695debdc1ad3761fb2287683c82fe02452ed34f91b566f27c3cf9e6f5ec157887c9a
-
Filesize
2KB
MD5e2cf5fb12d8d3dbb72ac07b475c24fb6
SHA1e7e5798b1b294ec18e0521793e768dfd5c6ec5e2
SHA2560942a8a240481367aac22cdb9d761ec6ee8f995e7f7cb06596ab6d2ad7e90f5f
SHA512ca0adbffe1fdfbca7c71faa10b148cb5a50592acb050b5d92a37ec1243dbf6c43739f3da2a8629fbda2239ad2de194ae66ef31850d96dc2b4afa3729dbf548b2
-
Filesize
6KB
MD5115cd9482a2fa3191211591fd15fdc16
SHA13547016f544ae18836790814d070ec9d951d789b
SHA256f9fffd35180fc9d377d63123761378de0d5b4ab082f7e5011f5b481e6e17e3f6
SHA512017142b6ab750b9a3fd24049ae20611fc31b63d3f21bd7f25bf600da329ee0f4fa5eb7d64b742a89c488bd5e7a993640423fa66012fd51051c391fd1b1dca709
-
Filesize
2KB
MD5149f67ba0648adcb14fa7ef0c6d02c29
SHA106062dd3a7138507fa352779145f2e24c3118d0d
SHA2562b93be819da7c1d181ea4d584e9cd2fc48dc86e840849c268852cc7800416780
SHA512781620b9d33c8fc33463caeef529c2a2cfa64a300e0f9aabb7356da587038c32235bac5d4b8fae3d2f425dff07bc08022cd5c71e7dfa0a1b50add42f89e5336b
-
Filesize
5KB
MD5d7dfb5500277163237efbe2a1489e875
SHA172f6c3388fafb22d401a0d0f3932a130ab2404d5
SHA256ec72f5f907ea7eaf363656c45e2e654921da3fb99cc84e049be4f03b1cdc5e23
SHA512dccbe6915556146d696e4894032f18be4159f43f2a66e3dcac151d1baa00fa65d8a67fb90da71077bbf9674612b665586eecbb9ce7f9b01fdb858555e960ab1f
-
Filesize
1KB
MD5d6b507c7756c4a0e82321a5b8e06ebeb
SHA1b43b058e6c466ba3a799dc10b667a3e89fe71292
SHA25620c9dbb8658f19e4fdb9fb958f36dc58cb314f224688de6474c770fb1d8a1211
SHA512476b04e21af81bc5106eba3a6e99c2e013c2faecaa99f00a2687b14bb5adec0a7e2b6a6b2c02d543ddc2a13793fdf830bcee63ef108e7cff1becc9b124e2efe0
-
Filesize
20KB
MD50f86617f9b07b5995140b46ad39234e8
SHA1ee6881937eade8697a0689fca5a1dc29f73c1cbe
SHA25615e3f86463c78d00816a001e6553e66d1988ea4c31c6c7c6d6b2730e74c43c96
SHA512696baca6981be6fe6ab98e685d6a0660b9ae2fa8c9088a42cff5026916438454c549198cedcd41a48c9f005921ac9e5ea4023adcf16716a57f652665bfae291c
-
Filesize
1KB
MD5e928246126cf48b5deb8c1a410a9bfdf
SHA16f69a9034f0540b527407a621fc0012fe14b3b60
SHA25659d0d2a7ac6999f20dc6b9fb65509ea774d3679d348cb1e7b3a52a616e037c59
SHA512e21a9a823479ec4043685d2e6e565e842d2f83cfc6a6ab9d62e18fd2650e284165be964f3b72b245045895b891de74c5a4af83f93d5014d4ecb4dfa7a7610743
-
Filesize
9KB
MD5597c3f63c6387302d8db74a7ad10664a
SHA1a4317109bee527c223845252328822dd554a30d3
SHA256638a4c35c987f1cf44a80227cdf031fe10c9e236e11b8fd5c110257e5d7db807
SHA51236c0bf639db3b771623388ff9feba35b56e84c3dc204e2e4e060497717ac485cb5891fd9f76ee24d4fba533a70d83b6c33a632c57dbab702cb765212b86fe571
-
Filesize
26KB
MD52a34d9eb59815fff07bad3b7f5ea5ffe
SHA11ecb6e703990c723cb155d000766958ff2f64cd4
SHA256febaae27646a51d94891c0eddddf7cb56119bfbe167d9c25b102ac1408fcacbb
SHA512d921ccea008b10f4e26ba178ec60756da23afde1b1ef4d0ac26c861f3199d9b956d938d5db0c50b51ac771953a29e2f811945dc0e264bc6a7560ca2672758c6f
-
Filesize
6KB
MD53b1c0c72881ea30415fe5c9915b2250c
SHA18d9671594efcce81e335be0d91973525e7255f15
SHA25658045d0a29bb686a73f54c03ed339f1f8afa881e3f819b5d7521ea6a61049d54
SHA512bee3995abfe6c14b95f321658be111e1cfb800b9947c41b4d55ba3e041fcf7f5230741c8d01fb814950dd7235bd8bfcc3dff4a65d6984a471786b7f23a560db7
-
Filesize
1KB
MD5c9f5088d7f28071011365f41d1062eee
SHA17a17a0d889c390d1b039aad21240ea393186240b
SHA256ab3b2ad554cec341d31e6332dc913c0b39acf72790ee7f2e19079a5212dd0308
SHA512e1844a38287620938fa948309271ebb648c12fefbbb2fe6efb59a3cfc605720d6e1680409130f88b2b88c4e83f5e29309de59fd166c3d1ecc9af2f860fac8758
-
Filesize
1KB
MD56de4017a772a138f7e58c9ad624c793e
SHA1e9b9f732d1e75e8517ad7d1d35a74c92603db3d3
SHA256110baee9faf08ad77b9ad3faf573a8e83c2ac2d82b0ffc0401b97f81800551e9
SHA5128334ebbe1f1eb3164f9a007d32f9d5d8eb62a1be6f27b7a1743a8082d5e33f329918b8334871bed0b312ad4c40c28da34e6ba7eadd1f961394ec690344bda066
-
Filesize
7KB
MD56c39461a7604452ca254c12c0c4c67f9
SHA19a71a4188bc49458cfc87d91f30496882fe8f71a
SHA256906e91846a412fe8031c5fa8218358f535b1f2871ed09d7babcd27e1923c8281
SHA5124d14a42997eeba57d8090417ad2bc835bd3e03732b746050d86a85298655d88ba330c5e46321f52b75676639c3b2058f2217667947fe24a33a2d163994ae9402
-
Filesize
1KB
MD5d92bb231eada2e533eb62f91fbf0dc8b
SHA13a16f1953d7f3ab73c31f0645725d0e1e38ae9c5
SHA256f70b1fd200100af1de2b27503a53105a0d4ac0742a54c635181a513cc51c0194
SHA512718b6cef9f15be1555420d7f5d73a2eac2d2b7c778a9314a111f8462e7f07449f765299b74971891680332d592466e63b15d1fa2982b1d2c919e06b29f0ce666
-
Filesize
262B
MD5f72794d20e41a4e9794d5f0fa18ce888
SHA1a0725bb43baeb475f1ec1050125e43e38b98fc6e
SHA256baf78c9951e0ef8343373f5cab76128e7e192f95d5a4e60727c9e557431c1bbb
SHA512f283af64e0da0af0f527da0f7261f8b4302667956243cb427bf2cb75be1fb45e8411ef12a18fad8ef24433287d614564ff6694c022755cba5d5f924124b16824
-
Filesize
47KB
MD52c0e35873ae8b5a18b0f25da37a07859
SHA16dea8b3c1392f80e10e5c1e4821a55bd77a7d917
SHA256769acf9555c1fe16578e4d918c2e56b98bddbb00b822f3eafc3fc84bf973dae4
SHA51202802280601f0493a267f38fc85b92d81ede1b146f2d578d76b271396216a5d6827ab743459a92bef8be1f8d8416f9b37a1106b0c6e825b63d7eb513e1b2ecb7
-
Filesize
9KB
MD55926e52be59275eb4bc0e2bec5567667
SHA14dc5b8cb2fc8fc8b3ed9a5f4058a67be83337807
SHA2561bd746b05abc894fc951c281c2158a520e4eb4d969e4c228161fcad05a04157b
SHA5124a168839412d8a4711b40253b4f77f6e4c5ef141e62650de06b006f26d93c2c409cb98b98af4f704c431eb600c20b71eeb8f0648045fdb55e3bc62d23a20b9ee
-
Filesize
6KB
MD5a4a93594ef28c4d3d70d48b016319451
SHA1276de1ac7957da2013dd29d2bc79e47b5a9dbaf3
SHA2564e62b6b394d3f5e26b13157dc0f61cd4bc32c693a2afb569d81fa120956671b2
SHA51287d78bae02b0e985b772ece33c32356196d421befd299f6c8e3c074e63aa32a3d304bb08f13326528b106f5a5042931de159b09fbed8ce77c89daebfa925d3d1
-
Filesize
2KB
MD5e7ca6a363ede2a588750dffbd8515493
SHA1837ba88e24f3bda5a654364905303c5bce20206d
SHA2567c1b3b55c005d6eb44e8767bcc78fc986c05dac2316c3e2719dcf866a705ae28
SHA512745c0bc553ef54e3a87efee950ae1b2828665a28a3f523bacff135d0d8d766406d6593f97038019c12c56ef70c689aeef38813f274f86701b49f0afd115cb96c
-
Filesize
2KB
MD549c558620992022a6246d3f9932c6652
SHA17b36a914ad3136714b1a0a938d711c34ed869075
SHA256911e42cbb3db4531d526dd13f0614f9057b57143b0cf0740fdd39485ac1a93dc
SHA512edb0caeaa52e0759bc6092c489c98e647fcfeedd7467bafa592b792be2fe9aafd941bdc8595ca9bde98e7e11fc9aeca0849d21ffabadbd2869b36e956319f440
-
Filesize
1KB
MD5133d5360e3c71ac3cb893b144a7869f4
SHA10579e2bb08dc0d328b8b43533215ddd099c31426
SHA256ea9e5373cd31b937bd1491e5664805a506b93f1f67beeee9cb971c0afa9888e5
SHA512d43c46ec89befdfbd39bf8f59fdd03086be140aab3aba94c4b097b4ac3481d896b56f87e8ab08c187603fc0bfa7b2548b1cb7e04aa4d9793ac2320a293d3f856
-
Filesize
2KB
MD526393865d0fc8eeba607d2220044329e
SHA1bc225f59c8fdd2dd893aa1f5f16707c74ea38e5a
SHA2562b778fb691aad187cf4bf9b625c953f846c0437743dbcdbdf5389069c4d71141
SHA51207627eaa325e3a7e53176611622c056fc5b0dd38959b02daa729d44baad84fb87d82242f07c5c85976b5b021e8029a2343ceee9b35f2e3fb1b4ebbf55f7758fb
-
Filesize
2KB
MD5163767f9f7f2e9a4af9efb5000c11683
SHA1fee96ac7182631fccc18dd9766443a9ebaf67b5b
SHA25603dff0afb656553fda1a34a8b9e96cb2d013c73a557bb19b65edc291af9ca7eb
SHA51242c3c50fb4be8e281e4fc706dbaaa4eed40632f4c05c41cd039a9e5d3748b6d19551b2665b715eeef17c20397304f777d65be21a1b2796df615e947d38e8fce9
-
Filesize
7KB
MD5ea5bde7c17a4be1de62daa3e45883343
SHA198b7354e3e544c24ce2bc38228b18aabeaa2163d
SHA256c681a12ea898d294a7f0ae505ad35570d326f52695fa91f7d87417c08e038abd
SHA5128e0fe7a0f40f89ff8100fc2804184fdb3f6c5731189d208392ade09c0d8b48894340bbe5eb218fd104f6c370580b9824c33ecfcc0310ca88181cd9ee317f8090
-
Filesize
5KB
MD56d547aff2188cc826c8646b3738ac0aa
SHA1a324ecc06515eb23cacdcbd0ea4fcf5d8351335f
SHA256f4b1a32c686a385a17125a6859b291dd9a98146313da5a26e12cca04695dcaf2
SHA512bc188e2b1eeb76713e76c2164806a198ac15105b5572bc1e30a288538727c9b44b935af3b9e9b2bc3391e03add352c948a62d38c79b7283401a49f84e99fa607
-
Filesize
28KB
MD5b26716f33ee9e71ddb3f5fc0f9cf07be
SHA1563d545a21b99505d7fde9ed17c965179f8f45cd
SHA2568ae8db25d32734d7807dddf89f6066fa2f1211e1c0aeb234e3feeb0bbf2fe2a9
SHA512e7eb98f1d890c538477aa0745237b14f13e948a4bddcbdec650d473a41ed76df830fc114ca30d222eef309ba712ddbed0e87f5b69ee2805b803a708e49fd4bda
-
Filesize
1KB
MD5f8444834172fa84fc03aabc8c2c2e117
SHA1db2361937dbb3fca48cc647a49a75740c3e13c87
SHA2567f226a79e176724c466d512e5e1db33430de9d1d059cda41fb1d682b204354a3
SHA512b2995750ac3ea027b363baac845f7304d8eebd072aea2e6fefb07e61c2ae718d6a16bbdab2a92e55a7c3e22244fb172283e6fc978c8619bf7f8f69f9e711380f
-
Filesize
28KB
MD5ff46314cd631a1f933ee8868931d29a1
SHA1f6db2110e4dfbb33ff3e63674f229e0bc6b34bcb
SHA2566fa9c1393b7d1d689b1a5850e6bc838c30388554f40913c860be2f1d321cabe4
SHA512d3ce5aeaec23fef05a6252e03ff612d1d3a612bf3c3a3cb02875ff53082a54bbcec11292dd8a25589a507b7df987d76d2969bfc2d370c9cd84a3379ae4147da0
-
Filesize
2KB
MD535f14294498fc00b5ed4c7c27ee0e636
SHA1312c07cbf6b436de8273c9a97d856b834fed3496
SHA256e3cc2fbd2b7af3fd04793306152de63bc83117d877ee09668390f08b2b3bcdbc
SHA5126c3bea9d3b86af23d24cf7c0615faf0206ef0500a1d18f87f4047c23e7dc1c80e91171ad1c3eaae543e57d60ed6f85cdcd7055f275fcf055a85bb66b28a4334e
-
Filesize
262B
MD56c9421c79cb7b15a5c4833bbb6f009e9
SHA1e6444319c3710968eb54204a91546891a369dd67
SHA2566c5d85bc587b90b65495535b3ce9ce4d868aa2e799ae20ef2c266ce5bd5bcde4
SHA512fee9fabd4f83fa2e0a45e6c5db656017231d41dca40c2575efd6f651d3413f4fb41d575d31f0e2f5f0751ca0f2190715c23b630e37f658558f1f352dc2a3b026
-
Filesize
175KB
MD511886e5f8b41789f94b87e488511f816
SHA145a30d31635f5cf069464b213b3e9fe88f36182a
SHA25647febc3d879dc00db3fc4f9dd41f6ddbc549bc1634991c6b7bc6d65c27d6f913
SHA51289ff7f94279bc9359914ab42ef8fe3050793fd73a8d0b92befeea13ade47af4804ac91db9e5ec579572c4d765a1d21590ff49ef9b65c15e2350a1a2176685e06
-
Filesize
262B
MD56bc3ce28eb18423de4f4244331b9d37e
SHA1a7cfb877326a55db32a5bb4ce630c61841949156
SHA256e559de149e638fdcd6ae3680a26b56a57230d0bc2a0e07086901d428272d560a
SHA512f0674ccf453c7604440a8d0d0e8c0bce46046bd8b71d31666c2275794b5248a5071d4f2eabe5c7c929c99df83033757cdd74920644be8d449daa0f855e2a3e8c
-
Filesize
3KB
MD5c1f60df682901aff4b3b85c55bd899d4
SHA183e1a6271ecd95a6d64e0aa529c5cd6ff1e9e9bc
SHA2565a4923e1f63983ccfbf46d687c9ad019d354be253c1bcbc832267e9fa8b10beb
SHA5122e992973739db293917e5a8f91db867019c23cfb3383ef0ec938ec12b33bd41797ea58346a3e314edbb5144e4fbecba43286b5d2309ead73ffc3198aa4ad13a3
-
Filesize
2KB
MD5ea7522a27dcbee81f905f5347df36464
SHA17c5a5a1d8149a8efb1f7b716f656fdcdf79562e9
SHA2564dca79c70260ca0c8dc5f60845f4f28f266f5b1a3a1025f4bb2402800e96cb2e
SHA5129f29cdaf0a82a3a5a168fd38ebae462c0c0bf8fc07d361238975d019efd663e3d9858985252ab75f0a79d63585b04949cddfc1671017e97b4b4d00670757738c
-
Filesize
262B
MD52f480613d6358a8f27b61e756b726e41
SHA1df18ceccd0d43a429c297364db160ea259be3fad
SHA256f5d08f5557760c591494b5b23c9da0c919ea5a8cb8c5777cbbbfb9b4e792df14
SHA512d6fbc8d3e53d8d201dfc9805340ea35f3d29f8f605cf019e771f3311de6f4e62e61f2900c72fce5c29aabfc728e97979d11226595af110642189281de6315ddc
-
Filesize
2KB
MD5ef04a668bf38535829e3e4c93c786a7f
SHA1156e17c75fa50103d59bef570837ddfa35ecb07f
SHA2560be1918a279aa533c65ce95482aad1632ca8171d6dab5f93e9b747138fe08449
SHA512d9493084e7f35a6679aa2cd6d9009beda6bf90b80551dc366cf6e5bf37b631ec520f407c3911c91c88720b4fa2aec21620d617cb9975af71c96d96358b2d4cf3
-
Filesize
3KB
MD51ed792b4d6d4438c4a091d6a9ed6a343
SHA1bb6db060b2ab3de1309a24563473b5a9f4479678
SHA2562c0b427e2823e92b5481bdc37e068bb389c0b382a1994ed60b2539a5fad96ab4
SHA512d4eb5b5e8f513ed9a67bbd7b59c00918c23a202a9224b89b302148c730e9c96e7be91804738bb397602c7eaf076627f1556f98d9f3562533d1ed736fdc34d09b
-
Filesize
7KB
MD5391ba24b6add58eeebfe70e6df82c6f9
SHA1394486f0dfdafe75cb152ce9322d108ede6f7913
SHA2567b9dde37bb89dbd1b542df57071b524901b9e9f47cefa65561e5bf99b71436c3
SHA512cfada2ec95342b027678b4e6f41f6022475c38df62fb64c495c23f9ebfeb2bf798b68e4787fdc5085450d925899c5e0d82e50bfa975efdce3b773cff8396df17
-
Filesize
2KB
MD59ba25cefb9f57ee837a564b63799bc7c
SHA1faf1bdbd8aed27521187562e4add1095d0462d51
SHA256a9728b838743296334d0c2665b82b0e8bf6c1fc3bca629834cdd5e4472971503
SHA5125b5c85f23445e9b749563b0c010c616d653b8594af90c3b7514210d7f0ba4aa69d78e11a2a44d7b5a1f15288da5ecf3c62476d7d7b831a8f375aeaea0d3dbd15
-
Filesize
2KB
MD5a0687e2aeaa07a037f29c31dd9daaab6
SHA1c08c2954d3ed429c96c2ad701256db78fa8715c8
SHA25614b90591160aa2900e80a1b41a4e0dab9ce8df19199c410880300079fdd44f55
SHA512436772e6c8a6c59802b0db51e9cd18f9ca5b236980eb300c9afab53d2b24cc1a2f03547da44fa856cf4554bfd66e7b864ddc52b05610c8d95fd5860a7da9d4e2
-
Filesize
307KB
MD523ec747ba10b77f3536fda8af6e6d2c3
SHA18c5590c55782a419e3006efc88472987ea975482
SHA256f3b804e3cd994e0455770609de6d3e441142a2c4d187011bdf91e3d4bcbfbdb7
SHA512568d07b29119d34d9ddf019c480f8e823e3f6aed7571e9b7b05b3e80ff7a357ac68443884d2e6efc4f954f62a76abd0f0c8023a5430f4474700c199b3906cdd4
-
Filesize
3KB
MD5473dbdf9ebba375b23e5fc93d68d12d1
SHA1549fefb5dae7c8762a04b746ed990f51f1958254
SHA256d5026b543a97dea8a1950d5832e3fa521b9f0ed94024157bdbf94b7a7e54a168
SHA512c7c83d21ea718b1e2fe0dd612f4075de9d7de426a301dd96c201b9cdcfc993b48f947d9ef38281d93a16e8d00483e6905d723e73067548fb1e98e939535d0f8f
-
Filesize
14KB
MD5275064cf006917b7d73e3e5098f58c07
SHA1b2eccee6592e8c62dd9299c4338c97545714927e
SHA2560e608a564000f93f18beb23279702ef84198145df070aec679ba557f72d3cee6
SHA51271fc2814aac66879f0df1e80584c8f2ab382e98f64b670c6bb1c870d754644c6907bba75f1a1a81986b03a36ddc10ab5c6ece8dd1da6a421b42a93eb7f067b58
-
Filesize
2KB
MD56545403da9cca8394e1bb93d8d96b4bc
SHA1f82ac894228e0f801367186c5961b212e14b0cbb
SHA256cd6faefa67171c1dde5391bfd19fcde9d2ee2084bbce529a256ba3b6b7e4a539
SHA5121dda57ce942173f992f682fa00d16023eb41d17950cd21bdfc3ffda1fb34b08221b116da44aa281bed33fbf3ad55d5229c388cfa095769665e878ad23eaf7ba2
-
Filesize
15KB
MD5fedc156958801190069b1477f2c1de1a
SHA1953eecbb3e2975027e606e9b5acf6ae8f355ea60
SHA256e53d31386c274434cc63917e31875a1d4d2eadc3aa9bec92f9d8c7ec0c7e4edd
SHA512a07687e63f64bafa7f55aebe8d8deebf976be87abc8bf1ad1fbb84881faec206a3a13de28e3f1f6a9775737f5f366cbc4e70b0c7bb6a3f6badec20f7ca814242
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize15KB
MD506f842377785d7215c792e6ce682f191
SHA13041cca6beb599c08f5947be1924c389a6eaba51
SHA256ce19ed33fa660b14c37dd66acdcbed25f293036817e27e796447fc914a3dac98
SHA5120f13eb9f1a4e2015c9eb8a34327637296c0ba26d7eeb61c26e673a184baae121ac9862ff450447c647e8fbcb852d9066eb1499a9856b62333b7d4ae89e4fa72e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize14KB
MD50c3b253df537ef89b782053a92e6b2a4
SHA1069f1736e097261c51dfa9467ad2249ddf9378fe
SHA256f6e51795b5d56489ea914bdb1b2045a84b7042626e2b99aa0b63816013db7978
SHA5122c6dc6fa76975e9dcc86af9069fde162f87e8397e3e0c88590533875b426dadcbb88fc4de0fde72363bdd7f1a0314b36e14639bd36b74c6bb1a226eb96abf1a7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5ce1352577fc1c43938cb30f957c459c7
SHA1ee04def9dfdf99fa93021c1044c041df96f784b6
SHA256504795db0fd53cb4afbb922db4820d254299009941238893683d1b4f17ad970c
SHA51272f2a85b96fa6bd15d7f38fe1630997cd2e4fa12523ed123d8b5271681e26f311b76470bc2d22f9472479fad8a5551173e7508fd001167680e0ef666eb0caf1e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize5KB
MD5b22d5a48f7a330cc4142b12963501d9b
SHA1dd3d831c5b36de8d37ca0bf06a072ab5419de5d4
SHA256c91ace28adccb640e6d30fbe837a1a8fe46e8d61ba045b6189606eeac1398e0b
SHA512b89c540670b8a326c254795e83b8d72cb34cf81f0b3dd2c030caf6d4cb09ee00ee050fe12a4e16d24b74ed030a145ff86b70cce1bbe8b0fd3370de10f383c033
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize9KB
MD50dc9774233c0499f3ed4e521e258ec3a
SHA1a6a0d781f66dedfc3e1f6ae76955cb23e8c5bd3c
SHA256fbb6eec16c802a86b3ce5ce09414f960fd8afba8913b89615ab227a28e2b2dc2
SHA512952e3a8ebf8fbbb2a4ea5b804c5ba188fdf3f299c83d7accc44cfad2f5f316a8ac467cc1a52dd93daa54d219cf916071befaa52f324bf6c8e04146ea7b3cc524
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD57b8df456ed0febd643a08dafd110be81
SHA10e7497309d76e5107ee705a1e2c149151ef6cc88
SHA2567cb1945aaadacd0a5149787bf0d741a1b099bb7c4112fd5bcb1af90e108f14cb
SHA5124e168db4ca1add57bc19571b7dbaf7af127855024cddd28e4bceda40b6d15d3b414670d089e2e13ae5c5d8641f3245ed48d301ac05a8f95e7ea678a7bf008aac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize6KB
MD58e6cabf7a56f71e6b68ce26187ae2b24
SHA1332c3b7c359f155e0b5134a07e6e64cf411d5038
SHA256fb67f7f94e436f1da2d70336821e90faa78f16fce9d62de26865b4efd7febba0
SHA51229af39dd29396fb99e8139dd32d167cd09795d3cf91a8dbc47cf2f10ae7c566d394cca87f197ba2762ff96b9dc4913d921e455cef71df52bf4b107c324edaee3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize17KB
MD5387a9a77bb593381e03c3564dc3d5c90
SHA1384deedc464a96d584132b59674931fc66d27eed
SHA2561d53b98cb8415c49120db12b3eac59b9853ca52abf06fe396d45f29a118fb750
SHA51266c22697439ab61c7fa11232f02daf8888b563fc85d4410f97b23b0c695da8e93f7bbe5359d4be57e47fa6e5bcc879204c0292e0c56693babdb2b3c78e442290
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize9KB
MD5e2e2fc02d82a0d32688cccf4e3945beb
SHA1a246a8351e184f0457cbeb7c1bb2e01641434ab1
SHA256b75f0a86605d7ef5b6262a6a260b82e96d52a3954e0249e8bfa2ff8070de24fd
SHA51223f1b9df45f2903c909c193d2d995ef36bfb5997e5d8efd57237f2c0d3cb75c4220cdf4244b726cf8fc2a86213a2d3884190df90b6d551790551c9693ef38f4a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\720dc2c1-5369-4a08-bae2-4839c83ca7ee.tmp
Filesize2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\_metadata\generated_indexed_rulesets\_ruleset1
Filesize891B
MD5d7a63ccfe52eeb58faa0f0aa441ab878
SHA1050ad45533af7c85a5369c48e0ce49634ed62d65
SHA2563a68db4a7ef75fa420da4db273d62feadf29e863800b584f97460cc6584d1f56
SHA512583c464b95d9abe2ca9504f44bc3030c0698913470cf7a3890f1f9ae79b2477989b27b4f16cc9e61a991ca1af8b507eb9d4b812d766d6f1f0d2200a32d41c80e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\_metadata\verified_contents.json
Filesize4KB
MD58f8eabb9959c83cfd07d7841cdcd10c5
SHA1d449886a11b7ff45d77db5dae7d64527f603165b
SHA2564cb304a1266975c2623e4d0ffe33122685da6ee7f6903b96b972606200ffb9a6
SHA512a135df22dc5be56cc998313138be00b00634fb1bf294e2427bae369b8f19dfaa18b61398c906701b57cf8a59941ea9831319cd999b34b0f30a9484ee2e5cb699
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\fonts\noto-sans-bold.woff
Filesize12KB
MD5a65fc7725f81daa832e2ac5d4820c2b1
SHA1a5602a3cb911cdb6ed538c22f451763d884092f0
SHA2565adee3972bb1a6f74b582f79a5d3b4735e665c00b2e49938a4fb68755e56d9df
SHA512f8b07d9d46733c8820cf2466a14203710f10ceba789f80fb700b00ff950e5c1f30fb035939911e4d1a4e7ab92f37ce8f6fb47f5d9ab58f5eb5031804e4ad96a9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\fonts\noto-sans.woff
Filesize12KB
MD50a66f097fb9215e828bc0ada73d19e45
SHA1f962197011fa900ec29b4bd14f624a3309854626
SHA2568e5f3060067847d71c398a897b8f8aecadbacadec3324b41d6eec5b3014fed89
SHA512060d79916429b617f950a86ef6783198ceb844f26e65b7d26fd667a37c577c5913ba4ef183d2ca0e7f46b3d6e13c128a5bf8c4ae7e0f543c53c051bf13a92fd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\fonts\segoe-ui-bold.woff
Filesize19KB
MD552382539737f4e9913e4bf6b9966bee3
SHA1d58d3dc5ff86fe8ff594134df53ea9b8074f6bc6
SHA256d711a54cb4822ccf7926b1a95b7a43107fcfe8ef99a817e6906a1063657c7b28
SHA51255f1767cfb589eca775f2849b975d8311295951f8e457be58de34983531961ce4fada3a856daed8d7cd712bd8b5fad53ceecf438949deaafb7d5cb87114ecb4d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\fonts\segoe-ui.woff
Filesize19KB
MD59a2931180d6b1dc7b33052657eef554b
SHA177b8f3cb5410c779206782a310990c19af2b02ca
SHA256f424915a692bc5a458d6e7d9c99e4fe0cf5cb8883bd3516b01d4fef5da8d3663
SHA512e839eb6fa727c6a604da142e7c823c5d8b7d8e33b3d19937da7bc1948c32893b08f0ace35c020e391ab0a9694b479b28282024c3518dac995eb87fd7aa18c631
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\icons\icon-128.png
Filesize6KB
MD5a3c4a97b3abf5c40532df4c73b6a0aed
SHA1487bcc26a31f4545cada98e13532510784f3d9e4
SHA256dc9ab4985526d23074e9cf2ee176e68dd7a5cd282c147df32733da083b7ce8a6
SHA51271c82630413b7d9e8f2541bb036b1884c2e88ba5abee2e6abf79744951f1f2e65f7a3d82fb59c274ad7f02b3e49ee5fa2f20973410db3cc2ca92e6bb3dd42fbf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\icons\icon-34.png
Filesize1KB
MD515b14e66c46e0a83449fea81f4d0e59c
SHA1c3512dc47f25eb700e21a04f0925aa9d6996f08f
SHA25610a9008f1b5e61a13f2fc225e9444f17a30036f76855826ff0f881de880db15e
SHA512c0296a9252e9ea8336a28a73fdeb6d90a3fbd13cb5699f9b90e8b2e3858f041509e8886d056b402c5444e9b36a5950fdb8dc93dd46c15a79d84e1e579b5cd887
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\icons\icon-threat.png
Filesize10KB
MD5d7be3dbfb6c292dc440d4f72d073715e
SHA1cae4a585577f6521e1931d09457694e57b9389b6
SHA256cdd148cc2f8b3d7f008e2827367ef48a2be499ae34dbd22263854cbfeba903f9
SHA51214a80c3602ec6a50b15baa23d74e894021a733eb14f541534ce51e1b847e4c25835591a6ec821deca093d384b849491866a340de832d6fb138e51330dc833f50
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\icons\icon-upgrade.png
Filesize13KB
MD58f0dbfccb36007d663b552bb84db01d5
SHA1709b15810f26fe075d1037b7d90e196f4471d574
SHA25607b43077658e1bbc63ac5c7431fd1940f74e8231a532a055de9e2fa0ae79b0be
SHA512064962f997821ab44b523dc6a7524b6ff21352d90fb9e13281a72ad4d09d3431173d96c71277c92cae023f91d435700169113f14171446d52e65e48b1a44f719
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\arrow.svg
Filesize782B
MD5098267b50a118f33b7492712af4fa9d3
SHA15662445b9138d268cced9ab71670ea69506e52a5
SHA2560ec47a14edaf377afdf77304c710ca0021201cb4d815c2883fb06b0253a0286b
SHA51215300c0637c00480416ce5ad6191015df45686393bb3bd3c75243ae60a2572b1a4d2c5d411628aeb271b73880d4f091558f39c9a68800523a77ce9f5f86266eb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\attention-icon.svg
Filesize2KB
MD542783644ebb2a199b3618c043b46f0fe
SHA1c372cc134ab0970a6aaa15f529363aa3a5cb9aec
SHA256ec38ff640365f6003f28fc3cc54d78c9883147610ca3c395edf4adcb2af91594
SHA5127eb2e91b12eb1398d22391480574079f22a3928640be3f0d7c4e5230db5f2ef1c48977c1a7e6877f1f4e9a3a236c4410f875fb0f8006a312cb30189d6bb9e9d9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\breach-notify-icon.svg
Filesize12KB
MD5e37aed44ee55c3e7be7f983a83449078
SHA1070bd086accd4bd04146a32ece09252bcab4387a
SHA256371c49b23b1602f3e3e79b98428641f5a316de0ed3ecb2eb73cf9d7e12a01cee
SHA5123d45277cfe5644db11598c3a6665f7b6b0eab38eeceb5846129c43bed568b3b2fdcaae0175103eec840697caee659d0f998b66a6f3fbf2b5e5353fcc922ae6f1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\close-icon.svg
Filesize283B
MD5af135c5a307c0929934ab179965e9e53
SHA17798a6f73e13fa7226363db06ffded4644028524
SHA256947325c209b02cbf029b7197985fbf55740d1b4f65242757889827699f646cc3
SHA512e83c06bbf1a253235c681b9bb29244891b0d8449e809231e5adb2251bf0fad6a1ec8333e1d31803d5104d45c10e72621ab68d1dd4666e7d0b75c316c2c3f3b11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\crown.svg
Filesize1KB
MD50f77ada07f818277112ef9ea68d42851
SHA18dff529ff78faf8724400c3a99290794f5be411c
SHA256c9899b5a377fb16bfd7e641092dd1d6d986ce80300d14b1eb8107d78029865e1
SHA512ccf41cfb6b96d33ac64123482b0794632a8ddda983e03fe9ba012ae6920fa80205549e828619d95059aa2eda7379dfeb722e480b9a961b7bc57b6302a4fb15fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\info.svg
Filesize1KB
MD559e2f9e145b1500bf20fe634eacdb14f
SHA18b30ef06bec1cbd4704e156f2a7fb01803d9cd8c
SHA25669739b12cc11ac6e4b417061d3fb46f63cb070a756fa55463ef018ac684248a5
SHA512fa125384590c831b85f4454a80ffa60fa9dc70d2c95ae4083e045a0cb8ba64a5bf7d3093e8a29fbf1c798ecf777e08824704d9f52523e2453451c8877042b9fe
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\logo-blue.svg
Filesize6KB
MD5acc37544364375fc67b44f027773c94f
SHA13ea1628a0c300ddafa885e6252e76cd18a952355
SHA2568c05fe44d139e67155501cfa73c8ec7d683dc0fc42d17869eb8c2e28c8072d5f
SHA512178a6bd3a043546175468957aa14dd81f2fa8928d6fcd787eb4a5bcc590557bd2a0cf376f5b0aedc7f5215337d5d9ce2dc8b9e4d6bfa66361a2cdabe815fb2d2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\logo_with_name.svg
Filesize6KB
MD57077be1629422619bbe5057dea2afcf6
SHA1dccf730b9bd0ba9fb7c505f350aa2428457bc952
SHA2560d28843ed45447345a2437b02ac99a6426de73143015d70bf2eb43ccd4fc75fa
SHA51248da879c4223098c02814106279abcd6e5cd4a4379baf4cfeffa2fa7a961c4d8791ce10bb79a6643c1fc63d9b57e969f4fa2e5a2dc47e2ac60a1970b2f67f24f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\assets\images\no-scan-notify-icon.svg
Filesize9KB
MD585be03700bee78ba5dffd47c18f5f796
SHA149dd78d61b39a013b4759b8789fff70e720d48bd
SHA256c289ac227906cd11b2178abc616f7c12ce72e70b089ab86043b857bf44f434f4
SHA5128e440d8e060cd8c080ed45364e84e124b30ed72878e7563c7ffc5813aec7fd6487dfeac4e237674cdfd7f798da9d1b3e2c7b2a23ac888fa890176606c312eb93
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\background.bundle.js
Filesize1.3MB
MD5b6b00d4310fd23fa3e1d94af5bcdd4c2
SHA188e3dbc145cb0b65795508136c921bc77dc90f06
SHA256abc1fab0200c29a94e1301a7eef2823640b82e521893bef0bc868272382a40f8
SHA512251fd4b1c975e06c490e8dfadefa3207eba94d39bbf80ab9a565efb6d5124a99aebe4c03e041f2de6cdb34f45d9b252d132249526314abc997aa4f4d07f6420b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\contentScript.bundle.js
Filesize534KB
MD5883885fc1d090cbc70af72d2fc335a36
SHA1fe0d38738d5c3b6700efcd668567bc0ec766e61d
SHA256f401990b49aabdfc551a7479fea53e5231451e5afe2f0c73cface57d53b20998
SHA51207d04b85f9cb0f56732d85e3c7f5043c1ae58379b30465f4b0d82f3d7ee29c97dba1f6349322f3254627b7770cbdbd462cbba086e5ec425170851df471e8fa8e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\index.bundle.js
Filesize447KB
MD5f1c97f2132c11fcb682bc12d314d1445
SHA1244eeef80eb528f668b0d41bed6c4922ce15d065
SHA2564549a2db13a3e2200752e94e2d7890f67b39f7d3cba1a6d00294d3f369ec8a69
SHA512db0019e0798c00c01400fb0f8dbf456d4cb7379b4268bd79fe8d896f5b72c20dbbd1eee8c2b51c7cf9d490d4f2ce7f4dab0755a0b081d9d3c1eac338a9c260f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\index.html
Filesize410B
MD5336fd61de62addda84cc9e5c283b7e67
SHA16b5985b920c40c61fb320f70be5f89233754699c
SHA2566476c7b35152cbbe4906e94dada4e68faf052744cb0da74589679b86d49edd15
SHA5122f641a563c6283ee3582c597c10be2336a18cf5e4a1e0c1a3c8b661e1ef49774145f15630b90cb5c1f9bd9439c6d64dc2bfc160763ae3d949eb0eca805bfbad6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\manifest.json
Filesize2KB
MD52b78987aa8cb637c48dbbe1fbb7beeaf
SHA12794737ad07bc86ca3b97e1128e510732b02efee
SHA256b3a3eded16fb28ef7d5cbd8a4419ef8d31543fcea3e49d5a4334874317ab7468
SHA51263728ecef75fcc63a4eabb1fe14411e82a95afe2a7373884b60bcabadb3fd8697c2946fc307b2d7a99ee31a4fa2117f7bd0b0eceb05924a94a2e652988417323
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir4368_1018656658\CRX_INSTALL\rules.json
Filesize939B
MD55736d36e31b7bc0d59788d30260281ea
SHA1c2810c0335d1760d2ab337db349c362596df06be
SHA25679ecc25acaf4d184958e339a9e48a1f0d187f82a676843dc6a40ff907e1853f3
SHA512046686a280f60d50791ff8bd13989ba4bf058f402bc3d45c3688bc60e8ea91e6e44ec3ae8bf66f1e47b66b336ea8b0f70f20ff1279f6dfb377d662d633296c7e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_best.aliexpress.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log
Filesize33KB
MD5e417327a19e2d356b88a8fac5e22129e
SHA1f077026d53bc4e8c5fd1aec1806e438d5d5ecf39
SHA256163277a90ab36f281db1c16192b7b4cc1f00fef18bd748de94d7b7e333c1b9e4
SHA512890bbca0e6a7547c45684c55a4e2ae258785acc80dfbb7ed0ab2aa89693c4be92d17ddeb9072fc050061819259bc1a8ee01aa0224ef3448146aba98a75a19f5f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG
Filesize383B
MD54a36c10bacb4eb608e9fe42b3ce6da4e
SHA17ba5dbf5145f5253137f6c86056f22f538f62234
SHA256cc4c2a6dfd72b80fa6b213b80098bc1046f7db4fb0dc57cd4f3545f9f02ae547
SHA512d4d6f0e9f1d241eb7a902efa656290f23c2fbbab635094fa9afcfb5df660c0097a700a5c67f190ec163f81619165344c6e67d4d27a7d72fbf4545689ad240453
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\000003.log
Filesize9KB
MD515c0615852c2cb8084679ef3260fcd93
SHA1040ca028a5c54a72ee73907dd9de373ee604c4c6
SHA256d941e00db5d99cf567dea86d861d869577e3a3bf4b74b386525d3a33b260163e
SHA512bb37f20517cd89201964d63a939275cffff4d680170acf1d6ee865b4d183bbc3924be640e917a75aa9a966c03ad78e1b7c9e9b27312da27188cde11b1f5dbf23
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\LOG
Filesize390B
MD53b15ea45a51b7fac231271aec3a52114
SHA18f6005e72d11d4283ea3be570f3954c33b42a459
SHA25617f013510bf006eecd7c4c4e83092dccf04d2f0787408e0013c281296c3667df
SHA512a95bbab99adfce2911a6a53488d7a224389ecd8b5c9a275753a18848839b215fed7b978964bc97e3aaffdf75a9d8b39e5055b84e4cc657335e06778da945717c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_uk.norton.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
1KB
MD509fd1250d15a5536350e17e5ca620390
SHA1b2a7c38d138f3a320a38a115fcc1c38a6ffd94ac
SHA25696c8fed2516a49c7c2629161042a2b82551d11f651e080f9ef3045539482b55d
SHA5124f97fe27608dbe92a95445418faf8248dc712c7bd60c066e31fe6533e511d414e4b3e92b0f3b1ebca2b2f1e1adf144acfbe7a2335d08acd5d73d6726740f01c0
-
Filesize
4KB
MD5a42b58741b86394bd9cdc5778da22c86
SHA17da27aad856a1232847452031a85a6c12ea7ad0f
SHA25628eca447825d9ab0e85e089022dfd3417ee66a5e64922842ee9eabb03421e93e
SHA51222137568a57d9e45cf20cf5b01dfab94ae53fc777b8b51a0807e4ac7524fd6d7f7016f93cf70882487b35e11b294bb24eb1a93116b8818e774529302b22212ec
-
Filesize
12KB
MD52310d18643b92487b56304c5a7fbf590
SHA15cbebcfd54ebee6bc95a85f283b95eb5358b8d75
SHA256265400d8caaa01745369809024c6f177f7a63a804859c79d5204ae669bba47ea
SHA5123a0128fe937eeab844d5ad9033569b1512c5f3e657f302014e6145242e9d8f5945be68b0d07084195dcb544d226cfdd193bc7ed4af91b9e3c52003c9539badfa
-
Filesize
13KB
MD51a39e5eb7e769d98b4428f402e75eb61
SHA11c490dd2f15c3ef06b16fcaa8fedccb5029f3701
SHA2560082b13c11a76855996fe56aed568869ada6ed2df19c922f665791399f83d092
SHA512ac2106ead3de8717d88b5b2d2cf6ec8cbeb982af91f597d670278d1d5edca733f90b40d059a0ddda081e92092e86064324fb9ee2b03dab3b81dba150c946701f
-
Filesize
1KB
MD51af5daebae206f822e122ea6c041624a
SHA1a6d18a04599952ed10a40b2095dae48fdcc5cdca
SHA2566cfbb50692b57c34ad4fb3bfbf5593715830cadcdbe5411fe6918c18c1b6c5ca
SHA5121b1e62aef42f5ca3f75ff0ade13569f747be90665d076fa54f5b2d81ba8474836ab51c553102235aa19591709cfc910a3353c6fb47c28297644bb9aad6b8133e
-
Filesize
11KB
MD5c1c228e7569fc1ca47ed9a2d7cda30e3
SHA15c4353044f81cb6dab362a481adaef7ea52240a6
SHA2565523303934d89a3229c60eb3585bdc703fbe2570be91989af54e3dbed4697a41
SHA5124d16e0428dfe7179156d0d2f60260af5cc9b223a86e56635284db41f18c8c93f4a998cc0be6d5958745cecf9ef07fdcd09b2175298315c1c09a2578b79f35d6a
-
Filesize
14KB
MD5e4924cb3c150843c2933a61ac1c9a62b
SHA1869445cd5746214be22e5ce62503acdf51b9b064
SHA2567168a60eaf78529bbb873e39323f19efd99207eee46a9ceb7dfbca0cba4f0346
SHA512a8f9af595669f26f4ad2271eaf01691a701e7cc169c7b3cfeb531464c2cfeef9477840111c3a39464e37db8ac024a72b4d647eb9772909d360ba810cfe85821a
-
Filesize
19KB
MD5ec0bc1c3a0ca933d0ab5a7665b1e9fd0
SHA100862ba1bffa3649986c664c9a18ca8b69ae700f
SHA25682a2f2365705ddca5b7fd278f8afc0500e31884cdf794d0de0c66154e5714554
SHA51242cf11a14c61bca257fdeca28a6540944feb2003d3d622e7d152af7ae975096660d75b3960503156922bd54d48b90c00e5b9ba46b589bc5324e067b385fe4ee7
-
Filesize
20KB
MD55259634e4cbcd128d8c75d4d82a90212
SHA1c808bb1194462bce7fc7d80bdc0677f92f64b465
SHA25631a9f7c90d82cbb62cc5fc4ea63b60f823864834792f1f02ed35b4bca832cf95
SHA51272c1fb23571984f2d42b946188e572cf95e77842f143c73d222792db5d632259a901c7b4f097ad188718669d4d4f4646c39ca5c0fb9b6b42c51798ec3bb2ca86
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\201c5651-018c-476c-b90b-674c0fe50f21.tmp
Filesize16KB
MD5fe8ab06231b2b205e4b3e45e0cefc1db
SHA16e43cc598dd2f8d8e4189d2c89fc9484e3ed82b6
SHA256b45604c7c3b213d07fba35a406482ceac67c9b7aeb295eed6751149a3f01015c
SHA512787849d391bc8c805ebdb9a3e2fa935d44734167e6e882d5c97e58012991c3fff006ca3ba5d00fe9e7b1a681ea4cb84ff30feffada4e8d88981c8de29238759d
-
Filesize
28KB
MD59dda31523947e6b38cea843f38f07b71
SHA15f91f3c1175389da3b9e3e976b9cb9e3319f2ad8
SHA256a7ed383c512fae8c6ce20c37f5f446350238bfbd01b74dbcfed4ccd9dfc53ef5
SHA512328ae6130b758b4b2d53b19ce412ff63653046f046c6fa47e358a0fc498391d115cf9ca6f66987ddb85f9a87d39fd6e3dae2cd919c712b1984611be2e6a31148
-
Filesize
43KB
MD5c02ddeb6fffab907aaf6016ce05e75a3
SHA1252e8665f74c2378566195bf293325bdfcd9c938
SHA2566b9ba3188c06c989957bc1ed7e00d33c5e23d095204e40b00ad1bbc3f7fa8cba
SHA512c4e51eb85834df00ea7158bad547e53b522d636ea29b8877dab1b634454a43896612b639c53dc2bde021b674c32fdc48079010e1ba6b14e5db915d4a31afc25f
-
Filesize
45KB
MD5713440c61ee19bbac7575da89a8fa03a
SHA1b5dd058399eb8ddc139d65f6d159978b7ab0c968
SHA2563dc8b0f0a86cc96bc757782f6429f1295f6f7956305f4052749e884bb2fc89c1
SHA512a9fe9ddfd391da2383284cf4e56054e53d87cfac60ede1adb38b48344224e1a2af3507d2056c315fcfe1fe793f980227422d90fcb2f092059e81ec4b528dcb28
-
Filesize
35KB
MD5150c2d38d23e2ff3bcc00d2227a4f517
SHA1b208df641094641e736f9c3aa5dd5119ffeeff55
SHA2567e6b6d44d2a05a032ef4e832b27dbff2a2f1303726f012043c31bc231f07f29a
SHA5122d55b723da8b59021a7f8ffd67db54cb31d25ff68accebffb35cc4ce47f7fd33d69b3140697581ed19924e5276bb6f96579367ac26c059b3fa8d168bd8e46189
-
Filesize
43KB
MD5c1c9b9d785c937a174592ea6e0e87a66
SHA1b33ecb1dce12380f8f225052813491c0014e6f6d
SHA2569b5977de3d7ad63215ce56cf67ec36c8daa3e02ac6a9682698d29dec9f4563a3
SHA512cb3dca9c64a1dcf0a9434ef1e60aceb24ec1a772b34f9b9f9d8be3e624912f528b8af7e3125026f73c665f68c40738a5df76d5a0a3121d75b79bf6c6af4fe52f
-
Filesize
211B
MD5cbe1209c1525065d9aa876b049fa6b4e
SHA1d26109cec2d9bf11a24fae02c673a0fa5cf9cf58
SHA256ee5e1650f76c030d639f28fe42c0edde3c749b6d573615a0ca7e48aee78dad5b
SHA512a376b0019cbb3f9310742fe6f37ac7cce5177314a28e8a8bf233e56fce456e778330cc040c5758fe82730157fccd59d5641b40b296c60fa9ad19102fd0e88d93
-
Filesize
211B
MD57ae081c7166973f6e7759868ec6043dc
SHA1455359ab9b478adc4fab530181a398fd64a7978f
SHA25631ffeb0dfe1d3730c6344a5ae2ea3985df289dc7b24e65d5e697f29412e458c2
SHA5129d92cfe2a8a3673952fcce518a0c3f78f69d2616054f38abb6616ea7b452a9a880ec939342b4b836bb9e8caa5a7935baa8645d1e92762351d80c8af25b611fa9
-
Filesize
211B
MD587d6f81de9d5e4cc386c69b6f168e96f
SHA1b52701694844b82a285d8dc4447c0cb33f26fd59
SHA256391f39a2995f0451f6f7459aa3b70f1636287c67b68c5f329330ae7de290ce14
SHA51278ef1d0aafb6861c84d8e1442367370256ae859a5995f193a7bc6f717da7901c14068bbcc8a756674d74c4f38ab291ae21cc223a653787c8cd0edd8edc0ee4e8
-
Filesize
211B
MD532f9c6736adc4a8201ea2444a4742300
SHA113d491fdf5ccefd26655810a395727fc50f3886d
SHA25639f72f5c8dbb984d8b91bbd8893a772f9484bed03aa5b2c250b8cd5b6f9eed38
SHA5128c87671ee34c36ea3f5764246914f3f0f100c495ab4798456d316d065a376cbed218f4ecdf77502d30a38416577119c9c820f3be010fb44789f30d604acc3d3f
-
Filesize
12KB
MD59f81df15da18a3203ade754d4a99df34
SHA12306720a581bc432fa22076c28306e6cbda1d1fe
SHA256880d9818935f9fbd0188c55c0e5c1f4ca56047913a09cc1dbff82cb2bc6058b5
SHA5122336b41226d5bde81d835ea766e531484c0394917dd3b24e873b31ce64520643211c6762058820c6fd299188b22f2665ff3a52c64de92b93846bbd478dff4953
-
Filesize
12KB
MD519ae6d7a3b3f247b3f9a064db5013f7b
SHA133d78ca21d1a7da464490f4175b14840a8f29153
SHA256741ed27b4549ffd4eb785a0dfdcc2997a462051f5b74be1b60bb41414d2962a6
SHA51230518ffcbbe23e0be2008205347b3dd79df0f880c3a81045f8e391539b708288c760a08a703511e90e63ce8d5f3db7031ee0c052ff0fde3cabc1342d4f4140e8
-
Filesize
12KB
MD506fcaae4d187f795f00a69bde0147d29
SHA15ad77cd235f6ac453967d5f2a74cc5a268c8ba1c
SHA2569d8d20b2effbe403925f1fc0ec1ca0d12deb7f3013a4fe8e8c899ab177606707
SHA512ba442f74c956b99f336f7558736f397570bb3d2c0b1cd5fb98b68001b1a055911e955278296d4858dca32282de11c304cd911ff1a397fc36064f1a9232e4ac8c
-
Filesize
12KB
MD55a0cfc624cceda9c3bf4ab855f62c3ea
SHA1a54f54f9cfc8c2d4407a7ca16012160df23cfd74
SHA256d557fd9d16e3e0a271a3b24fcb21eff581c146eabe3b2469e739b76bf3971b2b
SHA512cc8f6cd927207706b33a560f9de079a231abf9af3882c9e9509abcf2dcd415a9eb785e7403190e1f2df0b5fbc649b95c55f2fa05bc081a634b2275bb2698501f
-
Filesize
10KB
MD5370339e80c2f601e511a4c1f74a07dec
SHA192492337411fa9c0e7ee4e6e45082270752af16d
SHA256ef73efc7da7738257584b8e1f993ed1a4bbc470f4d78518a9d19ba2a5449a6bc
SHA512fda547e0f94dd99c2933d72581bf081e423785a7bcc53ac4ab0d7b4438d25f7b5417962e113cd95f59459d10bc29425a11e6154abe8205a69b391cb1357dcd43
-
Filesize
10KB
MD5f57a6192aaf39b10ede3760e8053f672
SHA137397e9f23893bd80a2edc7dd7a1520c05908c41
SHA2562bae6459208424d757aec0368e5874f3daa5b8a006c22dd4c06014c77daae80d
SHA5126084e1757db6d8aba63c02c087fcb1d28703a8644b5d389d70762437dc912b8f7ff40880d3f4aef6c5ed8f1afbbdef25337f351cdf4fddb714040055bad606ce
-
Filesize
16KB
MD55b8c41f643a74e035d7d5dc7cc9a8eb6
SHA1e1123a3318509d328df0a77204f14eca69794871
SHA2564950e8d0a0906768a1d8ed0af083cd2dd00fbdaa9c12075c71d3391fa7eeb5c5
SHA5128b478fa7cde8387d724c0eec61ac194dee100630300251693b19cc518692d6d188d91ccf03096f2ada702dd57476dd8e6841aaebeb28c4dddaca7d03e0b9c98a
-
Filesize
11KB
MD51479d4aff3e397e13b09400f53194c65
SHA11f3c81d96743eca66bbb861f6605716d83cbaf57
SHA2561bce32fd29a51ce66d906642e27fd3daa3c7df4374537531737d336928c33711
SHA5121cde178f26511907191f46854edc55be9b5ec6b2d318917c8941558e0c97fd7160f467e5d05ef11b3d45518c4ef08d66308b9aa6088a8fb2b5b658744583cc16
-
Filesize
14KB
MD5220cba87343ff707f47f576341b71791
SHA142b7f633af8e6a39e57fb2dee469677fa48f8f49
SHA256d7cffbf01368e75190aaf611ea40cca4e0943f70a7314bffb59382ad904d3053
SHA51200527023ef8de688e2d89dd89584cfb04e1b6aa0cbb2490e60a822faf6b59cc2fc6e357ad705e59aa5b37b8243c07f57e7fcf4ea8eeef34c8042ba51c0cf0f5e
-
Filesize
16KB
MD5df86b3ee4543a8d9fab92da8762cee91
SHA187b316f77daaffb7551c71772b70fc63208a7eee
SHA256f576d588025b58f30321c471725323428fb606d1ad22717d9fa9c3e48c03606b
SHA512bccc8739ff6701d86046db6aa2f0e3d450cdcb7ec182d50f0e7700a7afca8fe11300bc8c8a90df785c24c5c25357770fa685d5d0e00c92d21cb41de6dde870dd
-
Filesize
16KB
MD57d079f8382c3777b471b0cb8a2b79635
SHA12b4e7ffdd75476397ea42b902989eb8d66dffd75
SHA256b298fd0502f8285ff7606672a9004ad17f094cfd85d9830e7c977de785fb9d58
SHA512cd703f7a073ff7283dfe4ac16b2d8b7da6ba3c992f1de7d177af049469cc591a067db86381a1a59ff277d1c091385761694adfcce0a913aaf826a89060d989da
-
Filesize
14KB
MD51279775b7055a99208af7ddd44a42465
SHA16408748b9cc581b1ca80b61d331bf1eb2e77f666
SHA2562d27980cfe926e7b4b4b315d5f1f6b3007ccd747e55127f99f5304d7256aa695
SHA512c9924feff93ed9b2261a7113d2105582817508e86cbc6f5b89b7f032f1be9883567890fef9b0cb94449556ee3f5326068bc53518080049ba2e25bb9339f8d919
-
Filesize
15KB
MD5f4641018077e32a0d626daaf6331c95c
SHA1dabf0266b368de81d7fd8f7e4c2a9c685f79b3f8
SHA2568c64bca8303b5ca66d2f6c923ba205452efd5b3360f49db6ee96efa78cb28c70
SHA512395d09285c2328cbf55b9b6195a374d1531cf48c912084d6db82b1576a9098f8abfbe3a78d464c58a746416261e3cd8437defc739ba779fd4d5868a0fd34c774
-
Filesize
16KB
MD5a27faeb8fee93fd71e23840f9a54cfb2
SHA177fa16e7a3614e8533664770e3924ee9613c8d55
SHA2565ce135879e76bde83926e0ccbe19a8671ffe35313d6c8270c81285ff78a81e34
SHA5125d140619a011f9d5e7deb959390d91c3dc4b08ed55637b33edfaa77fcb3af7ed2360f199df3a0a7887ec86623f854f70a8d59917a9df4f2c1520a84886ee9e95
-
Filesize
16KB
MD51bd90049e285ef4dbc9bd0b8764a1615
SHA1985bd6c544a36c4fee0a72c9d9169f57fb940844
SHA2560393f2abed514391bbfdc70d00de8d32d0df191152cee7ee663c892785760110
SHA51232a6ec6c77591a2c996dc41078d6e23f4984cadbde98b3d65fc47aab8ca9f32b56b80aad9cebf58633149ef1dba49aca90a1d97039a198e43d821d7b5ae69792
-
Filesize
14KB
MD53340fd8a552301bb220bc280f1264645
SHA1ff67fb92ebbf269a1e7ce4173908fabe182cdd5c
SHA2568bf4fe750fd7bf20985a31546bd17ef88808f1da771f0a36cd234468a9ba3d26
SHA512e934a197811d96df4f3a917ccfdef959727400d13b4f284ac89fb24b28a12d70e980eb556d9d9b5628e1a6a5214aa6b720185097d720d68fea6fc428a23e2025
-
Filesize
16KB
MD57ea7ef07083d45d88aa453080aea4fd9
SHA12641c096f170de35f5688c129d5628020eb694a3
SHA2560898265e7ee9cbbf40b2f5bff483e6e943dfbc999cae11551a00511c3d57524f
SHA51215a7e872f610030562fe52e1d6609116a1f78ed58d35b222fd02d3ec0741c9503731ec3cfa49c310b4de7b3c9c83e7dd87a663e1a1c2a2cc791219838d1eba02
-
Filesize
16KB
MD5e1c121b1242c7c010b601eb2e38d5d54
SHA180a7f703cea5bd30a07ecf8d86346377302eebe0
SHA256e4e89ad6642d6445b6bfa62598a17f7b6d6a492f7d46d9c03218a015535e4d90
SHA512dcbc3ef0465412daf7d6314e7440e4ceae6d235a10244b54c51074e602eb302972affd44ba649bb2bc79fdde2d632c7af300b48014e80abf8267aa416b1914d7
-
Filesize
16KB
MD54acc00a04789d43d70a5852a4a08a530
SHA10d204ff4343deba88c4a1dcc27fd5437128c37fd
SHA25696b385c780cd70640381f1b2c6db4e248dd33f1abe8b31793acbf90fddbc933e
SHA51206d8d6e89348f01b844beb4829931d666b7b0d1b35575c2ac95f22c78ecc44db5f27a2749cb74964c855abd4494e99cfb7eb3a1b677747698d9f7f74a4038e81
-
Filesize
16KB
MD520c6d10a26241b2de6597cf1220c00f4
SHA196d308bc905fea9e3abfd111ad5c325b493fa0d3
SHA256e4db3febf4bed092730c84907ecc932c98a9d8234ed6b1df91c000f088654b9a
SHA512471372dd9d1da7be106295097057c81cf3ebb868fe8af4982f2a3655bf6982d9a5b90196263644bc827017ca43e992294389472a43101f684537e42a30074d0e
-
Filesize
16KB
MD5bf175d08ea4030451b328f7765771850
SHA1e0ad385025a3c46b1cabef0360525a6dac604da5
SHA25642e396c9853e21c7cb3ff33409013072fbce66f9a7c50f5adcba55f96228cc60
SHA512be46b87c72783a4c458182609c0c122714f5b2d26eba27e2470df706658d7b438227fe910660a6c330b806cd27bc1bf467a61b9de639e3f97e14b081ed4e6bfa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f2e7539d-3ec2-4cdd-91d7-bb0fd5b766b6.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
29KB
MD5568644d080c0c1234e9b81734ac22409
SHA10d3f2d0e3b9d9956d5072b3e623d10f24585503f
SHA2565fd78fed0aa5e0051739c883693b23116206246f8381f07aa5471767bba32b6c
SHA512aa652ef5297387633315054f37df05ab3b72ee7851da025efc62a4c98ebd64233a66581e8cee239f6c62e9b0e0545dc1542f3b50bc94cd61a96fb9329e31d041
-
Filesize
33KB
MD57be8dc03c210569aba6db956baff3178
SHA13bb79ab0c623d54cdcaa4ef069cb9c6ff6cce838
SHA256a45f6ea4551f249aa78cb4c6e560a1d2fba391d93df5524e69ebe07df7fc3dba
SHA512186c753a38cbd685b6233e12df52fb4f5633da4e6e2af5a710f58a4c10f9e158a8425f4d6abc6e745de5d2fa0ccfd649332d8f253ea480584a65c26a82514ec6
-
Filesize
35KB
MD5bd11ef397aff6f74d4ac1cd3d55f42cf
SHA18838c2012de6a99f40c3e648c058542446a7a166
SHA256b7a7fc671cd7755f9ac2f315a40b30cd6d9f273ceb9815f7b1b3d43a9ec88210
SHA5121575ea66d23673ae688f71f795c6d2eb83fece43f531ce820839fe5f87e889ead6fe4b4ddd2547d3129d0b2bcd80be2fc446dde9990ff3f6ec4427dda1a47c6f
-
Filesize
6KB
MD5e3d9e6edc626e72fd7a4fd66bb0b3864
SHA1291ed464fc65f0cb1d224ab4b9792d97a85e67d3
SHA256c4d05da5d08021d703e38272ff719bb18203443161a3209feb92d84374058969
SHA512b22668a46d176315106ef2863a47dfb41f47a37867b3af699bb36b9d9094805a48a762d75d84c66ba3debde753af74a34949e5eb406d81da794bfb4f05591e40
-
Filesize
7KB
MD5c278bc5b242888741b20c1c174786ab9
SHA1674efd6bbcaded796ada57401c47d8c1a95356f0
SHA256c1bf68e8f864147ab0dd0f4dc0ebe1146f8c004a8bfad76d0e64dfd62dacddd6
SHA5121d2131fd10c1019eef602e59c9676d76dcbd894cd196dcec45bc3672a60312b8d67ff07fd9a1bc1b2185ad0eb01b3ab8c34bda993e0ee10c5cfff797167c7ae1
-
Filesize
9KB
MD5e355a5c294bb64eb37c3c8ccd684be49
SHA1a22bf0ca9b52448be79cae226765f707d341c8c6
SHA2564862062de05bd31cf03640e7c9c3c30d58bffc1c8217641219780f9c5348e605
SHA512b74be3ac4ec62348fb61cf72cd263dbc7c4d0974c66a6283d04fc0474f34560ce19d739fac9710ab3a7f0758c658748d1fe59ae80bcb1665e461bcbda30d46d6
-
Filesize
9KB
MD54219ec36276171eaf5b66e32f621e48d
SHA18e4e6f989250114cc5a1c6b92163546157c920f4
SHA2566730c62d6b0060dd64913bc85f5879c3b9b2232838eaffd50855ed48f1a8a95d
SHA5129f7eb7723b657b56a56cced93d913840608cf4c417489a2d8a99af6541e88cbeadb701e1aaa4a5201ee8daca9025c1355406b0bd16e9a1e6416bd8141dbf0b45
-
Filesize
9KB
MD5b10cf6aea94092059598c4b7084e89d3
SHA1b1f82ee88c5283d1d362ae5f62d2f43f52a611ca
SHA25629354e6ffadded8c03974a5afeb183e49723d450c8a1774af490a0934a4e1b4f
SHA5126d8c5180fdc0d8711e693ba6021fe553554cd44248cc7f61b0bc9e23da4c001364e4a0b9d86d5d740f9d75e1d2e99508bab2b7ed95de47267bbcc4f3a146b450
-
Filesize
17KB
MD55cb92698b65c481c190b22def4058736
SHA124ed508f97ab39ba051d4477d0f81960670722d3
SHA2568910c581f839387bbc64504bdb29d01c58d0c0269089b2b8a23722147c47ec06
SHA51256003bfade8cbffa160dbf9120c175883c56d7168bc2ffe45f2ed3d52e46aa66eded1d0db0c9866e215b1cb9b9588ac37f20eb3b9adf0f2bfa63201f4e174945
-
Filesize
20KB
MD59f331e6ed2e2939e0fcb01d993575723
SHA1ed0174e39d10adf6ea5ef218f018fb09ce7ff6f3
SHA256b9342cf3aeeafde663c995807dcbc06f8f34c8f930087f1c9e34b961c103a46b
SHA51266dc4805d51d9a1e6cae59257b8babe5bdbbdd511b91f5eb58f5ac2b2c34b990dc9aff2baefce5c5742e72ca021c1ce6b5f28e813df4bb815bd7261681e97523
-
Filesize
21KB
MD5d88363c96a26fe8aa472f4cb6f60c642
SHA120ba4cd58520fedc862555858eba6ae20a8ceb65
SHA256e7e63144db8cacecee97f0cb584e6739ccde3148be6385ea31ed53433ca153c1
SHA5123d7e32398f591387ced8b0e51ae7db0adf2231df08458089bd03761d6587132ea147bf91575314800def9ce52c88acbbf57b2e0c770d77361eb1334b710000e5
-
Filesize
14KB
MD5b050d6359ffff1f8048abe0837cf6a0d
SHA10b8a6c1325212dab545f61b45a28990d7a525d55
SHA256d8ab959837db230215687060519e8b8e4f1b1b6e2119f6eb94385253dfdf58ff
SHA5129d64e58ffb66b0f261d055b60d0b0f54f3673ec4d466e627b15d6274d90d78b38aa23ec4d15173864eb21431a8bc27a1132569fa6ab3ad8176099207a627ef24
-
Filesize
7KB
MD5678b1933644bb758e8f78039b4483f7e
SHA13935ed835a6e1ea67e0b07f73ccdd5a842fbbd06
SHA2566d92d737227410805bfc7f9c54cfa6d768c8d6cd9d8b0012c35c903cd8a6c75d
SHA512d934ebf2fab2160f064b3640dd73eb9dca644a2e899398f1a5108617ecf503bb984eb550d80708382257f42e3c6e2120ede9526d28188b5cdac52428cd5d1f1d
-
Filesize
7KB
MD501985f17ed44125a819b3e9afd47255d
SHA1e52056db5c7e96ad359f0932ecd0b9b4187d0f78
SHA256df73e6cee05b456a72c18965343a171307d2a6e82ec95c884be59b61722b527c
SHA5122d980059e74bc84cc20a9901e9eb5d45d1b00057b2189ff2a58a245a8cdf5d13517c5d6a1289cb972d60b8464902aa393b69391c42c718d88df87815f3a0c599
-
Filesize
9KB
MD518a8e4714031ba0732c5901d502d3d8f
SHA1c668d0fd15197bc3b4ab56a65e5b32543cebf5a1
SHA2569f19cd31932273a3ac63bdcb1c2256adca4d3af0271383506494e664c56a1a04
SHA51205bda9bde21b0e958a6651dd5f7528d2628fb1984b90e9eba2b8ddfd1890fadc2ad4f2714f1d45fe195630e055515e70d12cc5aecaff3e5083ad563479b247a5
-
Filesize
14KB
MD5e059361faf0ad75723641de7c40e3b52
SHA1d57be7e7b840559294f81bdcccfe40a5ccba739e
SHA256998139866171ebb84ba41cf9669a6329ddf89ebe16977e01e4afbfd47470f33b
SHA512f5c88e358ea6111e270c7d6b66a8f8aece77405bcc46465de4eda5a0bc44edf01ddfac1dda9adbd523c5ac5ada7f6038de11271b426c9cbae07f82217c4f1ccc
-
Filesize
9KB
MD53e2b9865d98742c93da6af822adfeb12
SHA1883abe498e89fc046acef68dc397ff1b7f81dee2
SHA256357e785eb8c82a281329809a541be8db2433f768fb8e40028fe66999810bbd95
SHA51212de1ce3398f43fbb3d4f7e4ca2d23dad511b4e22778f6f415486e8046b8e91ef725d51a7412790d6675c39ecd8a34b4a5f5e0e425b4af613949a8b7dc59b6a1
-
Filesize
14KB
MD59ea4b4644fe9a34a935860796d8594fa
SHA1cb1932dd39af863e161febf08dc32e586b8fccdf
SHA256cda8e975b2cfeeeca861f666d502a27618c2091197e32fa57638d55d9a34cd54
SHA51207a13fb6b131902492f645efe1b73caef5a7747dc321bc033b2bdc2c0444e93942991e9344f20d6287746fa20ae4ae8779b63c5f2ab3d95146283269528ee4ec
-
Filesize
14KB
MD5bef2b46a18fc4d1bbea48d83d69aed60
SHA163ad7fed6752f74366bdf53816a5d0a97ba1d496
SHA256079693c6a240cf8f814b4364aa5ce4c631939953d66db8247292b4f1b5bc8649
SHA5125f733454fd0e73f8c0fac2ec29b895c4b38edd16e7f984e8239efd26f491fe6567f381bce3848195da76d365fc837f4592b45cf99d003cccc8b84ba40abb030d
-
Filesize
15KB
MD50121cd453316fa1a3969272f39f4f92d
SHA12fc4909917545ec15ddb251a0b0a60b14a5d23ca
SHA25669b1cec15cd63c1c3dce9f01e6e2cd3c35bf5352724af7825d399711c91189cf
SHA512130302dd34e09eeff2e5d8f51ce62e4615fcff891a9125446f76f59e10253f64a9a372fe12705705337d4a02c5f273b211164018f4a9a8095b7fa046e2cb203d
-
Filesize
28KB
MD513a66837e49c190ab93b86f58fba1d9b
SHA1efb1f2dea1eabbbe8c3e15da5cac7e13a04cceda
SHA256d31a6dd71a75576b0174e83180bb92c365364a040fe2863cbdc864c156010ae8
SHA512c69916edac2f68b86b29fbc35212124f4156a900af98d1da43416764ee8ec20622ca90170e50c32fef7e72c99a5082fdfdc5df2573c01df616cf564adc80a571
-
Filesize
6KB
MD55c2c6d7763da75a9e24d3c1136a97521
SHA1982f44f65c87724181b7a8d38fc0b45acc5cba4f
SHA2569a66c371b150dcc6535c55f657e439b8f7960b3f656fea09c574c22932f96301
SHA5124fe90a8e31a1fa7200f93d2b18d9ac8fb18d34dfe6d221be7e5f3cb24df4f20383bccd4f2165f7e295c5280e16e30ebc96f5b3468cbc7ae1694c1b9a781ec5c0
-
Filesize
10KB
MD5e1329d6d98cf41a407e2cb5e3ef70f98
SHA19b954c3c450e74558cae9c4607631cf2c64901f7
SHA2562db09069042faab5146d0084979c405984bf4e732a11c1678552bb1bb373c4f8
SHA512415e34d35de94d13196570d174b4ebb1c02a115571b952d207bc32f3ede3543ebf5959c1b870f4cf446330b795d91a48d43880d471d424d2fbb6985355ff5153
-
Filesize
7KB
MD5554eb3edae640c075ad0d8acc98fdcee
SHA1d8ac8592c981a594dd61b5c6da60722f624b6e23
SHA2568c2f50dab0f6b9503e87ac273066cba05c5c3e53a52db40dfbce00a62d994a7b
SHA512c009f818415855b74de3d5c764351f40151e156e47d214f08af2f690eece9c3a0eedf0f914027135598ea09c3472bfbefe2f0983f5fa29dfed7500a2393423ad
-
Filesize
7KB
MD566e12a9dffae774bf2a3058dac8c5327
SHA19aea8bcd5cc74a83f54d5fa0e30e71ada0e42302
SHA256ac2a1596d53466179669656e11839ceb219f520503d0d84c6f6fbaf245c28f6c
SHA512634378d2630c4d1c17b9bfd1951e13d1f41266d4d7f440b91038db271d501ef5c94891b13bc2e29483e93081321eb4710cfc99f939fe01e5798064e0f463edb1
-
Filesize
14KB
MD5db01ad36630339ca78214deb9b5dfc83
SHA1d62067d9b8f2e1d1388436b44fe6c9b276334ae6
SHA2568aae5e5aa95b5ec8c8e37a99d66102f5db5b1dc6bcf33ebb96390a26497771ce
SHA5121b1248dbd298e0b38805bf10d55ad5a4a8fa9f8ce748f09177adaa39133ac07cbd23278bf249f21409cd285e2626052d90de4f2463da9f6f91178662e2e2c86a
-
Filesize
15KB
MD58d7156ed20c0678859db9bb5d554e04a
SHA1e5ddaec18a7be47c20c52d6c480be42414e54de2
SHA256a24b9f594148ebdc3bbf9914df90aa9183380c0150b08b983d34505a29e09e6a
SHA5127d7a34b1397da6d7076ae5662c7b0c5fc3183d9b85b3fa19ba2db0808881d2de7e26d8351351b1a572ca65c18e77642f84d38f19a43a304d73962313f507ebe4
-
Filesize
156KB
MD5d9bf03220f32377f6ca8800ed8fc8d14
SHA1b923bb88f2a840f3b7854326273993a68117ee61
SHA256e33816ae5660a1495a15deb343a237fc1e3efe22ba0e78d3bc6bb86bb76d8e2f
SHA512c7bcc7eea86b63d98f4d385f7dc2782b9fb711ab861a46c972f81501174a3768f794fdb3d6fadc17739fee3519f75ba4cee14d01c1d0eec8aec921f0d0c06a57
-
Filesize
14KB
MD51d881ca406458993f8643dd544e349ef
SHA1d0251fa265c74c1fe2ea4a146df6cbc536d90c3b
SHA256709338c3e754d7876453927f9ac35859021e8f83a2b7a4a3e055ab31c99afb1c
SHA512a971d8beec75914263d05be7753e9925802817e8c574d72e7d6fdabd211475323f755f28f294db39151804223d541cfdae45ff789b8d3af2f826ee7264b9d8e6
-
Filesize
16KB
MD541338c81fcd948971cb379ed21005945
SHA1e4196597c6a505865f705a003818b617c525c63b
SHA25639f06b83d4dc85575ac9bc715ca8d0611adc54e84455f3a27392611f240fcadd
SHA512ff20271ac10d91b0e01bf147169b6dcb7de2de354e714b6189defaa688a5aeb500593cb9d13a84dfe5ce44938838a2c210fb9f42c63a6880a1a9de177fbfd0c2
-
Filesize
20KB
MD57aec5924c24231cfc08f91d85547f25d
SHA153a5740f806bfff31a9c339950828938059be686
SHA256400021fd095d62de91e54df0793c68da515f7b328786b2ffc82effc51eacc415
SHA5129985d58e18361d3940e8ecdc9787f54628997e0262318c54698e79d9bc7fa91bae76f79e150f5d208eb560cb80f3c6ea85c1feaca065f3acee3de2394c6c613b
-
Filesize
7KB
MD5b161dbabe4d46cf8859e8e9b58b61bc8
SHA1fcf93d0df18a371cf5327fecb1b7755da33a72ce
SHA256cf45bbb76922d9a156b5b9ed60ed41f3e77339d68c3c26323595d00a16553a3e
SHA51225db86784a16c41cf62a1885a10641e33a9d15f925439654f9b8f76caa7fa6c6348deaa0d5feb09f26a29f591650ea853ae8beb72bd2f92238dd422dfba53ae9
-
Filesize
7KB
MD51761faeba7b88e9808137619804be4ce
SHA17562e3cc5948af973b97e6c6108ab5e3800d0c63
SHA2562bdc6452a8a41f9672b61127f0dcc2eb3ba38d3c5ed89674f8d8bb5ee7fc5964
SHA512aa9ad7662543e373f6d577709d1f60529c66ef66b25724e913001013521ce66161895ba0eba14e8ad8b76edd089091d66cad4f14e3214c546bb0879694197341
-
Filesize
21KB
MD5793fb824c73de805bc37c963277ae2af
SHA19dd231e02aa9889880ba93b5d71c63c367a56569
SHA2566a5d260e5273f2c8162b2504f0fb1486f555fac2c852da19abfb68b167f3da8b
SHA51288cf1ee31166fc0440eeaa5750da1fcac1e5f0360063edf0420494639fa7c8307e2f373a3864a5e77c640f422714a098dd81a7bb167dc37619661407684859e6
-
Filesize
155KB
MD59350731016b2fe1f839819595ec73ad5
SHA1b49e0b99be2054ad6a4f0578db3d829a329814aa
SHA256d741724742e460547d4d471f15e9a35f56d615613babff3e3ea85b111b9e03aa
SHA512c270dca4e64bcc213bf1e3b80f667ee8a1d6b48482ae99973b020e4a42ef54bdbacbe409c72f5fe7df4b914a315d710c9565c87198fc1683714ab31769967ee3
-
Filesize
21KB
MD5cfcb6069409d2cc1aabbdd9a04b5f03b
SHA1faa0b124d70949ee801ef6219536267d1e390457
SHA256e0515ef884efe04558c912ae8840c5c2a3ed5cde552ab3ef3e54b5a3e9feaf9b
SHA512a7a11bf67b36dbee049c4269a48ca8fee7988949336ada1ae29088f8f134db0ca0b160dcdc86093a718aadf2f3cb80771349bc47fceebf6a535ff205145ae5d1
-
Filesize
7KB
MD5dc3e144200ab104231d4c01dbed117bf
SHA1ef380363b465702297b86c097739d995a4d6da76
SHA256469a546f363259d4efdc3fb90ea5038558bc1fbdca3040daac50acc063934c26
SHA5128337e3b1a782a6cb3ec0f8d388c3728d4a9de767810b84b03c33b4e452bf66a5d0798ebdb6bcd4568455eba3f1e3dab1569c7052c84b9249353afe476d5b95e0
-
Filesize
8KB
MD5ee372c5c93c92eb9fea921c8d5b5d10e
SHA15ef9aca6b784a610ef0e6c43529c2b4543b4a017
SHA25618269c760f85be0b4750cda2f05aa93d3dc5f86736b9b5ff8ef9a71cd7098496
SHA512c830bee2f0624ce196a46649ee4f13d005d4f61f96695fe456fa942ffa334179634488730ef981391bd98a70abc06c85e68a90c68516691d7285842af79921e2
-
Filesize
9KB
MD5f7ea393904d35bb3d360519fd0c0c686
SHA1a6a820e838cf9e8d66161908b2d118a79924c91d
SHA256b97550b8c8537d001e9910fced83f909b0c07b3e2e56c003ab843fc45acf89b3
SHA512ea516ae877587041fc3d065f2c6392d87277afd720229ea60b8a81a1b0de6f954c52bc9e8e5d54b8d54be63b4b787aa8ce8ac1293610e967f00ccccbdd49d1d2
-
Filesize
34KB
MD5c2e24364c730843fe52ba9590da94210
SHA148aa02c2db2067deb3a2cc95b50ac9f237c38ba7
SHA256a2d0dc53586a9fa3dcc9fcd8339b877b0460f1fca994402ca3eb8abbd2243ede
SHA5125c341743f44b328eab2ddd312c9322cce76d6ae1197e977e916476aa25ac9f3c4dc3de561d1af5ffea89565073dab23f0fcc94b6dc31280eec0957390b45ffda
-
Filesize
27KB
MD5e9b35d1e7db792b279d14107f5d87ed9
SHA18af997d462164c6236fd8d1225e65ad224ca77d1
SHA256d086a427c8bb08bca95b032da71dda45b3302944f37f0d1fde21d583d37c90f8
SHA512435e4a3eac1ab8f0ca95e953dee1aff33319a11c317d60427d3e4d38e624e774ead9ef217db775bb51552276d52d0a377dcc55892866bbfe9799d44c3d3d3b91
-
Filesize
30KB
MD5a8d1eedc07fed2d17d58220d73c090c2
SHA19c1ddfeef71a068994c899996dec11ed5249b49e
SHA256442ef1a0c97cb798988bb60dadaf5abd6d9062553d524df82beec4ec3567f587
SHA512b090396ca6bd112109ef811cf348af80d9380d3414f825120340dbc257ecf543903a91e613bfe671f6604bb45535906ae95fd485b4b63340dfb3cbd4046a80a0
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize99B
MD5580dc1a53e34a57ae8278765350fe56f
SHA19c3e2ede80dec9eca65856da8423a72db8f8e9b0
SHA2560402f55c26bf19205706e3aac1cbb864ef06eb20729962ae063ae03f025a912f
SHA512fc55d0e5c85f0bf00561d5b95f8a4c948c6b848f514cf93e76e4b310743a3e982119bfc94ca82e67fc760f9ad904843a0141b3a7df66096b2c8e4633bab4c9af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize35B
MD5343859b4ad03856a60d076c8cd8f22c3
SHA17954a27de3329b4c5eefd4bdcb8450823881aad6
SHA2568c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f
SHA51258014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt
Filesize74B
MD580d5b96641b839bdf3b754fb90a88e93
SHA14ded5db63eeee9064a96354180c91c073869bbf2
SHA256f65dc1008a76cc9bf0d3ac047fc647a3559ce3879eab1dcc122c1f261d524178
SHA512d45b9d7e19d846b3a95f4cc64658675e93b6c7f14d420525cb6f0b7c8c44d42f9b6ac817567f33426054bc527bd53aecfb570f0076dc6b6b5d72e6bbd15adbca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt~RFe5f746e.TMP
Filesize99B
MD514fc49fbd46664ee60bdca7c914a2dc0
SHA11c762dbc359fba7fca73f786f04ceac7b8193709
SHA256c5e5c446f0c93dd3bf436941e6de354c269443d205678016a9b2f571319c9799
SHA512688ac29750764989df624b51474125dc5fa194b4e243c1ec479cb979eb4eb6db0ca1d585f9978089a7bdf76af99d91fe1ac54860b8583791a687600e502593e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\282f05fa-8d2c-4265-969b-065e8ff784cf\d73e05b3c7588927_0
Filesize70KB
MD55a6a6765f7d971b88d3b9aadcd0c3cae
SHA15ed8ffb3ecfb8344cc2808e5eadeb1efb902365a
SHA25634f29547d78635bcff5b6c272a1818fdc11649c205b9c3f12a5c25455809023d
SHA512b698515e20dc7666ed64f13cfba2e852bb2164b2ed991060714a25febb5fb524912a1de7528e6c07e2ae3cb8ba245b0cc061add0a02496142edfa5e81c5fc425
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\282f05fa-8d2c-4265-969b-065e8ff784cf\index-dir\the-real-index
Filesize72B
MD535befe44f3f808a38ff342efddad4355
SHA13456a7b37704a9db9de9bfd83e9c6ade8df082dd
SHA2563135b2b9eb1aafe2a5f8b05b494406d1a74528f0172cb860c5b01652121f5266
SHA512d86ddc96c0eb843509b0e181e4594cf6e0a04f03ca3db2bee7d7e683873bb3a76ffc129e48aab5ab89914e99f53f1bbc684cb254dbeb8a323cf5967041761a83
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\282f05fa-8d2c-4265-969b-065e8ff784cf\index-dir\the-real-index
Filesize72B
MD5323a3597555dbd2351cd60b1bdbf7076
SHA18a21b7f3907ce4f2d59e0a962ec91349a266f97d
SHA256ba79e59f12f7cd1bc44ddfafd7f6e6afbe4b10a804eac17819352e86ba33fc4e
SHA512c9dc28637d03dd8bf2135f540257685bb64c87accc537f7e193ad8d15811ed93b606f45ff94480f0ea5bfeac22f34cd72a2b782ffb6de46b25a8adb169504cc8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\282f05fa-8d2c-4265-969b-065e8ff784cf\index-dir\the-real-index
Filesize72B
MD59f28abd8c593fadbc84dc24621fb3f49
SHA17e74f209c59d68a8f21e8597681e047114983dc9
SHA256ad23d98b2f910591cedb7ebaa46b89396489e9616ad071aef30a8aa55ba37829
SHA512af705e80cfbf9e0ebc112d0f3549872d9ca382dd39d51b19599880139472023c71d49540c344b6fe07151a62a196c08e5187db21e082c6acb9de8c09f4e9dfce
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\282f05fa-8d2c-4265-969b-065e8ff784cf\index-dir\the-real-index
Filesize72B
MD51000cb27dc0ff492228e1c33826e748a
SHA10f868674405aa2226c2b0709687e438426bb136d
SHA2565cdb9d3253fdc3b4b0641e3032a5e3d8aabf8a06462ef8da3354de5be5f31a6a
SHA512b0afeca682f6924020d2f2f1400d72d85fae5a366fad43f489870b51f83826ceef1edabdb052ed6e6bbd0abae5f29305f17073b1619ce1addd0ee0e2948f6381
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\426d6ef5-c056-46af-855d-d57dce151a49\index-dir\the-real-index
Filesize96B
MD542ec187eaa01fb8e3edd9208c00ee0c0
SHA19961ebf547e3e8294c9d4f7cc29cca2383506f3c
SHA256bfa413c8b0833186a7c1c9bfefe3fb1ef5cbe2f3c209747525ec981d7583e02b
SHA5124bcad35a0f5a038ceb1cf390786363b0811745d3bfe6fb148a67d4bffb64f3332c76c0ad5979c7db6d852f0b542a33698eb58394dd238d645e70a0c3255ffd85
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\426d6ef5-c056-46af-855d-d57dce151a49\index-dir\the-real-index
Filesize96B
MD509ac3606ca6602206280fe662611f8b0
SHA147457721ff05bdf8b919181aeb02d5bd7be6899c
SHA256429d430a635f39f7273b31361be146821d48b9b76347d96b45fdbbef29e643d1
SHA5122379c03816f5ad787d9b5faa8c8bb772567b7ed422eb31d39b564c5adbbfd9159cbdf353ed0e94bf6ab0d748f168301e449318550cecae6018a46758ba826533
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\426d6ef5-c056-46af-855d-d57dce151a49\index-dir\the-real-index
Filesize72B
MD55de6b18a3f31fcd7403b43ac5f4c6afb
SHA18d419e62b9ba38beef5f3d3f106737ff5a639d89
SHA256c981eb678c524c3761b07f2f0122b382e7d0e4446ed6e310afa50ab86767ef13
SHA512ae7957852695202f0162b2a925568b1a5edf70c519767637539decc48340425dfe60d5c4a6248c68fff259ba1df467bffabbe159c9dd1d31993e000e990d3985
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\426d6ef5-c056-46af-855d-d57dce151a49\index-dir\the-real-index
Filesize96B
MD5644705cb054bf46da8ccc945e9903e86
SHA1cfaaf8d3432ca07427400a69c14b7865bbaba00a
SHA256b023ed0a2b2158396fe5cac92905c5e33cb3ccb2b024a82ae1d1826d865c1304
SHA512eca7e4d8cc4456f18aa770202e3f0eb9a698c65587ce7adef552185efc273e5affee86a1b3e7624ac97bfdbcf80f423d261b153731d8867ab6646c42948ff3c7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5b571cf5-c472-41da-848d-ea067fb7589b\index-dir\the-real-index
Filesize1KB
MD556a8ee50e47ca66dd6153bdde58266bf
SHA1e917d8b4eeccd9258e78a2d04b6bf497e3877f69
SHA256910da57e88da26422d89fd62bd1e091a69da094ab375ec3cfcf5d2c2e78f7f9f
SHA512aa984c4fa9e88def7213246ea8a06729b42aaaeaf1fa312fc10cdadd12cced99ad77c0825453a3e749c8614b188e4ebc3dfdee426a79731c91c8af9048b4acc6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5b571cf5-c472-41da-848d-ea067fb7589b\index-dir\the-real-index
Filesize2KB
MD5a2a0a728da875f40f296e6f2ad6abb99
SHA15a86c3df238ecf0767c2d683018aea4f3d4379e9
SHA256ccfd03389d16cf9c6655953401b6e69783d2fad1123b3f8087ecdd72039e0562
SHA51270e496de0c670fa18dadfbe240e15ec196102ad9dad37740e6c924032b1e6de70a491885ecfc50f5b34ce5f9eb70719648c16ca6b69014e2db13aff77049be8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b5b68f8f-49f1-493a-92d5-fa44875adc8d\index-dir\the-real-index
Filesize72B
MD5622e00403350eae7613145a5cf34de93
SHA1a3d4e544aed7b2e9834e1e6de69b08e507b402ec
SHA2560b85839b197a5326c76ff83ac6a448a6221c77a6bd428dfeeccde76aea369f07
SHA5126e810b941b8859d5d0c4ba0cbdb1c2bb94473a8ce7a46ebbd824426746406adae6997fe11352499acb5b1717258b3572e9361710f52dcdff756a4c4334d8b87b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b5b68f8f-49f1-493a-92d5-fa44875adc8d\index-dir\the-real-index
Filesize72B
MD587cc2c6edef1d4dd6f14f0dbe74b5064
SHA14ec5539b3ea4a5c26d325d8df1478ef1e9e59a50
SHA256d1120980ff61fbc8fc087856b2113ec0d0fc941f747e3c35d72ab78a6e1fde56
SHA5126e07119c119456223a66dd1ee453ba774ed94a1a610d438121b05c651b09e1b12be9f45b25768e130427b680e8f9b4774b216c1916ac68e9549f48d54e1a053f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b5b68f8f-49f1-493a-92d5-fa44875adc8d\index-dir\the-real-index
Filesize72B
MD58ce956c852aac85390ead081043da44a
SHA1dc08e35731144b996d532f4e33489fa7f0fcce5f
SHA256fce5a10bc1969e672032a9e9b27bccb6239c4fc431ad0680a7ea652cdd38b676
SHA5125390760bfc8282f031c8618ee8990f7fc32952442b993cbb783345d8225d24acc334db878c74779105712132822ceca53e3a87c83a5e4a1ab17534ca3b05dc9b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b5b68f8f-49f1-493a-92d5-fa44875adc8d\index-dir\the-real-index
Filesize72B
MD5031c8cc0d5fe7dc2a42e3d78639c1d43
SHA194ca4c28078228c0cdef9863546a5339bc819a12
SHA256a4eb9a9b38ed2db569641ddce54f3f697bea0fa9370ee7ea0ab0bad8e756c6a7
SHA51279a3fa28c8ddc3d58723d1cbdf23546ffa21f5a1f9a7d15355c5820ff0a5b1d8364918507e4da65eff3e71eb40759a4f40667ce33bfdcafbe24d1e24ee038a91
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize253B
MD56c74b139e45a3a4bfdebbac50c79f6e2
SHA100e06d9106d5d93ce7d75be2aa854f2c2d577570
SHA2565b1ff260fed3eb0e891fb592bc47eed1087c4938113493610701f47ea517e230
SHA512d0bb1e43679a08f3215ee0aea6cf80d9c30059c1bc726ffcc54e04034a6f5fc70599777b16b9f0de834e36e99090cf0393ef14b1a10453caea8787ef497a8382
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize253B
MD540fa8244214b7546a8ab948775be9657
SHA1f64ed6d05bff19415f0b3e06d15536120483f9ea
SHA256039b0305c5e636aee1b474b4a608b0f06aa4d20661e94de2243360c5b3d1d7b0
SHA512de54f43c8ae909680f2d4caf20cb5fad21538fa8960320ac8e1624eae15f41eebe48042cb1499d902fcc902cc067dead34f80951c9e6f69b3e063cdf9ea9eb99
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize192B
MD5a0882a7e7a9002061c59085bd132e326
SHA182f5dd72fe047efc6a2fad02329ab3070781a7de
SHA256e81bb0664df9646c2ef47d26f44ca5ec1270e6109e125953f761f362433f8db5
SHA5129af890c4b7dadec2a49a63b951012fe15e9512bbadb354d088fa418a6fadb412d27780a0efed0f6252e77a083c32808ee7ad59dd1b07bc4f5cede052a844c3e1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize255B
MD5743d50b8e8f38a2b9402ce4beb059a7a
SHA1ee7a75eee334ad8d5af4e36bf6fd68d7351bc65a
SHA2562adebf6b289022a4785eed131aae018e900da34bbf8e44d5ae136c1302d406ef
SHA5121cea23b7ac860f9eeed101b8d1e6f02d829868dedc207828942b19e13b3d18cc69deb6d3a5894a7e8684e6f645f08907eca805327cc64ed8af929d03b5295c52
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize327B
MD5b89a716d4dd5e25c6da42c481678b0bf
SHA110a526f4237bb4739434d20f4ba112ed9e13f19f
SHA256e80aa70aebba0b2e2934cef3d0e975da7f5c5f6ca57c53c7fa32595a3d6b672a
SHA512890f000ba51d2b5972618892b2dcaafb1dc85ceb957d29bcc7df1cef410fd04f7d70317c3981e583ce41ce8edd70eaf5ed2065350e346c3fd2a58a182e80550a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize322B
MD5accd949b12db7c733992ae9015fcf6cb
SHA11cc6e7f3aacd755012e811c59addd4eb37755a89
SHA2562ef7fb1fe8a2d176a8cc53a4d7e66731362615491663e8200b72be0acec3fee0
SHA512a09a9393a539c7c624f426a9070aea090a5c7015539a74d409f62df7e04f7d01e1345a297cd726adf897bfc3f214ee687475fa36497d85af143866496274e4e4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize322B
MD5ad06981ec0be2f9be17317667e7fbd06
SHA11edf9350f59bb5df5838a71225a5fb9e9aa0de27
SHA2560f206292dde9fb9c3dc7c27d50f71d63085db5041ee5db6ea5298886daf38449
SHA5124a31cb3a68e49fdd44d869b4023ff48239b9dff39d1644333a957a34d83bc8e42c22a11ce6ef94cf113fd594f7d9b31a60bc96c2facbe317c2a713e2accee822
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize322B
MD5e9600fe845710f89372fb07e6e2b4f1d
SHA13fd0982a3bdfbcb36abcfbbb625afb3bc2b4802e
SHA25650bdb39de390b268f00fccb4aca7b1e2fdf9af70788570294b696aaffc0f4554
SHA5122504d316234e2d07c5c6b1205f2678342a35865c3314a6c97f6ca6072627a83e5e2d7dd56731a6d7da855c97656b7e704aee24008e76a267f9f7ac12e9373925
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize322B
MD5590c34248d2ad08d12c89ba37413b3a1
SHA1f7887d55951b9e9153fabe1c301c00fc1c8555a5
SHA256769b48f89ce09bd80a059467ef4eb99e10ee5fb14d89feb544703c5bae75024d
SHA5124b6787c9077e290b29e9a775a79761de670cbf8955c25c048f9983670a92b63b678643d0d251671cab19579b4d7de01409946f04a534537e4cb610527a650104
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt~RFe692785.TMP
Filesize119B
MD546351db487a1c6a364233c6ff6d0ee5b
SHA189c727d0f0f0b44f81389347cacabc1c9cbf11a1
SHA25637b894558997601e8a1a01f18a69d92b68aca3fd6fa48b94a4c014453461a365
SHA512b3072286291dadfc6b35df49b283fa731fe69b9dd5c527f6cd9ce16da34856034a879c59b2521a23626fd7bcad5e7d7390d6f599bafc7aefc627104cab26b79b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\013888a1cda32b90_0
Filesize9KB
MD5011094ce6f6c9f702e432525e4c55a3d
SHA1b9bf0ea1d2077561ef6702319fb96dbc4e850ac9
SHA256b413f9970437c17437257927605d22adc3e67ec97672e0b8ad63fd2a11e8c282
SHA5120080e966bc69cf24e43d629acab1cfc1d22ee1bc77a607211019d5faf6ec8d974af62f70eb579fb5faf5faee07bd14f2fe601677f94511275e6a9d32abe9ac70
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0
Filesize81KB
MD59b88fa4237b0422bec98246bb4c5a16e
SHA13e80b45f1718da0237cc33fd83a62ae663a2ad38
SHA256f7217f0bdff10790a9fcdfca92dcbf88d36a4b094949ae19447d9a49ede4fde2
SHA512140047baf21f528c96a32e1a001eab9d3e5a87ef98126719f27715ab5a70709b5b38a26106954a0f3b0faf1ba55773828f6b9308cea0d112ae5c023a308291f1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\67a473248953641b_0
Filesize6KB
MD5ee8d6a2ade1b4fcc37799e697f0f8f46
SHA1b9eea88ef66ee39f22c34f20ae2a3137288f1f49
SHA256b709839323c78b8afb020f60283c3c46ea963d7cdb3954aeb0aad2a47a2686a8
SHA5122af8accaf7f024ee9f1e5c17d2df4995fe6839f253a3de67b8b8492e5512b7096ad71985fe99f0c821ed8181c497ef14dc1668b470e93cdc4704a6a4c81ad3cb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Filesize5KB
MD5bd2c3e978d2e35a46959181ee1ff7d27
SHA12a0e9e5ee6da3b7e5252ad2199dd71228de5c419
SHA256d769aaeaef763533d466fbefc8405e652cff00eeaef9afc0af1907fed2c7311c
SHA5127fa1dcb1206f1730088e9256e120694bb9773f70aed3f9e6e17623edb8eefce55c864476ba9391a73e51f7d6fda64f3b322eee077e8e59eaf79fd7e50c03d45b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Filesize2KB
MD52499b60c5a8e0919bb9f3dfcbd7ea0c9
SHA105a35307f31df8fb3b8fef92b013219de6dc2402
SHA25642440b30b12292cd9842cf60b28cdeccc33479474c7eae41bebc8f6e35132663
SHA5123e1db547faf37eddfefce87043b81492f58abafdd05118085a1d533f169825420c131bd7b8aabe57b452163a74f17a3fe3679d396656af1cc5c757aaee5b75e8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Filesize3KB
MD50310dcda7fb70a2186049e3aa0af37ae
SHA158a165533843b5ebd11300a6079856fcbab2ac43
SHA256c40028b2bb4b7b25190536709ada3bbd0c864a33d3d698fb0601fbd80bfeb17a
SHA512478a5e22fd61e0227f9ebb91d32675156c7ed8ee0e201ecf49385ffaec411ad923ad8bda1fd3a8a1bd2af07fff87cd0bc1a6b153d2201f2039fe3dbfb5c3ffad
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize240B
MD5c505fadbe974007394a14e8ab4843e5c
SHA1e175851ccaa2686ff60bd070636d098ae915d8ac
SHA25633d40d95cdbb542d12e592ef1e188d74d75f101be0436b7e3cec6228410f4021
SHA512d7dcac3dd4f018aedfeb956569a5b2c292021eb27b06a191e8f7f0970df4cd56acb628f2561c3be9c219b7bacd4ab09c35558e3b7ffb9867be4451b3c997459d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize264B
MD508a9713a4f8cca7f9e7e983be48e1552
SHA1bbf8dd244ade3ecf115e04bbab7400ce8ebe970b
SHA256e8b22cb636be21a03150ab13332d30d424725549a8c8f8cf07178474f0f2905d
SHA51212873c0e1a34037a10907ef43a34d22166c3749e3efd2f95aa40f1afb169a5b41bb69aa881461eb03af9dfe68cc6880e31aaa81330c1eb7060b10dabd91bae73
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize336B
MD5d53d5070201eaa2351eff2d5d5784701
SHA1aa54b503ffd4cbb6c44d7593b23581ba06eeccfa
SHA25673ab57c112641bccc98652ff7dc1d5ceea80fa0606a73ef34fc6b985707a0625
SHA51224d7a48690e90bbb028ff7047633a67305e55d40cb8c4c0b9a420fc0a4ae477f01b9eda9c21354498667cc1300d98bcda23768150c15f0bd92e0ef2a7b34624f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize288B
MD51b5200f124fca5a6e53c639b6ee60127
SHA14986925e529fcab0a570f07a717729482d22fdb6
SHA2568c6d4493bf0f046bc76dd34198caf7f904eb213203ce6a77fdf09674d150b840
SHA512822f201198229d87d8537f12f3c7c454a41ea0a33dbc95de88f74ae21dabb21f19ba71f31f01104c842dcaad79e93156f3ab820c4a687583486e01f0e8e3cb3a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5cc6a3.TMP
Filesize48B
MD58cc88ba4f3d36ec7cb094705862c7d42
SHA1def40b64ed5fe865ede0d1b62d1cf17b1a0ac6d6
SHA256548f4a0aa49a67c8571c8b62e1c23873002dde5570a95d546456c8b7e4527ef7
SHA512733249af7dd8ffb96cea632c10db345ffe2b6b503003346ec0dbd518366d7bdd5acd272bacd4a41412bfc54d7e0c114094d976c9002bc7339f2bd577a374a59e
-
Filesize
1KB
MD5e2c32304c81549a3cd7f47e4b9472074
SHA12d56c37d01b7088a455f9d6778cd41a857e673fd
SHA256eca0cc7ae0a5212d799b64f6bc7a7395fecb7199d20d3327f8ac4a22b034e67c
SHA5122a637c8d9aaa44427535c2432d90052000823bb8993055f55ab8ab3fcdc2eaf32d2bce730f1f6d1b5056e9325281bf64c5676de079f73c0620d8a26f0be24e40
-
Filesize
2KB
MD5f9692b584355d8d3be99ffa540f92b11
SHA10702ec2733296819989dbb33af746fd503d26c58
SHA256e56a9703da5780cd86ea0ff815dab2b9646ef28f6fecf4727a5bfc8d347d9cf6
SHA512d050c3663f3abb3cce164f97c897bb2c76768acd8ee0a1d66cb1c3a765ed11a1af72bbd7ab0f306c20fca7e62616394f23f1fa020e073dafd352fc96d5e8a5ab
-
Filesize
3KB
MD581761ea940313ca003a3c44c9a30a7bc
SHA13f5f1b62eb99b0b62458107e3ecb1143a682ad52
SHA2568464b80a160e36ef78559a2a48b19b3e24334642c4754173831cc690124dab46
SHA5124945b2203ad2d7742d91e500f66d59254c1ddf8b41e613d228f04a8fa74345e60a28ec0dfa7a1e999fbd857bc7412223289124f23e0ea2b1efabe5bfa1b02287
-
Filesize
6KB
MD5e1342f6648ac238960472fc6982238b7
SHA186c62c6c0d8d759bf4c925e12fe4bb657f7adf45
SHA25636753cca39c7df7c79ff9d4658c26c853b78e6d9321cf497cf139af5b9d92dfb
SHA5124ccd2c221409dd167beccb8f7fa0c8e2a0f3ac69877eb2de6961438ac1b9ecdb3411f2a4d30f70436e4b602960cef80cd60f4a9195a72f76d9ba24212f6083cf
-
Filesize
6KB
MD558f529a789191f18290e7f2405041272
SHA10af4b8e88a4945a0dd5201d4c40da7353ae3a659
SHA2563fa541dc7f72618893780af4afe3983fa86bfc5d491acdc230f2bb3ff8dfd7e6
SHA512025422bd136d494bbeefbecdf21fa2fa7c0b61dc43fe382fdef6b3e4302bf8bea2dfac0fd1e02c00c9bd9f1582ab28c6b8934caaa611484a70b84005ac5c0438
-
Filesize
7KB
MD5e89f65d585ed8c0811c65c3aa1fb180e
SHA1fe0b40419639fe039675b811afbb941436301546
SHA256c13db9b2d468fa904b41d376ff26d2c73dd29f6e7ab7ec02f367c6dc6b3e261b
SHA512fb1749197ba96e93f3d0cfb106435e69eb13618408fda30df21b09cf9cc6417bc26005b8abe80bd447ba2c9f254bb51ac3a84ad9226c77cfbfef4b1c5c0db0bb
-
Filesize
7KB
MD5a172a64babf1bf817f1eb49f83cec664
SHA12a3639c59745a00fdf366d673d263ce235623724
SHA2561fab9a5d3b6d46cccc26d523c9a07e27138bf60394d71e6794c93272e85e9b83
SHA51213f05cca02adb42a34901295c45d068130e4bf2a9a6b67ee416d6fe7f9fe84f35264cb3d182967f1b167e30e7ef10e7e4ae1635b96a39902a76d1f4e9f4cdb65
-
Filesize
8KB
MD54278e0ef121a48b41f193c8cbd2d8a91
SHA1a04b6eb2ad37ab16bb675e45445f684719630f9b
SHA2567a116455bec7c3efe3d4dce70545f9d0b8d2e46c375c8db98effc24ef0e52ffa
SHA512b6bbbb8d4a33a822e9a8c0c4907489aaf125dbf2192f770773fca5290c8be9c961f273fe986b3c8d8d89e03e18b1ec5985053840834c6c0adb8f034f015698b0
-
Filesize
10KB
MD5d46e04dcff4aa86cc708e843a2b95c21
SHA19d0c6038c6690fc46226f084ce70113bf3b603a9
SHA256cbbe72fdd65e115e235726fb5ef7e377966432ff3dfa69e79d6694e604530262
SHA512064f8f92bddda3add1e23aeb7e6499f2cdcdb35385865bc31dc5bdf0dea116864b385704be368c9691c5e8589e7b8ace6573fef35afd024557d519bc7f6c8bf2
-
Filesize
10KB
MD5e932f76063258ddc2dbd66e722d9351c
SHA124a732927d74e98eb287c1fe153fe486110e87d0
SHA2569fd9685355ad379446c30e80fe1efa81024e5829c38695f9b48c862c20a6f866
SHA512b33b33c3038acda5b63018685acffb98ced0773623a3351c2c67070151bf5109585df8cce854cc919df419e09fd2e0cdb3292718e248e3564c809dbcbd16b52f
-
Filesize
872B
MD55716510a3c10286c0d95e3ca8a4442fe
SHA10bc3c05837b52d63818d52c9cfe1d0326837cce1
SHA25631912ee5b1edb7ebc055720bfdfa50795d46a68d65e8ae1af1ef7390cd7ecd27
SHA512f008087231a50939e8d130dc01098b7d3fb4e3d7ef4851c84237128637ca91820b5d9ecffc26533b0fb2fb010b9b7abd29e0d5517bfbb071faccfc7b0216651a
-
Filesize
872B
MD556d7b8516b7a873d604955be5c1248c0
SHA1435a7c8504a4bf2172a543e756822e26902b096b
SHA25673d3ac75571fae9262dfc1dfab658e22ff8e29604509f9721425fee3a7573ee3
SHA5123c1dbf31c359f314000e3f3b4e1dd51f0ff106570e0d8ac5bf5949e456ef072823775271d972d20c510b97c289cb9e132dc487ead4ce2b76f9067af6736d5265
-
Filesize
3KB
MD5bc19792ac44af608e4aafc3d8c4a2839
SHA1fbda855b3858551fd37af1df08a3fad363cbe553
SHA2568cd20d9b5e09657709b860f036b20a8b2398029142b0a1774a08f3d8df26b651
SHA512b29fdab76911755828553030734869f85876524d248605773f2b077fcf61d1b06a225078a729bfdd2e1149a076e9ac9ef4a2b9b1f3165550097f233908375d67
-
Filesize
6KB
MD5d1c5ac003236ceb93fbfbf1c968254b3
SHA1c9ce822ea0ce13dff77f93cc844134ed6a5960e2
SHA2561eea0db436746eea4dde078216993d312832c5ea0569e3068232954c2a408760
SHA5122337504d8f70a025ad86c7ff1a91840ee1b9f464252ce330da5e325c35cc1dd3d6c702d81dc395749ccc3c58ca72236c1acbd7b5254ad7b0459ed5c668828f40
-
Filesize
7KB
MD5f10f61b35a60e6f2eebec2c48919cb3d
SHA1b3b9cea7fab759ff1ff8a6aa43f182c004267bc1
SHA2562a4e8008d08de6b7012909f25454b7dedb210239a40015051ef75c90f551ad28
SHA512e357bf12853a96f90645984057be9e0643988e5828d64d9c89b44045183b5f35d19acd6f591784adc938d6726bacc250465a1b15269c078c3ac0c376712625e4
-
Filesize
8KB
MD56a9ca22212444fe8207a4e82f4f38a4c
SHA1144353f3003d49309d46071df4a2fc83f5f93867
SHA256a5840f0b62dc084e73c805c478ac07e26ddea60477641ec449ada0595dec731f
SHA512ef680283b5d5532263129ce3f9f64b710fa02f83e368a06cd54194d35dfe643c2830f89728130d787da1afe5ab7bd0c448bd470ce4b128515c3f9adf909a27ec
-
Filesize
3KB
MD58198c1522b0f113fc2935a14f2acadc4
SHA1a25276af446ae33c320e6e4e6a9fcdd6bc1b9770
SHA2563dca1ab8972063a50bda879c45a6ad83c8dfcda4c282cb5d666927ac7d79d26b
SHA5122ea431780a2001c3e014920d787eca7047aef528ceb137c540327555cff5ed1148eb574240a816554bce84348d42d0c4f1d7d57b4006cd0b9d31d53d070f80e3
-
Filesize
872B
MD5c876f96de84012f796b0d84bc3dfcd11
SHA1b56d11a7e4276e95e0244fefc0910007b8959703
SHA2560e183207bdd04931960f6f2f3258a4343285e11d5461146f42ca874d38a08b5d
SHA512f0978e005920ef56b417fdd3adb4b5b4f8d4dc1db3d435709544428a43397a5e748ef47579fc1777d6a3465a5d19723308452975cfcb3f7f639a6713f95eafcd
-
Filesize
3KB
MD53936a2cb24cef5d2c877cc058c1cd2cd
SHA1c9c0593a2d15330e208ff5e8aa4bc00ae382c348
SHA25677f04e969e47e6b1f19d25f651e333568c59170c60c20bf0f6a1a61df9e468e8
SHA51275f657cf1dde1ec16c15e82bdeef43518a99ccee799f47f020878d9f317ced703d8a76253d8dcde396a36cae42988453cefdf9be2b6f01423db7d64fd9c7d771
-
Filesize
8KB
MD56b3adf4309b203f4a58b166738157eb2
SHA1d133ec8ead41e0f92dc485023f2786a2bb57cbca
SHA2560885627265753e08c0bd92d88216906e7567bc769f79ca34bb9c7712aa5ad655
SHA5124cd0919b530ef3ff8eb07e7c4734d7db66c84b1db42e69acbee2552c7892f06cd56a74f6350ac439cddcc274f1fd8fcf5c61cce3d0ae465cc0f327b9c2fd1be7
-
Filesize
6KB
MD51f0ea88d44957ffc7ad6c83bd145e1f4
SHA1c6aeb662ea9e34ea3b16e36158805ff5cf43ff83
SHA256064d33fd4187381684950c4a289087f94bec76b00e40643ecc352d782a141a42
SHA5126b44b416795fce242303198c271832dfa17bc5018d95f1d97c2d10bf1941d0a4bc11b3125cafebeeb74546961b7bf266678e242136da17226b75f459f56f7ac3
-
Filesize
1KB
MD59c65ea0f7b6fd312ed80dab83310e439
SHA18d1a40c1f65f8d774cbfd6738a60a556cc4975f0
SHA256746f0aeb474d73fdce4e144a3cfead3d5cbde3b6a8ef5f13bc905cbb586d8bd0
SHA512203107cc0a1b390f0378cf63cd63644cd17a9330359e494ce8102d1ae61b18484bae584b2fc98edfe7b92276cbd12fd668d99aa631500cfbf771c9596a86c80d
-
Filesize
872B
MD505fed2a33e45b5ff357ed2f7e1a0fa13
SHA12aca572e6071cbe2061649d409368cf52cd34548
SHA2563d192aac8d67bc8265ad939522964816e3c8b9047c75f148b126b81faac50a19
SHA5123bec4be125d11d6230049f23b97e836c44313f476c0afb17818b39a13a632fcf57f1d6355a006933cec498422020758a3b7a14cd548a55b5d8409bf4d5f1deee
-
Filesize
872B
MD5a910ad834210298343ab7f80a225afde
SHA158f4d6e64d0ab029be5fd80fa265e60777dce8da
SHA256f16b99c4594d626ffc6d139c1b79315a08707ab2cbe5fe3f3adae7df5b4053f8
SHA51292cfc54f05f5ddb92f2f4c187a18e35f44118cdb587809c61b4e22c183d453a15491621e0aaef5c968bf39ee64475030986daf3986f3bf88dbe345de787e2c7a
-
Filesize
872B
MD57fc1dba4a37d11961cababe42fab8e4b
SHA1ac10c992839243fe59b8c4531f81e42ac73403f4
SHA256f01da63869d9d9fb414dc9c4a01697ecb89f39e4e20d64c3bd132079ed94e2d9
SHA5129a309b93e902fd67dc6285652d2fdd7a07d8bf3d9624dd7cdeff46710224d6d8d6ef52c866d50d03be7f9b9454424c78e7e808c96b39e4cea5321d9a76304892
-
Filesize
7KB
MD5969b78aac2efa5039ab978c99f07f18d
SHA13129211f13a50c9431fb2ed64664793c9336280d
SHA2561d353f0b86b6f7e4460942566389ef1987b9558d09d2392134697e6b81d86ae5
SHA512b5e5851772092df7c5c56bcc4bb9319e59398ecb508dc6ed770bb10653cacb18bfa10fea66806aca1953f708d214896dab6e9669f9a6f9473c4a28b303356e23
-
Filesize
872B
MD529f189a06d8dbb830ea702d480e1fe62
SHA19ce2efa5afe1434bd93d0563e0c2412977fa1ae2
SHA256748598c125e5bcbe597a022e3741f8d1d472c17dee31f6db647add14d0214b61
SHA51233efa8a681e0f6ea4282139984470886d7df4046af7c9e176a7452f2f8af5100262aca22f3f4eafc2f602445d24f3e5aadbc69f364265724e14c2b9ac1685658
-
Filesize
94B
MD5a3d525ccdd57293f8c55dbfbab403c35
SHA13d404b5f1c0d4d52a3988e6377e6d5d7aa35d770
SHA2563ea45f19f79e1f8b4754493931142c90bb661ee5a4f36d93165331172e3ca967
SHA512d63cfaf145886161f0ed889c2d8ef26b230dcac97aa659811e3e00f9d4e3c627c64e0a4422d4d052f3841324b1af75b9985f423e6a85a258b303804ca0390257
-
Filesize
158B
MD5b711f60a451a478d62397fc96d645ca9
SHA1d3959d6479f32b451f58c60f93dffab98d5ca9c0
SHA256fe9c2391ee493c1fa9513bce8bc054a78903ba912a7e398169845be9d56b8b98
SHA5127f6ee6e86f37132a07aedd313a1a577eea8f25d3a12af4a20042a66e45acb94a31314412f346d9e905ac213e13a3428c54775d09276985ffbc1baaaa8139c7fc
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\8\CacheStorage\index.txt~RFe697363.TMP
Filesize158B
MD527eb88d4ec7dec093e3c406bb5184ce8
SHA190f6ad85f691f7df55430a74e59091f0666af184
SHA256a287e0e70232b6e416b8e42e7ffa832b27e0d3b4751311152cb5e25aee1290d9
SHA5129fcfbe335224494155ea98497fd681d9d6253356aefd203127f8d5488c1ca11aa62f30427e60b70d73440139a897abe562f3501f11bbd3329059b8a1de986ebe
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD557568101acebec0d0b6da71cae750ffe
SHA1fef13f40e93641a18401b572d2004a0d88c4cabf
SHA256ed8dd56e4b9f5b0a5cd21bce41b3dc5a863e7960e0880dc454124ad84bdf5660
SHA5129a3422a013c8941d7c14ba079e7c871ed23884cefe9d5ccb498acc2503c4745c5cc8ed6588fdc3d51260f7c3bc14f1d47b9747e27def3d40b842f41b2436c796
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e7666cf9-aa5f-444e-ad7a-2dfd6d17db79.tmp
Filesize5KB
MD5b618809cb7ddc8d2f397ebb5df46dd67
SHA1be3c80daceb20d905850bc6a699745489e0452b1
SHA256533d1926481305e079c78721edd82b503c612151ad0fba069688ac5ca4e33511
SHA512980650cb25d17f76f425106182c5c8a79f74ed9a9c1aecb55c1aefc9137dd331d4dc1f47a9048e20c33cc11be244b04039bbd43b4fbeb5d7fd9d758959f46cba
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eded6e2a-b936-4bcf-b519-4aef2e4053b0.tmp
Filesize40KB
MD5bc3683b1dc0876cf2a17a3083fb71002
SHA115b2ec4dcd943c3298a5f11f9a80036d5084e662
SHA256fd1e3e0b5b59e8f4eb28cbc0ae33a6aa91b05a3e87495fe190201f1f190a7101
SHA51265dc199a4e31f76132dbe54ff217f68f624a3a4ad2460dc8f9ff435851b7df10765220285f23d21fe63d5f7b03a035a730ac1a10a031bb28b7693c712a82957e
-
Filesize
17KB
MD55e7dd49773ddb70acc3ffd499662fdc9
SHA1e5753fab4e2aa4ada17336ad0d81acbec887a3c1
SHA25630ce27be7179edad8d9dcc9614427f3376888d3c616f6e684982ec64c0850aeb
SHA5126c101b128392cef739f25e10a7c867d8a32ec818e6d44964b73b5e6fa4e39acaa41eda564a5dc790cc834053257ab1b82030b15eb7d4cbbafec122f265422484
-
Filesize
120B
MD5a397e5983d4a1619e36143b4d804b870
SHA1aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4
SHA2569c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4
SHA5124159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816
-
Filesize
13B
MD5ccfdb3683885194694814921ac4cd280
SHA197e37b300cec836cf1d71a273d417fe15676211f
SHA2561232cd46a3a396999ad60d837e67fcd15a48257fe1d5da5d6d60dbf24f4d32ac
SHA512e918d6d7d26978478715a55d9ba0b7796d8d001c06d5a4d5edadbeeb57dc4a702a783830db5b38858e7d085fda2db0f2e9231371bedc0c70d8b2ab88627c6ae5
-
Filesize
13KB
MD5e923902f9900dfc41f6608c5cdf29a01
SHA18fa13e1ce4b860de60890c20ea2c44749384cd5c
SHA2563f48f2ad69ea98a6c196f24b62ca054d06dddd30080eb4edd69fc6161344af40
SHA51214a95cd7ffe5cd3c429c2453b1182a495f000267c2568945e4252e7e20b92ad9031c5ae3773e7a41b42356aa321315195779f7a7391ad9e885e582d0fd8e223b
-
Filesize
12KB
MD5e6c2348fecca16975f65e2478c3a1685
SHA1462ccf4d5be4559fbf90577e50e257857ca09d54
SHA2563fccb93658e49755cda0f8cc43720da55bdccf37ecb749fddea74ebc812091e1
SHA512ad98e329f53138d520ca4eea5680f3d9c71de8318a871df8cbfe9e00d81ba803d452e84bf938081c438f84fe9bcadafc6c1a3a21394d64991c1d78144da652f7
-
Filesize
12KB
MD52e57b2731711c369d3dac4627d841960
SHA15fb9823083e7ee390e68e7a23d4e071b08332e0f
SHA256298af47c48c0b2ca97c2ae12121c3fa9ed900fd8b5177b6081add17f0502da6c
SHA512c5aa6a24c4d7307a4660efa608081c8f7e2cbb8331d81599f988ea7bd9e857c1429b3dff8450316bf0c85a2d197da90fb724a0f317d02abc5307969cd2a436cd
-
Filesize
12KB
MD5565acd52a7bc417cdcbc11c4cba81a8a
SHA121a6c6d51a5a6ad4af6b19cc26bf04867abef9a3
SHA256b6d376ab32f7dd64843504976d2bd95b903c049471d9947c8394276410890f15
SHA51232d94e654b04d11b618c4ff9f254361e27f4ca9deabe1b8e4785913c9ac2bb67614458041f54cb44e10f6be7cf0791594ec783ee0dfe8923464fef9dac6b27df
-
Filesize
11KB
MD5bc47cc87b4cf6b564f1021f2c9f827ea
SHA1c9895dc35a7ef59b7b1fec98b52d63975673fbc1
SHA256327bc4e8ccfab5768ecf108c1885c688f900dc11485cef77bebc91087b3fb50f
SHA512478f3e7453ff72aab6ab6ddded8be511b6094e77d1eebe10bd7271ef0c7798db466f546599069336ec7ae3137c3c629895ede85b2fbb6dfc8a6186e190f87dab
-
Filesize
11KB
MD5e654edf99e0cbf35ee0b372f8c0e3f74
SHA1c2a612eff0a10a2c09769125065113ba5d0891bf
SHA25612ee6442691cabb27f7e8cb68625989042767cd71bb00c466fd5a6270dbeb931
SHA512e572c04791e304beba57527df29caa3aa06d924f3e9cb9c8e3d64ea58aaf2544cb3fcaac372ced3553209f2ea8fd13ab1c451f789860b36c74c475187a60d5e6
-
Filesize
23KB
MD5a6c24394521b79df4c319d49871eda17
SHA19a9fe2ea9555aefbb7c792b4b63d6132a4b71b64
SHA256a4d19a806fc2a4b31d1d8d0a9f25cc00ae59a7cfc2562f7de71dcc6c31735a64
SHA5120ecb3177914ef35a06d9f636c849eaa144b462f23bd2e2b8a8e7209f7ee047601cf0ac81b202d46a949fab252cbde31c74c845f56d33bc98cd48c646fbbf1c47
-
Filesize
8KB
MD58e3ba647ad239e86e1a3116f7f61d86b
SHA1d2df55b31f85d3335c2f9ca1f26e9e8484790e55
SHA2563fd0fcb4437e6331f304e76fda901420a3198dafa7c8812f2088faf31ce1d65f
SHA512957ea306ada1548b69ca406537855d009bf2337bdbaa380101420af46451b7be91eb4e031d595932381c7560157c16167671ad241b30221aa4d109f5dc7d9ea0
-
Filesize
12KB
MD59e1c0c84727ca8b5f00db21d6b4f3d0b
SHA1963312531b842bbbb37a6934eac75bb2df5b539d
SHA2566e58c6585eb36dbb3342245b889b7d0b8bb2b781127488c79f0675d9ea6b58c2
SHA5128505156056a7be373bbd1950fd24cc10a76943b508518bc73e3ebdcfb3a873a470893b712bddd03a2a0b4602b76335110f56a65882bb1d8ce4c9e59d9b7291b0
-
Filesize
11KB
MD56484a4e2f08e36c1de18535c40fff044
SHA1c13ed7324864b9304be6542851d96c26a39b3a42
SHA2561f47112a4496a1626941f2250fdc8cf6d2f400b4a9afc4827a9b73497a5f0d0a
SHA512ab0d0b87cc221b6659f224caff8ec450400d4c540635fb313add720523c8b1931e1a6938867eb73aebdd9601b1030ceab682395e915a0b893d4d3647da0ab8b2
-
Filesize
12KB
MD5fbfa701c416ac069c3828196ad2f1b49
SHA13531f0c5d31c45cf8bb2fffdd037817ea31344e0
SHA2568263224824c62ef1a866cd9313586745128ae022318dedb8ef725b9c3e934529
SHA512513b2fd8982a10521cf71701334562ba1ec1e47cc5cb51effedb73e093d1fafa834c91f7bd2a02b875cf32ca2e86a59a8676ac55927756e930d310d89a288f02
-
Filesize
12KB
MD50c6ad5a44d0f0c91f5ef3d40637fc0a8
SHA175b8aebf57a74030662c577da33e495ef3d4cdc3
SHA25629b066c1faf1541c6263fd332df72772b99163deda189161d69e46618840d1e7
SHA5129d92cab421be36326471df5127f5563c3e44b5a6ff1d1eb184f32b30de927b9ac6fbef6b71dd81265ecb5f336469f99a4fce45ea841eb4774442e5df18187660
-
Filesize
28KB
MD5474077e4e2bf4c583909fd9b658a6b44
SHA164704b938e9875159a493ca4e04704a46fb084a4
SHA2563307f70c04047d87d6ba2eaf324877fc66c7913d32e79de4937b14546a91abb9
SHA51230c07beb67d4dc2ead52886cf49c74d567822949dd91a8dfb62a335d7f3576822a36071aa0aaca57b1ae7ed729ea35f8544fb14f8eb68c7b14409e66f2c51453
-
Filesize
12KB
MD5b827e06620533567cb95dcb589588b97
SHA108d3a38c96b5904a6ae7383822cfaeddf9142c6b
SHA256777372278516793a4805834bf1e48e59008d1ad21f3c08f4885cbb5c5a0db3a3
SHA512305e3e74725f623df89bd787236dd6c41743d9cfb84cdb73a2cfe321db8738ceb3bb88b9386e306d795ac3728d8d6d74b58a8d408a24ecfd37351b0acbe16621
-
Filesize
41KB
MD5d3c99d504429dc0b58cf09bf390c3ded
SHA1611edda1bef9ad62e19d16e467c89f8564e20b9d
SHA256cb077d638d5f431ba69b4a3522c365ca50717e8854066986a4a05f1739b58edb
SHA51239038ff5402b6735847811f468a36ad81182726254c39dff5633918364bfac2891df6854fe8fbd80c81d6af06030f499f53a17d2b6efa86e0d0616be6cfdd29d
-
Filesize
28KB
MD5853021048cdea863e16ceb2d86435161
SHA1cfba679a9153b5c18ceaa8c3f37de43911099bdc
SHA256a06f597f7b6964b988e4af3541a3cac5637d7d758c2ca7c256e42b22a7219276
SHA5120bb593698740d8ae3cc2f471c2e9cd63650d9ebebbfc8c5787a56ee0bb6aaa688262befb2b2e4fed4f21d60afab304e9ca8558a9fc3beab121f1163543f1fc50
-
Filesize
12KB
MD52461e9b60ead8a622fe128391775ab24
SHA1b42e50d7c0b74d5f900c2e5f6e3be43859152d10
SHA256c7285032dbc6cea26b0478bfdb1d2645b42c974092df0215086db82c347b823f
SHA51223bafe8cdd0b0fe1d43531ecd276d7eaee48c40a99d519ecd5d8e7be978eb0ee09f2a4f1efbb346b747fa2b7efb48e311a3bb974f24f2b497257fb7f04bf7a80
-
Filesize
12KB
MD5c282b1a5ba9e4b9efda9ddb245096d0f
SHA15d8c3ef1ce4804a59d31f5362e2d004751dadeb1
SHA256320a5726d2157c571946ef1215917cda58c26c45ed3004fa305722837399dd87
SHA5129a7a2f6f418b1e8d112a84968b62fd3566030c8e406f804895fdce30ef5237162859158f3920be2d1c208e97423fbe5c74a0aed70ac6b032b17c1f7c7e11bb71
-
Filesize
9B
MD5b6f7a6b03164d4bf8e3531a5cf721d30
SHA1a2134120d4712c7c629cdceef9de6d6e48ca13fa
SHA2563d6f3f8f1456d7ce78dd9dfa8187318b38e731a658e513f561ee178766e74d39
SHA5124b473f45a5d45d420483ea1d9e93047794884f26781bbfe5370a554d260e80ad462e7eeb74d16025774935c3a80cbb2fd1293941ee3d7b64045b791b365f2b63
-
Filesize
29B
MD547d41a980668e9bfae197488d6d56feb
SHA18acd8919b112d637a18e4c2f79f61fd62d2a1e6d
SHA25687c1ba0f3a75480bef554b38abd51d7858bbe2cff07d4fd29162b4468d2b6c43
SHA512165cf9913129bab36c22399c3636960cff235313256262439bea6a1ed78cf80d65690254cc63148e7e13bb515b513037ab6be7d20efdfb12b07985339ada36fb
-
Filesize
703B
MD58961fdd3db036dd43002659a4e4a7365
SHA17b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA256c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
SHA512531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
-
Filesize
6KB
MD5d00d41647ae523afe66aede26614b9e6
SHA15f12131f85c225666b4158fe179aa5e4d8ba8e76
SHA25690c4b0b14a47f68e24b87c9b102f0142b2eee737ccd7b8c5a64733d6475647ba
SHA5120a1019d35c0a28d9891c04787fac1a924bc65396fd2942917baa040b9f6f2cd61a9ff25171404406516e1e09fe130be44a777ec7fc5209f86769355644be5902
-
Filesize
163B
MD5bedbf7d7d69748886e9b48f45c75fbbe
SHA1aa0789d89bfbd44ca1bffe83851af95b6afb012c
SHA256b4a55cfd050f4a62b1c4831ca0ab6ffadde1fe1c3f583917eade12f8c6726f61
SHA5127dde268af9a2c678be8ec818ea4f12619ecc010cba39b4998d833602b42de505d36371393f33709c2eca788bc8c93634a4fd6bec29452098dbb2317f4c8847f6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\D5DFSS0T\version-5e534e6db34e447e-rbxPkgManifest[1].txt
Filesize1KB
MD56eb3fbaee1016d3b6991b0080ad9a26d
SHA16c20d96eb53c3506c54719ea5a065a4a103dfe38
SHA256b15308fc266caf21c4136358ee249e69a529365787133c625ff6bb7cf1d3cc57
SHA5128e8bdfedd81f5daadd368f795f4266c09f7ba5a1f1f0531cc865bca6e0fca0ca49a386dabeed4553f634777404f1c84e4a9abaa6624f804fdb25d5fd50e95053
-
Filesize
119B
MD547fdcd015cc921ad16be93557700fa54
SHA1aec51d6e7432c8a056603793b0f8ef1a065052cf
SHA25654702e7c60dbd8f81ab48d22509c9029df209ace9ea65eb8b8074e65d02b3e7a
SHA512d7cf7f720d3cc3e80634a016e9100cacc7948788a2bcd82fb66f067a08944b2b66dbf1de61dbbb96438bead4fdcd77664057fc6c64cc4d7848d85869e6ea1d02
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\U23Z080G\microsoft.windows[1].xml
Filesize97B
MD5292a283bdecf4cd89c3ad863a28bc72f
SHA118e896fec5f8b3ea2963d0a5cb45a244050c35c1
SHA25609794c6006f357000111d7d13c1c20075eaea58f68df78e118d14b4547835ec2
SHA51271349774dcf41cd9e72c881cd374ffaf2527b2156a616cc064f10f34e7bbf0ea6174916acb2b8b06428f2b2f29315359e66dde317965463ea1eb70fef52beaaa
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133599121607488854.txt
Filesize81KB
MD5c833b3b1bc6f5e4c4520b846bf9ef9d4
SHA19fee9cb5a46933f641533246d44480b7d20e9728
SHA25621cb7efca7cc64a1a1d80801a9395d141fb27328ed9439d867f55056a244164d
SHA512e25a47ed72430cf4cd0c7a0290e6cc25df41994127aa5645ccb202199ab843129e3469e41206066b3ab70c073a40c422811f17a6898178c85a2f346869dd4ed7
-
Filesize
1KB
MD555747b2a6091286eae423c27860dcf7c
SHA1bb0b2a0bbbadfac9896cb889ec93e1bf16f816dd
SHA256de241bf7f38b17b404c69402fd5b7eb361c665ee5ffd19945a0d3ebedd656942
SHA512fad1990ffbee2334299735d34878e28e2585fd466635bab85759c89f5f3c8dcf144b00a1e9abc5c3b91e46adb6b9d96cb89d89ed8d9e6550c6ee8db1018dd917
-
C:\Users\Admin\AppData\Local\Programs\Magic Inventor Factory Suite\skins\ash_inet\v3\img\menu\menu_13,1.ico
Filesize2KB
MD568bc7228549981845d235bf4f98cd384
SHA1a006dd97a6d9e8f279f7feb2bd4cc094e35fafa3
SHA25682e70076db0ad6104d4ae9400aa89d7066783f88615bca86bb3f9d18f25b5f36
SHA512a37bf0f26aaabfddd70dcf65f7d96dec8732df34f1184fb06f48b6176ea7aa6efa7d92a2eb7a9ba84f097e5f730345a665240f7cf901a2d2929b271f1f9f45f8
-
C:\Users\Admin\AppData\Local\Programs\Magic Inventor Factory Suite\skins\ash_inet\v3\img\menu\menu_13,1.png
Filesize3KB
MD54440fc54b2dc99ad935f93eb82f0a610
SHA1c548ec4d47a043b2ce053479d1a5ca026cb10873
SHA256fcd8e155dcf9876051c3220878c56c7cb1081bfcb77e396ea11ac9e03db03bd9
SHA512ff3c0d3ffb40139544d8e1fc2a367b585410602774fe6ed42dcabce715eec2a1760fa910d9a9e4e3c4c3342a5e6b156a45ead8680bbad275af848bb8e962dbdc
-
C:\Users\Admin\AppData\Local\Programs\Magic Inventor Factory Suite\skins\ash_inet\v3\img\menu\menu_16,1.ico
Filesize2KB
MD59b2c538f181be487694e414bf449c573
SHA1c19c887d5d0e313cfd9411cc9bce5ed2f93e76e2
SHA25663741d0229235f082509da28502af894dca2640577ceae618b289fbb0e5a6a4f
SHA512bbe2e05961f7cf92e8ef6f70ca2db90d301a7cb22263b53fbcd3aec127b0e5a539fe159c7759c8928b58f7b7c31c9f8ba926ad7e3da15896e110d3ce5f71efc3
-
Filesize
244KB
MD5e7e09cdee0ac28c06701a758b434f7e9
SHA17e707725a9a6d13c3c952379d40dd0b5e5c2839e
SHA256ef1bb51608b73217228b47d898e3e3f6cd2eb4363a96465a7b7b607d48fec1ef
SHA512cec21ac74db9b4c03b1315208a0a078deefb90c4fddd255840c766157d690e0fed8ed8cf110a6749ca07febcf17873eceb5ee969fa627955f903ec1f9eefca0b
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\2f0623b3-b6c0-4abe-8bc7-6ed6cdd462d8.tmp
Filesize1KB
MD502c14014cb9542c62b4e539309c6d8d6
SHA11a86cbc6cda0d0b28e01a9293af3ff81e0a244da
SHA256ded3521dac90e0a986083ce947fccce0404ec871a9ac189b6ac04d817ff223c3
SHA51299cb782267483ff21b2d037aba3e15e27aca096afb977afdbbcad3139f4e722ef7260aa678cbffedb1511170f97c2040510fc2bbb8eb967e2af9ddc753faa69e
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\additional_file0.tmp
Filesize2.5MB
MD515d8c8f36cef095a67d156969ecdb896
SHA1a1435deb5866cd341c09e56b65cdda33620fcc95
SHA2561521c69f478e9ced2f64b8714b9e19724e747cd8166e0f7ab5db1151a523dda8
SHA512d6f48180d4dcb5ba83a9c0166870ac00ea67b615e749edf5994bc50277bf97ca87f582ac6f374c5351df252db73ee1231c943b53432dbb7563e12bbaf5bb393a
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\installer_prefs_include.json
Filesize217B
MD5da0bd7417305735cb9d30f3aa2d36ff8
SHA150f9fcb246e35fb791f9e609e41b0e6943fa8636
SHA2560dcd968bb79dc07e84e17d2321662a148f5553789c2efe4aba1eddff4aa2f979
SHA5120a17effea9f14755f8baf081e2c43a8fcdc23f1708cd69176aa2012da4f7015621e04ea940c5226c761b8b6114e2355dcbcf0a83cf5bcbe833ed08c6463abaee
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202405111433561\installer_prefs_include.json.backup
Filesize202B
MD5e96310fd8b32428f87574cda56d8533b
SHA19946400c2e67043e74e0451972a9dcdeb1c8b7cc
SHA25609a87934c362a94bc2dcacbf1f8bf03cf7098fba46c5fc61bd6e7caecbdbce48
SHA51230ac9909d451ad44ba3746a8138180189a3b71aa830d794003ef493b4b9a8450fd023e902287775ae278225b248c85202fb9392a8033507d47331c86986e37a7
-
Filesize
1.2MB
MD57b4df4e24457545b1ff42f4cec035263
SHA130a77cc37c2e448be188dde0544732ad882ede64
SHA25659ff890b16157ea154f671e651847ca11acc03196b1c71c656e6e8276aa5c3cc
SHA51240ed42dde14e18b7cbd3b49def74a95d76b60e8214835fe3b6f606b1121201cddbb347a991d4a87ebe56db758e65913a49df06fa0d7574f3bfc0c839ae83b355
-
C:\Users\Admin\AppData\Local\Temp\7zO08870BBE\63211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14.exe
Filesize399KB
MD5796cbba02beaae7cdffd1e5afa234fcb
SHA1a8fc08c44f9e2fc4e292f6c143ebde916b5f8d17
SHA25663211b9c4a6b331834b5fae7091f8cc38477d5cdb64d95027b3dc33e84e07d14
SHA5123afc9fd9f4c96b84546cedd3e36287d08955e0988a0dd386355285b644c5ee2f0d3e7c4ded70c8fce75ab2fdff2ae6c87d92a6064f4e307f5179309d74611cfd
-
C:\Users\Admin\AppData\Local\Temp\7zO4C5A018A\369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a.exe
Filesize31KB
MD5cc893a8b514d6874965dd29c0c473732
SHA169f56d454e6facba1eadffbdc7c2bf826b01ceaf
SHA256369caea879ce15a7146b74e59ac7e172faa742d053634bfa436637c150c0c85a
SHA5129ce978051ec948e2178a2cbbaf3b72d8367b0b711772ab7c903c34362c0ad848d152fd73babdeca5b86a775460075f526e42ddd4a0062b7b0330b45d495ac9e9
-
C:\Users\Admin\AppData\Local\Temp\7zOC05F5C13\a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c.exe
Filesize3.1MB
MD5395eefdc1a4acdca0e2fe54424c7b804
SHA1be9feab5b3e29e776a711ba0498b44150a3cbc8d
SHA256a16a15300a60c9f0d62caa4c57c03fd1b14a416b317b092e72e46cbc3933f47c
SHA512e2de13ae4149ef9fd2c11d1560cee19df33fc684477d91ce183083c93632cbe7e755e24cbdc0bf3f418d3099f011ab933fcbb99ebe5124e4e9f275bf0298b2a0
-
Filesize
2.0MB
MD585d49a7f82ddbde5598829b755b84261
SHA1c87770057fc05f5e3088f2d5c0f38f4aeae7d516
SHA256b79838b15a988ea1aaaead3ba1353d54085cc76008489fb42f614e96f8b46aab
SHA512cde6caf5817b5a47abdcf89448209b14b28b4e69f5968fa52dbca65a89ee8aebbd786c465ad0683a0fcb5613cd41649cf6c34f550a1b5e63c86ec1f250fd47a6
-
Filesize
4.6MB
MD52a3159d6fef1100348d64bf9c72d15ee
SHA152a08f06f6baaa12163b92f3c6509e6f1e003130
SHA256668bf8a7f3e53953dd6789fc6146a205c6c7330832c5d20b439eedb7c52ed303
SHA512251c0d3cdd0597b962d4e32cf588a82454c42067cbe5e35b41b0548eea742ea25815e5d6830b63c1992b5730a4e6d7c005fb0019aa4c389549b06fff9a74b38c
-
Filesize
5.6MB
MD5265b2e341a0245c17c11b615d1c5a9c3
SHA14e005128286d453209ca9e27ed449804f9ef2f42
SHA256919982000f557525e38476fac219e8c26c5414c1226479480e861f9539589d9f
SHA51242228afe979f51aaad864e0a8faefcc83e2272e7d66b71a40215ef50b70f9ab2785aced0a679b911e89bb0d94f5676d04503e2df39389e2abe5929cb0e0bbc68
-
Filesize
5.7MB
MD584ebaa7c95efeca73a5c0f2deab6a455
SHA1c072da28301354bb4c94f14bb7a70f48552a7f7e
SHA256c626055a1bde4c4a28ded2d8830f8060633cae35b224903ade01c7227d74ff11
SHA512500c7aa69d1b81f23c85f1f5d289958910954937d132179a71b5d0fb17d5bed64a3bc0c2c2bdfbcd739b5a290ae2fc5fe0c7ee2b91597450eddcbf92744edbdc
-
Filesize
40B
MD50fa4b9044c469414e5b0bd60eccd7fb6
SHA1fb0b24dbc8647f4586c2606343d0d9c09b71a677
SHA256d086946a3feb6b0c5b62540d9e135d68ca07dce81f4bf4c4b31f63875e9e8a97
SHA51299d641ba203a5ca68e1b915b6aad621d6303bfea0d9c2f4610804b253aa3541eac98978d6905f9e7c3c78c525ac294e43d839aac418002af30c135ce4169abc1
-
Filesize
49KB
MD5b3a9a687108aa8afed729061f8381aba
SHA19b415d9c128a08f62c3aa9ba580d39256711519a
SHA256194b65c682a76dc04ce9b675c5ace45df2586cc5b76664263170b56af51c8aeb
SHA51214d10df29a3bb575c40581949d7c00312de08bb42578b7335792c057b83ab2878d44c87042bbdb6ec8ceaf763b4fbd8f080a27866fe92a1baf81c4f06705a0c4
-
Filesize
74KB
MD5cd09f361286d1ad2622ba8a57b7613bd
SHA14cd3e5d4063b3517a950b9d030841f51f3c5f1b1
SHA256b92a31d4853d1b2c4e5b9d9624f40b439856d0c6a517e100978cbde8d3c47dc8
SHA512f73d60c92644e0478107e0402d1c7b4dfa1674f69b41856f74f937a7b57ceaa2b3be9242f2b59f1fcf71063aac6cbe16c594618d1a8cdd181510de3240f31dff
-
Filesize
33KB
MD5db6c259cd7b58f2f7a3cca0c38834d0e
SHA1046fd119fe163298324ddcd47df62fa8abcae169
SHA256494169cdd9c79eb4668378f770bfa55d4b140f23a682ff424441427dfab0ced2
SHA512a5e8bb6dc4cae51d4ebbe5454d1b11bc511c69031db64eff089fb2f8f68665f4004f0f215b503f7630a56c995bbe9cf72e8744177e92447901773cc7e2d9fdbb
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
2KB
MD57afaf9e0e99fd80fa1023a77524f5587
SHA1e20c9c27691810b388c73d2ca3e67e109c2b69b6
SHA256760b70612bb9bd967c2d15a5133a50ccce8c0bd46a6464d76875298dcc45dea0
SHA512a090626e7b7f67fb5aa207aae0cf65c3a27e1b85e22c9728eee7475bd9bb7375ca93baaecc662473f9a427b4f505d55f2c61ba36bda460e4e6947fe22eedb044
-
Filesize
44KB
MD56e331872b76530558ddf5b0a58571b2e
SHA14f3ef98c954066bebad0187636b3a05a75b6e4f6
SHA25624c5e78f661ed3f4b6290c472cd992e49b6781bb3ce88baae5aac1fc86388dbf
SHA512978ceebf5edba0a93af5b275d6dd3602a012edb7269c7404e5a422ec1cca132c247715af0f2a8df0fd533d5d3550a3416a91a61b5695dcf5d1bb6638023c430a
-
Filesize
515KB
MD5f68008b70822bd28c82d13a289deb418
SHA106abbe109ba6dfd4153d76cd65bfffae129c41d8
SHA256cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589
SHA512fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253
-
Filesize
27.5MB
MD5d2272f3869d5b634f656047968c25ae6
SHA1453c6ffa6ec3a0a25ae59a1b58a0d18b023edb16
SHA256d89a2423da3704108861f190e1633d2100ecc30b4c40bd835ce54a6934887bc9
SHA51241072ef6f382cf6d4d97ebc2a49a50a9bd41b53508a8586fd8d018e86aed135e8ac2cdd16bbf725e4f74f14ecfcf49789d3af8924b6d5dfa6b94dc6bf79a0785
-
Filesize
1.1MB
MD5143255618462a577de27286a272584e1
SHA1efc032a6822bc57bcd0c9662a6a062be45f11acb
SHA256f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4
SHA512c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9
-
Filesize
2.3MB
MD5f743314bda8fb2a98ae14316c4d0d3a2
SHA15d8f007bd38a0b20d5c5ed5aa20b77623a856297
SHA2562113c6d5ef32e3ded8b4b070a6d0da8b1c11a1ba5e7d7fbfb61deeeafc9d451c
SHA512f30af84df2eb2ddf3ed414c069f0edbcf42110f14e0aed61c0f28d6bca0f1c7785db1d53f90686ffe1f543d610b0f5f223c79160f7245924c38d99e6ffe2321d
-
Filesize
5.1MB
MD5472dea5069dd8ba24cd0379d70a78f4f
SHA1b543293dd4cf909eb0ad3477e718bcdcbf0dadef
SHA25680640139d8a69161417b01b1e21618921096ec5ea25658e1a56de9a6b7941395
SHA512fa85babaa4a7ac60759da659ef22348569cf7c653d6c865b3c8277dc1a4a9d7edb356a621b218a9c1f39b48ac7f01dee902a046a57b2bc8b9ce6f424051bf6e4
-
Filesize
2.0MB
MD5c79e3df659cdee033a447a8f372760ce
SHA1f402273e29a6fa39572163e4595e72bde3d9330a
SHA2567d09715c4e0735a0832bf81d92d84600df1815a2ba451586bd25eb16f7c450a5
SHA512490cc30ccfac209f1f5332ce4168b0dc849d7e4d86f3c198ddd23b39ddc950001928a1e071c2ace74c4710508265c0872adb02e3f068e521d28ed8b19ea36492
-
C:\Users\Admin\AppData\Local\Temp\nsc97E0.tmp\tmp\RAVVPN-installer.exe\assembly\dl3\41e4b240\51ae2e68_b0a3da01\rsAtom.DLL
Filesize157KB
MD53ae6f007b30db9507cc775122f9fc1d7
SHA1ada34eebb84a83964e2d484e8b447dca8214e8b7
SHA256892a7ee985715c474a878f0f27f6832b9782d343533e68ae405cd3f20d303507
SHA5125dd37e9f2ac9b2e03e0d3fd6861c5a7dcb71af232672083ac869fc7fae34ac1e1344bdfabe21c98b252edd8df641f041c95ea669dc4ebb495bf269d161b63e5f
-
C:\Users\Admin\AppData\Local\Temp\nsc97E0.tmp\tmp\RAVVPN-installer.exe\assembly\dl3\758fb99c\a2e33168_b0a3da01\rsServiceController.DLL
Filesize173KB
MD58e10c436653b3354707e3e1d8f1d3ca0
SHA125027e364ff242cf39de1d93fad86967b9fe55d8
SHA2562e55bb3a9cdef38134455aaa1ef71e69e1355197e2003432e4a86c0331b34e53
SHA5129bd2a1ae49b2b3c0f47cfefd65499133072d50628fec7da4e86358c34cf45d1fdb436388b2dd2af0094a9b6f7a071fb8453cf291cf64733953412fdf2457d98e
-
C:\Users\Admin\AppData\Local\Temp\nsc97E0.tmp\tmp\RAVVPN-installer.exe\assembly\dl3\a3956736\c5bb3168_b0a3da01\rsLogger.DLL
Filesize179KB
MD5148dc2ce0edbf59f10ca54ef105354c3
SHA1153457a9247c98a50d08ca89fad177090249d358
SHA256efe944c3ae3ad02011e6341aa9c2aab25fb8a17755ea2596058d70f8018122a4
SHA51210630bd996e9526147b0e01b16279e96a6f1080a95317629ecb61b83f9ebee192c08201873ff5df2de82d977558b2eeb0e4808667083cd0f3bf9f195db4890d5
-
C:\Users\Admin\AppData\Local\Temp\nsc97E0.tmp\tmp\RAVVPN-installer.exe\assembly\dl3\fafffd26\456d3168_b0a3da01\rsJSON.DLL
Filesize216KB
MD58528610b4650860d253ad1d5854597cb
SHA1def3dc107616a2fe332cbd2bf5c8ce713e0e76a1
SHA256727557ec407cadd21aa26353d04e6831a98d1fa52b8d37d48e422d3206f9a9c4
SHA512dd4ff4b6d8bc37771416ceb8bd2f30d8d3d3f16ef85562e8485a847a356f3644d995942e9b1d3f9854c5b56993d9488e38f5175f3f430e032e4091d97d4d1f7d
-
Filesize
362KB
MD542e6e9081edd7a49c4103292725b68e2
SHA162f73c44ee1aba1f7684b684108fe3b0332e6e66
SHA256788450452b0459c83e13da4dd32f6217bfb53a83bd5f04b539000b61d24fd049
SHA51299eab89bf6297fda549c0b882c097cd4b59fd0595ff2d0c40d1767f66fa45172ca5b9693dbf650d7103353f1e1fb8e5259bbcde3dfa286dee098533a4a776e8b
-
Filesize
73KB
MD529e6ae1a1af7fc943752a097ec59c59c
SHA16d5c910c0b9a3e0876e2e2bbbce9b663f9edc436
SHA256cc9bf1feeab1d76221508d6cc98e8bdc1603d5c600c5ed09c108e31b8bd3a6a2
SHA512cc6d55e5fd23c89d73ecbddfa92c102f47f8fb93f2f6a41d2e79708e6a8d7c13c1961dcd07810db3135d2f8ddcbf3535fb3ea3d1fc31c617ca9b10f6b867f9a5
-
Filesize
166KB
MD5d9cd9c6486fa53d41949420d429c59f4
SHA1784ac204d01b442eae48d732e2f8c901346bc310
SHA256c82540979384cdcadf878a2bd5cbe70b79c279182e2896dbdf6999ba88a342c1
SHA512b37e365b233727b8eb11eb0520091d2ecd631d43a5969eaeb9120ebd9bef68c224e1891dd3bac5ec51feb2aee6bec4b0736f90571b33f4af59e73ddee7d1e2ad
-
Filesize
129KB
MD5f1e592a7636df187e89b2139922c609e
SHA1301a6e257fefaa69e41c590785222f74fdb344f8
SHA25613ca35c619e64a912b972eb89433087cb5b44e947b22a392972d99084f214041
SHA512e5d79a08ea2df8d7df0ad94362fda692a9b91f6eda1e769bc20088ef3c0799aeabf7eb8bd64b4813716962175e6e178b803124dc11cc7c451b6da7f406f38815
-
C:\Users\Admin\AppData\Local\Temp\nsh252B.tmp\tmp\SaferWeb-installer.exe\assembly\dl3\1fc629ac\ad5d1b7f_b0a3da01\rsLogger.DLL
Filesize178KB
MD5dbdd8bcc83aa68150bf39107907349ad
SHA16029e3c9964de440555c33776e211508d9138646
SHA256c43fea57ecd078518639dc2446a857d0c2594e526b5e14ee111a9c95beddf61e
SHA512508cb9b3834f7da9aa18b4eb48dd931b3526f7419463c1f0c5283b155efbe9c255213ae1074d0dbe2de5b2f89d0dba77f59b729490d47d940b5967969aaf1f19
-
C:\Users\Admin\AppData\Local\Temp\nsh252B.tmp\tmp\SaferWeb-installer.exe\assembly\dl3\867c184a\ad5d1b7f_b0a3da01\rsServiceController.DLL
Filesize173KB
MD5860ced15986dbdc0a45faf99543b32f8
SHA1060f41386085062592aed9c856278096180208de
SHA2566113bd5364af85fd4251e6fa416a190a7636ac300618af74876200f21249e58a
SHA512d84a94673a8aa84f35efb1242e20775f6e099f860a8f1fe53ba8d3aebffd842499c7ac4d0088a4cded14bd45dad8534d824c5282668ca4a151ac28617334a823
-
C:\Users\Admin\AppData\Local\Temp\nsh252B.tmp\tmp\SaferWeb-installer.exe\assembly\dl3\9a0ce265\dd361b7f_b0a3da01\rsJSON.DLL
Filesize216KB
MD5fc1389953c0615649a6dbd09ebfb5f4f
SHA1dee3fd5cb018b18b5bdc58c4963d636cfde9b5cc
SHA256cb817aa3c98f725c01ec58621415df56bb8c699aaed8665929800efb9593fcc0
SHA5127f5a61dd1f621a539ed99b68da00552e0cda5ad24b61e7dbf223a3697e73e18970e263fda889c08c3c61252c844a49c54c4705e1f3232274cbe787a3dbd34542
-
C:\Users\Admin\AppData\Local\Temp\nsh252B.tmp\tmp\SaferWeb-installer.exe\assembly\dl3\a4a5473f\cf2c167f_b0a3da01\rsAtom.DLL
Filesize157KB
MD51b29492a6f717d23faaaa049a74e3d6e
SHA17d918a8379444f99092fe407d4ddf53f4e58feb5
SHA25601c8197b9ca584e01e2532fad161c98b5bde7e90c33003c8d8a95128b68929c0
SHA51225c07f3d66287ff0dfb9a358abb790cadbabe583d591c0976ea7f6d44e135be72605fa911cc4871b1bd26f17e13d366d2b78ce01e004263cbe0e6717f822c4e1
-
Filesize
12KB
MD5cff85c549d536f651d4fb8387f1976f2
SHA1d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA2568dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
-
C:\Users\Admin\AppData\Local\Temp\nswCC52.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\5894593c\f2f4ec56_b0a3da01\rsLogger.DLL
Filesize178KB
MD53c4180b83cca1278afa4e8f6a3bb0847
SHA161988cb6bf9700e517a4344a793025ed175ab9ac
SHA2564149bd4b31e147776a9b7881b3e40644fc583c4c25e40edc480c996dcb7090c8
SHA5127a2e8f2664573115c9268726abd90b91bc19664e317a7b5afa001ce3d31b0537c9524066a2dc2fb831e3dd34b8c98f1405699701b3e990dcca175f1bfd40d54d
-
C:\Users\Admin\AppData\Local\Temp\nswCC52.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\6de1f56a\008c8f6e_1700da01\rsStubLib.dll
Filesize248KB
MD5a16602aad0a611d228af718448ed7cbd
SHA1ddd9b80306860ae0b126d3e834828091c3720ac5
SHA256a1f4ba5bb347045d36dcaac3a917236b924c0341c7278f261109bf137dcef95a
SHA512305a3790a231b4c93b8b4e189e18cb6a06d20b424fd6237d32183c91e2a5c1e863096f4d1b30b73ff15c4c60af269c4faaadaf42687101b1b219795abc70f511
-
C:\Users\Admin\AppData\Local\Temp\nswCC52.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\9f50aae3\abb7e456_b0a3da01\rsAtom.DLL
Filesize158KB
MD5e5e1626c36117bc60e810c132b99c249
SHA1753c35e07b1453a80ce2260d3c37387ab457c91f
SHA256abddc3de4f7320698394f16406cf59b2cc147f903c5afb8535025ef7ea696000
SHA512145d37fd59b90da9656ff96a2f50db185efe791eafb67d492e9bae3869271c71e493019c08a2390f4aa251f8611c78fa66bca93a8925e3f8f0fa98f4b5278800
-
C:\Users\Admin\AppData\Local\Temp\nswCC52.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\af7f1a46\6b6aed56_b0a3da01\rsServiceController.DLL
Filesize175KB
MD53aef2746ab8bf491c50d946f271d8461
SHA1e89d4c3822f0d2c58bc6114f9e35d99271b2f82a
SHA2567927338f12e8d1835e97fb342874b26d4f068da95bb582fe0ccfde364e769969
SHA5126649901243600f82e481408ed95c2471de50c5266cfd42892a526225de0cb0f9469433d8d87d72f33d0d0c8d31f4f245eaa041fdb45f839433f995763c314f02
-
C:\Users\Admin\AppData\Local\Temp\nswCC52.tmp\tmp\RAVEndPointProtection-installer.exe\assembly\dl3\deaac72c\527fec56_b0a3da01\rsJSON.DLL
Filesize220KB
MD5bd772c48f94ad1012dc608a4b7b55ce1
SHA14593870deb85c3ea9d54f1f260e2ab96effb6ee1
SHA25659733e01120fa4d5cb1e765babf8fefc15d98f7d484cb1902e0d07c4f3c0dcca
SHA512534b4005c4d7647a42da6489a6c6852d95ef0156d0f76bc76b5c6765e035fa86a46e2ce823962b06b4f74c74623155302974d0dc0cdac7fbfb00fbc3579bc286
-
Filesize
1.4MB
MD53a71552f16fd8c2192db0f8972f0671b
SHA11c0c2f0c7b87eddf1f8d63e07298aac8270d206a
SHA256f00d82efe7732b292b97befc844bf98c8c01e975efef7c9b0826a224dcd8fac6
SHA512f558c87b92ab42345ef5ada85ffb8444e9265e643c0167250911802ac60afef25a678bef93a17b0476c56790c294bc0eb9cd783bafcacb6d220eef2c0df684f5
-
Filesize
1.9MB
MD506bb4a5bde8c907dbf05c277a15d270f
SHA110d9673a173ab666a464529797e20d1dd2eaebe0
SHA2561724f1617f764f55b460bd9bca707b0184b76097f32fdc745a7d9ab5a5e09b73
SHA512509e711d5d97fc0fed07f40c4c3a9c48530c4954dd9c5e4f0f6808437cd2ba501dda5f8ab40059d8199f6cefe3e1a0a994dc05c5234459c4b30ca79eab2c2ccc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera Browser.lnk
Filesize1KB
MD563876d016987d3d5905c4cf1f77bcee2
SHA19e1429c38c4737c33ba193252a28572dd684c97b
SHA256d6a30d8cf7067a3856eb645a1d35f776f5bb8fdf600e4c6541302243a86db91c
SHA51217cf9c86ca73b2ee1fde59e316bc30f3edf7b55aeb340480f39600983bd6b1045c0a788d9453a7a180afdf6f4c1802b924942d08d0a42ee9af1549b00ce6747e
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD548229c5c0fb51556c79e867860c12e53
SHA1d78e481c48060d5f21e41b245350461716c7c28d
SHA256f9926b839cc2a92769a7af7e8a69764801d87f64071c974278e37d2b722dbf35
SHA5124e6849018cff9ec5077ad7c6afb264d6ff3c9c88e37b853387c2e1142c625a73f1385f874c315e207438e28cc178d00f912320f542a23a73e57fc65752e1d61c
-
Filesize
40B
MD5a392ad99b91a29fe973cd824e365a0c6
SHA159faf4dd7041a1e7c6ecf28f8c8e21cf380dad46
SHA256977dd9b2431cfd67367e446989de68eab82f13f517a9474892fdf1cfb6bdfc2f
SHA51275812c49e6fbe526ef4116203b4aab107b7a8640a1763f4ff9cdf990ead8d9a4b41385b4fd779fa5f175386f00b24c226d8d01a49df50bc6b029e055906aec07
-
Filesize
40B
MD52f43da9cc10c07d89df2d34fbe326c3c
SHA137c4830f434e807765e55349e3c2de876aded68e
SHA25609318438823fdedd05554c8b800366b8f6ba1d3c6790e8512ab8b508cae26134
SHA5129a816ce3c36934ce67c09903336a5d0091a041de778f416e8894f85e97b4d640f9e456ffbd49f32e97471658372dfb304300758113d3459c4efa6c9b7552a9b8
-
Filesize
59B
MD578bfcecb05ed1904edce3b60cb5c7e62
SHA1bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA256c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
SHA5122420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
-
Filesize
689B
MD54bf803a985cfb7cc723b0eefc962290d
SHA1ec682c1007816c6cec2b6e638e4ffa3b815fa4c2
SHA2569914b226f3c8da503b299c0597eab40a186942fe6de72596a55de2c8e4baf151
SHA512000e3011c8e648b994eaea31e5fcda4e7e05a17802ffb890c2d56541fca72dbed38cf2148afc1579879a54bb159790564a22f1d94f3ae0be52445d1b4ebcbc6d
-
Filesize
7KB
MD5679a01ad9f688edfc3dbd633dbd2d302
SHA187682828ec15905ccc41bfec2ce5e56560e231eb
SHA256f7ad7f0eda7535c0f14fec27c20ef38a09a94da21377e5a1cffa3d339f478b65
SHA51284fb5ca1ec48b73f635957189bfcf7624bd27e50c95e967eb7386da2051dd01584219a661dd81b732b5fa6ab81b30e4ef35aaccf3a6796b0924bd7df5da5ed7b
-
Filesize
8KB
MD56f1b44c800be719a263c5d30b2380de5
SHA1bb6db112db36dd054cb30f732e69fb9d09196a53
SHA25611fe7ad1f26e4dc817296d25b100821cdcebefe904e8cf2f06c61f2faf267787
SHA5123665e5ef190e7e949e3e398766d943a540924c0dc916a52592ee321fb7896830f4e27f04fe7bf70a8f054f0ba7b1ff2235c91e6ad9a71f362a91436d6b07e4eb
-
Filesize
9KB
MD597f84f55bdf9145e508faf83fd1ee1ef
SHA1f24764671dd4d94ffdcaaed8b355189e17bbbaba
SHA2563e98a50b933e1c6e5466fd49d98f13a9adedf689c372ce2b823f09b638439099
SHA512e23f903200e5f935c8052b03578616e07c23dfa1583526d63f4816baca40846a847eff67337cbe927f6f53ff34a1a5fb0beb48e5454d97bd73c9edf3b64f1544
-
Filesize
10KB
MD506b99a9f8aaaf7fdf8d41a96f123d1a6
SHA1be5811364bbdbb47f205d00a1a97a5ab68a5c1f5
SHA256e3e5f8b162d028391b8b3dfa7dadbb16a09ca6f6a19832d14a7e805da6d489c1
SHA5126970cbf39de9b1b2619a4bd2fa43ca78e1e69f37d934e29749b3894419fad9528b97262ad3d9a7989309929f29f4f6d364764b434df90095503f221cd6b218a8
-
Filesize
10KB
MD5f7439c4375e48bf33c724f9487c83f49
SHA1b7d701880e8f452f476bba1daa1aae6b42ac1056
SHA25693fb7d7250912f203d747a121ce7a431c5472afa9272d4722acb272641cc5e16
SHA512ffd41b606f4e469df366ac6be2278ecc4000896e04d25583dfaa3a576eb3937b3725f0ad94ce45add5abd0e4092c9be1f5b61c204f8936f1464df21c22d884f6
-
Filesize
9KB
MD5e01d575687b931653980dfb4439b74f1
SHA188eb094324eddef3a80584ad24099c5546f2b01c
SHA25642f567763a293f303114fcde0cbd24e19d6eae9e68cdeb9bf5c1efe1e37bdbe9
SHA51212601174b070b1bdb8b140cd9a8ad3dd716f1d0c6b560d348b1f2f621ab0eed9d8b2dc30bd3b2d4ca185c6df3b532150bdf6a8754bd17579db957081b0dd3c16
-
Filesize
10KB
MD521aa31a7a055d3a87a8e9064df6094ab
SHA1158b3d8d8aeaa987d8c32f3b23bf6bc744216fcf
SHA2565cd4309d912b4a01b50e72ccc957323cc115c2c9db285d6cc2be0d447c67e5d3
SHA5123c9afcbd4f6433ee94f0a06456a4b15ed01d0265796adfb93c4963506946f5af58c27a1640e4cbefa76d042e973d5d95857b663dc05822cfc1e12d5caf12ab48
-
Filesize
71KB
MD55ec7b3b827ad98007c8b46dc4a53f860
SHA14fcb26f3fbed1d49726ed0446292a1873cef93d6
SHA2566c6348da98fee8113c2026f096316a6bc8a38ae2d52a3588f7959c6221d71359
SHA512b444592e51e3f61f1083ab515f3698c168fc6fa0a72c735cf8593899d0271305697be596b2c7d4b2784d51810c62d48abc498538bc229ee124645220a520cdc4
-
Filesize
72KB
MD5490a9d58fd3530cd9ba49d51f876fcac
SHA1073890e51ca08693565b56089e9eaf4aa74b4536
SHA2563773034479eb9ff146610cc3623180ed1c22cee828517a76081f19e7521ad3c0
SHA512cab60fc30abe306b139f252c98813d3c642037d4fcf081bcddb8da65dcdbe78a72cc75da3a1188f6d140a0dcef00867b39b292ebc8bfb985a4e940e5616c3894
-
Filesize
72KB
MD50c51d4d0f7671954d28aef5de5b5a28e
SHA12d646d3080630716ef61ccb817399338cbf16306
SHA25611ff0f03c6c2c75ce4d12c924ec2ef49de9d49fe2beb0f0ad95099b2756d3d4e
SHA5129a786bd78009058a3556425c65899092bc1feb40f44c9692bf190a8354d324077e8399be6034c1fb861a65f05e8cd43cf392b2af59e9cd145bc071f0ffee4383
-
Filesize
72KB
MD5c7fe846ab3d7643e35e7ca51568f0557
SHA1cb72202d0ece92349acb20b1802f6dcc8960984c
SHA2562e81596f7158defee7ca7e2a7ecb4d9d9a65a7e1742a041095bdb42e4b035de8
SHA5121041f71c58a45843b41c0d64e4c1ea475b5846e8df4172a3b4143aa8e13b1f43c04fcd31bf0158f8e4d9d82be672dfee41bfc391db1dd538f0eba48892c46857
-
Filesize
72KB
MD52470774b5090bc74af9a2236def64b53
SHA16b6497a9a75e230802d7c8e2b8d1c3ca9d930b10
SHA2564a7e189978f0e8fef041b96c9f82619750d3bf4ecea9d8927cb150d82f0ee150
SHA51282148ff430ff6c159625a22d4b8781e4146f5aefe21aa6865a7e7d9aa87c10afc2e9747365f32054eabe6af141e6b104c439868ea03ccf2a0b0c1aaf15b37940
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\c0da5b1d-52e8-4bbb-943e-e75ecfdd0ebc.tmp
Filesize4KB
MD5581e3956bc54255640882c83cb7ff651
SHA17ee62523f6b7b2383468676917093dad19030320
SHA256011133418b52e79baff8f38f4c58de4bcab216d1bb929ce6ff36407f0e05bec2
SHA51277bfe9629cb70e8ba7552ab4ccc570aaeff7cec166124ffb99c3e1d81401ff9765b649a2e30d003e7b80053456706afc073d01fbeddcf23e15f180f4942791c9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize477B
MD57e033f25cbbcea695e35670b8d561ffe
SHA169e3540a700449a28398e5edf1b938dcb66c79b0
SHA25652051badb659c9d24b9b61395d0d2b3391f7f29d236015c2423a418bd7ffddc3
SHA512d9322238dfac94a368478e293d02afc69f887cea08366c6762d04a39874ec9a587c87fc7edfc85b154dc1cd70bb29efbde7e6329665c7a70f673522c22e82ee7
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1KB
MD564c0d975bd4f2f41e6fd31a05cb374d2
SHA1028b48a1a01726c9a0002b3561ff12b5189b9e14
SHA25622d4ed4fdd05d83aa9796bdb94b0fa8dc9dec4be03abc356ce74049e75331495
SHA51265aeb5ef41457c97ac6949191c61cea0f4b81b1e5c9159bb64fa821e0b21efd325ca66214f48d9546d98647381a0b6508d6c285ae82e468e9a70d1be52e244b8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize2KB
MD50128405c8cf6b8c80112999f1b03fc63
SHA1f288fd21509a0d695df896bf3cda5fe724cb54a3
SHA256b8a4be3b8e93183ad648277fe074a35a6b67e26319c7265cc096a981e2f39676
SHA51266d1de3ddfecae117afa47b44e4fad78897d4a34fbf0dcba517fa50cfded739e501234a3e862f769d5a248c2a17274594ad80a0caff38e73891820fd7457a005
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize589B
MD518da8fee2c2e07b00a1f418a48b0039b
SHA10dc36561dc688622ee65a327e82c17e84b8b73e1
SHA256cd0afa8f04914732cab11a76f251fddfb8ebe70707f7e4213514637ebe3cb62a
SHA5129b005212d553bff1ee9041bd0c3fad8cdf8da25a2d27c343ad0c0ad27d13e080581431f6e69dd439770dfa261e8d060e1b1725e4b3e4918e0969b860926137d4
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize685B
MD51a824b19d83fcf88f2423b4a8adf7abb
SHA19a6b1694cb6a4942cb4cf9a7c90356e4b25837c6
SHA256cdcc72a00ca30f794900b978f74c318ceda5d0947d0fb829877b685739a79b56
SHA51256c0e8d8c6b46e56a6e9b6bd9220bcf81a1b9103b27c97f29f57cfbe0625cc507b05948165ec03599938c73a5ae3a00572f05fd2ffdf7c58c0598c1efad279b6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize813B
MD57f8f7eb6d62cc674545593ae3a60c0c8
SHA1c2e1272439ccb3647ec4c1b5ee141786721a8c7b
SHA256522cfcaceb92154c7ae57b0a4dcda57e931b75e89d5e6c0754561eede36e4efc
SHA51299cebc246efd87fb74182d7525f039d4e935dea2742030f29805c22270cf9a725709210e0f544010509a75e775a4918c2b61bde05ddc961cf321d7a1b6525799
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize909B
MD57d555a650244a24f9f01efff326d2bb6
SHA1e06688ad9b8556ee577763c7a93711d3c9968b00
SHA256aa6cc86fc1e0b1137bb30566e9c859ee9a359aa0a8e4d3b7d452602b20651b85
SHA5128e233fd9bbef5eb90d7f15f53d47e147780b2dc25613ca74eda0fffc7b3914c97e55703e8b931bfc4957ce315f90f2a5634330f456b75151f0395db22ab93c8e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize957B
MD5c1576ae25fad4852eefa02cd024427d2
SHA1a01b5ca4810790aaf67d267a3ac5d7c789da62b2
SHA2566ad2c2687b82b68a02cb446784b30431b546e50d81b6a2f67ee2249438941e17
SHA51232828f40e5b170af5a345fdf4f449638d9dbec750ac0efd01ffbdcd08996a0fa0e0fcdf4fd5e9947b6d78996ec2a567664e2c54ed0bce1652e03d3e7428f5b0c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1005B
MD5f30dd2881d11749e4c462463fd4b5422
SHA13e6c1c331a05a96bb891d003fb3e1c5cd6c123f2
SHA256fa9a1675dfb9ac0469c2d62f40e5a1be3ad4fd629f332c38b6b62469b0c67386
SHA512cd0df0abfea7aa7e5aabefd7ed429feed57464a03ea367c20bafb9d55d4c374dbe986ba7dbc0843d20f43ef5c91063cb1c996076bf2b30dc5015276df2386dd4
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1KB
MD59887298048778b7331c91ebf9bd1fc94
SHA12e87b4fd26b8bf39e32146c02d5b3c225775d961
SHA256a7492d0f3ab7ee031e1282f27b1d4f75dd3b1f4075fdf99f77f7b71a7dbc96d3
SHA5122e4a914c0777f5b512a29a2673047905e278aa502e47e67fc6d78d7f49bf5faf281879569b5acb1338b60c69ba0361ca3e76105e0719019f88c3ae0609274e90
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1KB
MD5f62da833970cc75c62f810cf50943ed1
SHA1152fd04140b9f5ac81fc43a583148dae337c1e6a
SHA25602c36e751796fea9b9feab835adb445e1e287ffef4a8607b6b4269f401fd30bf
SHA51282f63155147915d56c66e14532b5bb2fab63885917a31bb138faf2eb7906722e9641d36b39db04931f3219b5423c849a72cc7baafb48cddb8fad9ccd375a74c6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1KB
MD5f09253a8d345dcbfeffc9911f124a961
SHA144a90a5dbc2c5780971553c47a6d15634f317794
SHA2565230cc2f3c058511d1fb250c7a420a72f71a7d1ef69431500b9469dcdfd4ce6a
SHA512bccb025bf2697fa91ca3ed9292faf78e2ed8cef53dfd7ebe03d71ec1b7f3996f9c317018130a758b0d86147728c4b13b26967d6a2b0d5783278afa015c595de1
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1KB
MD5e178e40e5f4ee52155066e75910f6310
SHA15938a9ac1aaef1ed386584f91799c888f8cf6cf1
SHA256734b74c3e12bdc75217a6538a63b89e76683324b51691958a41d2c2d71d6aab3
SHA5127487d39a3e2fd1a81f1959311312f2d7786760c2293632ad7348e79d9a706d2dd39601bd06f2815504ad402db0aca2c75d7cef79393b67289ffd573027845982
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1KB
MD56d6a85ed9ef4f8df6d854b31eaa7aeab
SHA1fb7a6ed60d5a94114d0128395bf543ba9e897f0c
SHA2568ce5ceb65a46f95dd69524973394377f8443529ca8314cdd848f48a798db54a1
SHA5128e17afc989f25187cae167974807d8ee4ee100472353750a871b670be7ba62f5a2a00059a860a8ead400d24357ce3ad61aee95049899c94b5604d991fe913056
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1KB
MD5efd62317c8c039a2145defd9c7389afe
SHA1ffe06dd333166b1d573e43d8abe51af98a58a69c
SHA256c148fefe28e8a8fd91c6a60a810da1801240f2cb0350b0c607768487854ec376
SHA5123beef0583e50dbe8c7a9c2f801b8595be18f63b4f496224c5d77abc86bc6d357d27f7b740ecb966793b3d4d6b408bc15151c63bd508c20a15d502edb4f406fb1
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize1KB
MD5133d28dfeb71812a5cc0b55f16fba518
SHA10e0db74a54031eb932d7f62392a4dada4b370dda
SHA256909b7d90f11c065db8b3facb66a45532235a6fe55c2e25ae3d3dc5d54a5dffcf
SHA512ade89016fdf28989df27f15053ab043e8d3b7f0c8a9290d8bfe221df1294c4aeaddc4fdc79bd5dbe1adc90b36b79fb11feb49d4b7980dbdd979d2e396c29037c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize2KB
MD512f9e872926aa09a790ff831b2f2826c
SHA101d1dce46ff21c3e519aa108fdf0f14ca36facdc
SHA256ff651e8e1950d06b07c6d51812b482f3edc843fc3e18ed4bf03453b9ff7b6b8b
SHA512dce13e8e816a5ab275799fc13e5343b156ed99db7472260aa084319ff914c452bb767a25f5dd07d23c4f5d1d4656f53c22f1c8f3f43d4d2fff1b54c9e7b78003
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize2KB
MD5bc12934f67442ee267932d6a4a89d4e8
SHA14fe102023405b2416a8dfd3a661e905e9b3944ad
SHA256689ad6fefa4a229b4dad93c3e94d366f44e1444b51b7c60bf60f01720364d472
SHA512a7fd6d532341a6266464ed279d6d96809a91b48d2c8db21d183635a990633a39bc145176f441b2c7b5aab2251bc024fbdc01e143ea36f73e403faeb88c4e4e2e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw
Filesize5KB
MD5ba6cb58165be29fa75b3dc3cd6cc7634
SHA12a4fdf332056d4d538809ea3a4c142a45994be75
SHA25611999bd1d12fedefe6b583f1838fc9ceb511b562d40dc8ebac65a463075c14a9
SHA5121daccf24fb80ff3b6cd3301595e6f3886e00fca40b861cdfb4980c3658af3e7b881f272e41771dbaf25b7df1fcf125818a0155b2da247af946ebeeccfc8a1e1e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_249ae4e2-afbe-4b2f-b9c0-08245804b18a.raw~RFe6fbcc3.TMP
Filesize381B
MD59f39bc1b5d7d3c63ade1c3aa4d6f27ff
SHA181f173fa9d3b05a97782a8b1083ae514f8a7e946
SHA2567b9420d38f7a8dbbe5204bac842eb9879072f0bb2d674eefe8553d570926114a
SHA5129c344291ecd0603ad60abc0a373bed10b2d9d2e90d4a78641d0a3ad61d013e59531d7312501c76672f302aa29ff027cabb2dd4661e63a7349489677a959ac525
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize685B
MD5cfcaf0cf48e45254f39fdf974a2eb16f
SHA1d5a836c526c17c94176f96901fbab14c69a3a611
SHA2569cba5c509743088571810376da57cee8e9f37af59ccaaff193b70112adc748c0
SHA512529075713ef0286b0a4c3685328c76bebcac824bdc2e9bfd217188e358d0809f312f9334c4c4d2ed0692b7f1ba019862886f92538150d913c786769d2fc360ce
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize925B
MD553c000b4e3c856a1f4edf569cbe9ce4e
SHA11b934724ab69b03e1334fd930b52d4e9092d81c7
SHA2566a96c749fb798e205b15e2b0d082615d74a32ab06db4cdd08486d08e88723301
SHA5127f0d18e61549601079efac1dc7973f33c2dd523a16e18529925322f9d0e4bfc1716a1be518110b75ae685b7d9091109a4017ff8efbed992d286ebea2805b66ce
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize1KB
MD541c80eb83d463486fffd590be3500980
SHA1f7a38ff88ecf7df7752d002e6a8ab15345ac1944
SHA2563a2ca7244990f4d2657931d47a3402fdfe254e6ae13cc8d8d5a9ff140b9e9cb8
SHA51266122bfbc23e22b767e4840f1cf122ad118c0c4415141f7a1eda200f55e6e986607f3b635e25f986ca7641e1c63d3e2b9495a648bc16d08c37b0b682ab24cd6a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize589B
MD522783a107f6a055b73b9a13719b68aa8
SHA19fab603c20e0a8552d640026dd816a53938a6caa
SHA2569867e25c989ba31af540ab9db9de1904e7a5dc70b9013d0e078db070a4e59b0a
SHA512c6f512b80dc3c4d719877b929e960524fb971a108d80ae6344ccb0b1297406f6d8b5dd6057f7c18fd995c0485f0b9febbd30711b68f571c721b297504162d6ee
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize701B
MD5a455162b676e22ab0ddb5777e3a4b05a
SHA1f38e59627020ff76e7ce0276cb454a4b3353f6ae
SHA25639983b16e23a08d35b05679f5dc34578680245a0446b2f028fe9ee0614e964ca
SHA512eb6b456e580d886a84928bd9c1f3dd3ae836da02bd9b7e91900de74f15df9bfb1b9cf6d8056c46547abd32b07b033df96bb8bd789a3253df026103d5ca461110
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize701B
MD56f2c16f05ecfca537d2189ca2c1bf6c1
SHA1398c2a4bce08c0070660b53a5825a0fe3517b527
SHA2563c1d588131e82eebaf4348147719b47835c7ad09b1d03041c2b3253101aa23d9
SHA5126a172c79ff4738c86e1680efec64e3b0660a0ff6bb274e8985275d850b484c59c9073f8376cd25717bf1eaf1c3f4f1286db5629c7de10d1aae977f921fa4faaf
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize781B
MD581bedf95c205f45e6e6deba4b7e9dbbe
SHA196e934f8dd05202ec26e0485fd03aa5d7156ec26
SHA256a394705fba2f0b7614a98ec76a4c899d760aae249258954423eed9e57a9ec741
SHA512f268e11e1d40f9ecd994f85aa81b26e16d0e1deabb8ec9f22036cdded0f5c7417eaf929549c7403e81424bb5d0c28927e77504aca5c087db4f97c5d69c841be7
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize829B
MD5b457263aceed96cac256b42b4f8b0467
SHA1f0d7d7762df10bb98f563442ee000f347e90063f
SHA25636924a74c65f895ae5a722bebe42b19331c2d37b7253b31e674bfcb577820e7f
SHA512c5fe91b1811db2045cf07a9b460ddb2a54cee63260618190d7f889a6512c3db0989ee5aa536cb2b96b7ebfab74c1aeca6b3de5f5dbed937d2d778faec0d7b391
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize973B
MD5499ee3a908cbd7fc2003978bbfcd4ec7
SHA1b993eabe2281c92cac4d37345454afd8648942b2
SHA2568a57bbf09a649280eb685459b57571b9511f6108bc146c6dbd168a84fce56a8b
SHA51293c39ea0e433c276dd9066f59e4b7ec52de44475b6a3e4ca57810d1ba3ed81768a5d3122b4eff4c64ca4e7c2ab75b4ed53a25bb0e97d0bdf3a0d89d3d7b1b584
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize4KB
MD547c1ebadddca288d8de73ae712e1aedb
SHA1906f581fee35711f1d5224141fe31b59bcc61fea
SHA256c6bda48ab92463ea7533a16147686eec2afa0474d633dab985386070818c1611
SHA51206dfa9bf601f05b2bc89270b7103e954cef36eadf4d0da311d612630e57906b9e12438a73d06589bb7e7bc60e1fa88e83376e9656f9e8c263cea5ff01a73c525
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize477B
MD53285a6a6eb6139448c01787de0fbb1b9
SHA13e21f1eb54cf9ae3dfc3ccd306f187b92532019b
SHA256818684e140c8269bf19fad8ccf48363128ec4f0e28ee3501543980668c1a1a47
SHA512a76e9037eb263c9f76bf58d2286b9784d3029ec8e8b3e3fe90e697c2016362ba2cf5cbbd0a84c03066a685bb44cfbc2c84a2ac5b57b7072619b1ace9883915e1
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize4KB
MD57098db745cb7b59f83fd94af770dae8b
SHA1e03a87ec13066d89e3233d73da0b8af160aa07d0
SHA2568ae4376f5fa721429a73d8ebf58941ba5f28dc7cf434c47f08b70a75024149d3
SHA5127b0e3ecb3f97df9dc459a4c5a81d9896c2d52347e183e97330c943080cf5b74b889e7c94ab6bef12ecab4a39fa527c2a829d6e924f687f3c861ad3a6869d7cf6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize733B
MD527a7de270fbfcf2ac6b2dd0c5262fedb
SHA147b2c7af4ef99ca7a5ef444791d3c722eec7b7f8
SHA256188a7ec7ce7901db494f545347db9c9954f4652ef805305c9cf3872c553d2119
SHA5125163544460323dce608bc3c2becd4e4e76c588be4733e2fb3cca815010949580b98f7d0a204dab666a0f1abf82a979d00ddbcacb596c194eb03159ed7f44dd11
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize4KB
MD5829dda399cb8b7b7378073f5aa90c8ff
SHA19522b7a0ddea27dc70d579160a397140eb6b74da
SHA2569be46f3088b4c48585b5cd4fc43cbf39f8fe75c6b20421360ecf413db1bddc1b
SHA512cd0aeb145e8a1bc50e2288327ebdd203a78abfb64d7e797f760c536b754682dbb70eb20a226f158acc2ba3193cdf8db01ba2f2e44291b63cb6d22dad636585ac
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize4KB
MD5e776ebe797ba6596cb1ab78b28811ed0
SHA1dd559cd7503a2ca0a06467af24d258269307a95b
SHA2563601dc31e8d6a488888fcd470e3c414f229453b3cc8c75a95c3f17f95d1346aa
SHA512084de9e1c41351af3529f711b8bc027c8a6833cbbf4c1bf31eda41a4dbed68e2fbc9f61c9f8523b9ccf61645324881a40ea116efcb5875651b467ce87687dfbc
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize5KB
MD5abb5e58223b9b9b481c76f8d491a3395
SHA19354ac92fce68a8f1e48ff316d439e666e7491f1
SHA2567a89e22b5517f4b175bb3826dc8462cca03a33d8ab8ff00a62ee01ca05d8b8c7
SHA51288397226ccd4e2491e03628efbeac6c70273310eea16a17f699133799ac9728788e9e6af50555dae20f3c305cd929b621fe0ffe5c8ac382acf9367718f0cf9e2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw
Filesize4KB
MD56371bd893ab182834b90a05781e8b4b1
SHA146a052be8de1c937d1c1c776cb27d855ef78a1df
SHA256767bd9cc16aedc927928f30273ed8f8e0c35f0ee270c58f2499b67379079f1b0
SHA51286e240e3700f881ea0de96cfc7e0ab1e29924dc33ebbc71e186ad2984b5e081eaf8c450cd65329da637eebf04bff2fa071413ed44ba7e0c0925b150bf4283e8f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_72ba1e7b-6d88-4923-9fc3-964428da6e3e.raw~RFe71f0f9.TMP
Filesize381B
MD517cfb4f64ac93ad849793b955f33e342
SHA19b13a6e995626f710fac390aa0514ba05a0d061f
SHA256c2d36fa5f5d845b4017346eba9f5cba8adb900a8490aeabf685d04a9283a32ef
SHA512ed4b3b240173cb15f3f4b795e53b2a590644d9cdba3650661ade1de34dd0419562d4024fde73b883fad473946465936e1d0637b5ad547e7a4b1766ceae4ae976
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize685B
MD55ba277493b48923ae2c8293028802905
SHA1c1dfefcb5c401e63b3ca4eeb962e83b4fa2a7458
SHA256c090b00a562fa10875b13c795beaa0180394ac3426d1c6b12e5b299392a3e87f
SHA512610d9cae69692beaf5b571ff6586f6ea1849af4dc221e172c314822ac8f3b224b263ec7a48d2cd648e9ceb66884914a7d2e8ffb612e314a24f2e1e5f62bddc4f
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize4KB
MD592973c5d42ed615bcdf091dbac04a443
SHA18678f0df1006cea7e0e28f43916188a775c0da38
SHA2564a305d3ec1d6c46fa26cc6a6870987f390e5732d7498e90d3a38ccc5d549c86a
SHA512a8b0b90077d20feca63a96fd2f993b882f421a77250ff033577d7b04fee2d499fef302c4a672d27a425b6b485dc7114f676594d57555bb1b9c17be8fdc5d7db9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize477B
MD5cc059a8cd79604e21b41ccd4b2368b95
SHA1f972ad29ec3c13fbf0fcef43396b523401b0d9e7
SHA256f5001c85b05ecb0860c30e4e7d58b0c07d2fce1ce3765739e71ecb67f866bdc8
SHA5123b58f8b9584351fb5a7a7dc601053d7207c842d9e81211061f7f18f7a59fd7b1de696c5feaa6350cf019d582bcd3dc7e54dd3e741d9bb4a3168902de3c90e4d6
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize589B
MD5e9dbc6aabbf2c3d663b027e6b7dc67f7
SHA1cddeda14db37536377980b31410ce26c13bce979
SHA25686bc373de647af00ac4d7922bc732df7852f03540ef610230ebb893e7bc6b051
SHA512a4aff6e7c12d8539201706009d0ab9c498ce5c9117f633fd66612e904e98e300df7100ad8d47f64d57d8e618b4f51c97b7ece6672ecf1b1a6efe703bccd1bc1a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize5KB
MD5569e7c41ef92dda2048e9b8d34d39c33
SHA19b70b8e25c9b8722cb1734a18fc798fa55b39f25
SHA2562bda62fd212f489d5fe4a4a55d0dbeeff7e799b6e5409e66d3acf877632d539d
SHA5125c4468874a8232fd07d6b15cdf989db5a82352147dbfddc65d9c263721ee59dff21e211f4d2914f47c0bfbdd8da9df64194d638981ef5f7f3892ab25f72a125b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize989B
MD5073c74d5635712d7733ea22fa5bc7972
SHA17bbc36751092cc12b8edb2f9e53d2c2e760f9585
SHA2564d2ad794302dc2bfed8e3cf1e5adc2cef9c2c20f45e5140d08931524b1747e06
SHA512a38c2ea3dda48faceab3ff46ea72ab24951d23e58ca28c05bf2f1bbe5dfe590cad005a08a5d1f7acd177e88a86f42d32dfcd7febadd3f47c9b3fb004416d00d3
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize1KB
MD53f5472c8b1df717cdec500ada0f0d731
SHA14fdf3ddc41e21583d01af82acb7e81776005af7b
SHA2561be4ffee3191a50717bbe926da72f7084d79bb8a189bc8a2cbf1b2128ff1fe63
SHA5129c626a7d010c8bf9e0003320a54c00d8337b82b8ba5dbf349709ee7fdd906d4bc5a675d20c5e1b3de6b5b3510c2eb5d1e118f9b1c74309bb55b10c47d69e34b0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize1KB
MD57a7ce9f8c046d06ad766d8b9419e8709
SHA196f2dc7585c70a4486b4149c9a5368fe5b6f4986
SHA256f73889b60b6b9e7dd321d4bc93ef4d89082395b4e00798d74caf61981f582427
SHA5121461eef1130cded236423d4d3bcace9df58e74276886c1e34ac209f1f5468eff328f68d5fecee844ddb328635664547cba96e114a2576873a561fa42e82b4f72
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize1KB
MD5d13f1f369b8e49563eb1374f89d3e240
SHA1cc5b240080c87a6ee7ad7939f3fd3a3510e70163
SHA2566e155aff58a3f5c3f8732bc82e8755eea4aa57608ba1cdd0c08136a2640a11df
SHA512c6793e97a43fb1fc012a187ef81fb9aed5cbb24a29ce132beffb21416194221fdb89337ffc161d64c1b7d50d5e1589f257539077cdcbd31cecc4cbe88e528352
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize701B
MD5d364e4a1e4853531cdfd7fb230b47c7c
SHA19758e4fe80b96529d3d105268384973e6012a9c0
SHA2568e3892ec563c49b0b2bf886003a454ed32d29a8d86d283e3f04b618261547036
SHA51203841a68a29bd7e14602c1d3307c1df9090c2f08464f0cf9ac75a0e5dec26927e0113650a497271a4260ebd77c5e522c9ebddcc6a6ffa36d4868ea05edac7555
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize4KB
MD533a9dbe336c0f895aab94a397b2014b4
SHA1a51690e3757ef70e0b644da2960f7e9f8cad35b2
SHA256e6ed40ef877f578513000c9baf21fb7d3eaeec1dbddc2eb78932f91418245977
SHA5121c8faa02e33cd03ee8a74b2054bd209ab4bcff51e81a62e5258a92d28f6ccec217130ff3786453deb199f56e0a142d851255303ae585ed006c7e07b9da737596
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize5KB
MD5fecb26df46e10454920510c364f31750
SHA1e0792595077c734e7655a05b946a001035b6b038
SHA2566f5e4a0ecb8e4952f69159f2cfd8093757e98b86013a147047f168e1454d4d2d
SHA512eeebd8ba49c925ee40aace06fd6aa276389f7e0b0cdbe3652f24304338eb735e922cd83ea15df63a99c1c67af46c25ccfdcd687ee939e8ae62edb695d5a6e1bb
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize733B
MD5ab78a7aaa9c1f3115a26ff2e4dba5660
SHA1ef185a2253d58d7d557a87e0235a736ad5891704
SHA25687b665d213de6fa00e54c9a6135946ce2f17907fccab0135571150e449b8e6f4
SHA5121cf37ac90071f001c2e2196f4ebff47c60506e827b9faedcc7de5e4bbdca0d7459bbc947f001de5a987807f4a180c507dda2830ad6a1f92a0b4317a90e932b44
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize781B
MD5ce37cbf6009f43386476714b5c73a123
SHA14ed2498cb8e66011abe0f5950b00f35093c26fa9
SHA256aa39385f9d5298bf1508be239bae9cfa64d197c3b3e4a0254108b898052556d6
SHA512aa9a35a430340872e81eef9aff87d2d71edd740b64a374cda1e378e3562283e7f189303083c249d6b2f40c8a6516082d600ce285c2a4dfbe8eda9e38674a28a8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize6KB
MD5fbe5600cae6da7dbdd82dc576646f21e
SHA11d23402f406b10ba3d6ecca52fab4e671e921391
SHA2561cd8542378a394b6005b790a31b46794487eec3599764207fc3b464c6270eb18
SHA512366da09b4b6f5b6683bd948249d82cddca51f94bc5f0504c34f132fac29217f474a81ba3cedbf688de95fc21dc106b88eb211d6419809ce442019b3cc9aa39e4
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize4KB
MD5451a04ea8754fcb228df63b5cf8e922c
SHA17f3990fb37d61fc7b0e3fbdbe60dbd6f846ac211
SHA25665a002bb74b38e50e42f4ea327c81f45e0bd997d774c3ec1a94071386e08771e
SHA512504fc5c776dabda1cd1c2147f2d07b381f442bce20be95a6aa828ff4bba0412dc0d6219b07b916ab3d9e4a082b7612be35b86f946975622b06762a15c4a63328
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize6KB
MD5b6beadf66843f26a57e526d2a8acc3b7
SHA1840bd2e03957526e31cd433cc2e4db1283a61d69
SHA256a5d88197776d0ec879affb121dacd73f8f7cf00da3f61772164ffd12cf27a1ab
SHA51216d0d8ec7a5eea7b0224980b403b6ae2ed55933450c16c3f759ebd6c8a09f709c313525248e11858717a378ca96a75f17b9a300f8b473f951f55520677bb4876
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize701B
MD5c16766b885272f4ab3a980dbf91e216a
SHA13b555b916cc9ea1176cd871bbd48b687900716e8
SHA256ddab93c26ff6dc26178847fb5aa42a42ba88c26e270edac4cdac3b2dfa5ae06f
SHA512a6fe0cb2a7b9fcd82d653f4776a5727dc827a05a605074fe483fd610488c6efbed1892f83633e239464c6befe7919c5d3fd760d3dd6a071912100c60538c35b9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize893B
MD5d614116f414d7e24be99497e9ef692b0
SHA15d40ddc19b5863e4dba6abcc23a2c6eba28ba96a
SHA256eed092a39ccda86972e5dba6dced9fc59962525196ca490c76a885207db4897b
SHA5124bdc126c8949a40752896135d1f97a264fd28a231a74fa2d3b50082ac8f145c6f804998340b2479e3a59541ace5eed9c814d1bfe041e0adb17f2cc7768e7d9a0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize5KB
MD5eaf8cdf064b05467b2850ac49556bc3a
SHA15f16b7d16796cad08aeccad76cba5eb94ae874c1
SHA256c86719ec5c6320349999547585e151b5b3fca52fdd7fb8518a1cd1c1faae9569
SHA5129bd6582d2aa0321e98f78add84cd202d9b432cee6c3e087ff95b246a1c453dd3ec63460f2a01938655cca12c5417bc06fc94ea33781326c73d0ce92119d15c73
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw
Filesize5KB
MD5563f4b1e3eb55ce5ef41ad7da5bb2cc1
SHA1edad689df59c9e1f383ea36396af177261da68f2
SHA2562d83538dae2946b0f420ebd16870971c50cda68d32bcc6189ab544c6082e0771
SHA51268e5686126e6d56aaa53ed5225a9c92acdd666ac5778048c59b7cac8d047b16ff654fed9c8ddb2241140b3fb827a3801dcef143a95cd8214438cd3f073eea49e
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_76bf96ff-1dfd-4826-b981-c1375d02f138.raw~RFe704378.TMP
Filesize381B
MD591fedbca3f277e545205c78e6644e8eb
SHA174fd34ef0173803f271d666293a3d5f7a7ff458f
SHA256f877945a84ff9382f3e8add15fb00168ee889faf85ded17112705006eb89e072
SHA5126248f44cd5bf068fa8d3fb17dee219b57c2e004848110beb4be5921212825f1cf054e903adea4c952bc9ecfad4596f18ff3c3de1ef25f683f2b1a7fbb0258e41
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize605B
MD5f4077cb1e8f67407f17d495efef3016a
SHA1063d07267691c799975952d05c0a2aad95fc517d
SHA25685fae37ad7934a44156979ff9af1980f6b3d151d079fa0fd18b6e057e4f5b08f
SHA512d4bd32bb5d2266ffc05c57a6ab37b2921ec68e102639bb51fcb1b3af22537fb01447f4d3025e747bf200ef7e75620542517aa91dc1d2e7094ced93cea8a1875c
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize605B
MD5a0c0a77e38f23c7d6f2bdbd05d7632f2
SHA125cdb6af02f280e91b85873ef7d57419cc65577a
SHA256b4669e3e4032b891ae9a5df93a2db6e638f5c4340b099934524f162db036c436
SHA51261f024bf6076b29d27802983d933f4d45bcdcecd540ce2da4261096b6059bf06f15f84317e360bd6f07990ca5c068a806f41825ae87c7f4778b444c0b27ab5f9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize701B
MD5dfc452b4d93d98e88af90f9a6fbd8ae4
SHA1f23fdc0657015a2a98d31df839addca0b51e095c
SHA256a10265b1dbe89434b5a2c8167f1220a889b64fd524429298c914977d513b82f4
SHA5128fd55678cf1078ebdecd711c27fc8f158f3623e60dea1674882a88e941f4c310c4e0912b03e906ff55a539d96e8a0c53864cf23ed53475ea80fcfc8d10dcde0a
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize733B
MD5bd8a63f82364efc6b179d4126952704b
SHA16bfb149b884450d2b4e8c91b3f2bd9934ead9864
SHA256df66e01e6648b26369201b80df87d67d88258c896ca5266bdf1116454a5d9caa
SHA51246505e63f130f60203bb942bab673aa7fec85032d1f89625c1448dee9eb4616bf6e4313ef1fee5583bfe28e1393a9f9d4bf8b119f31c58326639857ef4890ff9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize781B
MD5a2af42e2e465fae8bbafe2285c3a6208
SHA1df5e7eb7eb78343bc9abec5e45fe90f9d853dbdd
SHA256dc300174e7b27fc98ed8582301ae3e422fe9a4e44398de594d8aae3750e79969
SHA51211c3c0553d02dacc4d90eca8dfc163cdaa46af04e33b7e8566e83f72cd86b0d38a121ac1ba9ecafade7c6734738fd6fc5055759b77af5670f39a73030dc15c51
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize893B
MD5eb7061e68d5323826f6c4f02ceaca391
SHA1510caa2a3b9d47e2b6c9f589154b7e82470315ce
SHA2568bf43536ff52ea93945aba8ba0af44041754c7343f31354db22586892d77ef47
SHA5129dba8cbd444cc4ad069083d2e8e7c21b0bf3a787f78df1838d0b1c6fb504be95795e945a2addb5df1d53af01e3ab5ae8bb5d889f1ef0f78c63d55e914b2f779b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize4KB
MD5a070708012eacf3af9920f1df80f4f08
SHA16b30e17dd5c781584798f88e8a77b9dcb0db2819
SHA25656f96650074809d8e5f0c10cd0cbaaf1179ef2adbd32d0f7da227f9217b1506a
SHA5121c6d62e4d42b376ac6a4d02ee461e2a1928780463a3dd8c2a46ac544187ab22763b566d5274ea7494754ccc3f76dd87b22d5ca5e81506dcdc1326e8538b7d2aa
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize4KB
MD5b3d0fefc561e9083ab7a22072450688f
SHA1cf22ca808bc11645f24464a085222575aff2da79
SHA25688f3f13204bde0e911ff5dc506720bb5ff0488adcf3b5146bd05e1354e822e8c
SHA512bdc1e2183b8dc3e7cd1d1198ffa0d3c44753698ce84c30322971a43cd78d1c3a5bd69d4ce2cff06795efea829b6a34eb57462fb9644e4948751af19084fd270b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize589B
MD51b4f8fbaa08a50eb552a23f9a83cd9b1
SHA1ac5578e2f9a8ca8a950f05cc5c772be15f683166
SHA2561af7f6b298b8c0c0fd8f34be188e796223c21b2db5c4605ab9639e43af32f34f
SHA512bacc26868fa3c8c97d89d21486c3c3bca3407c591f275a145edc5a56052f38e65c9b21af1e2a30151374dd39c06e1c8190a105d6c5ae8ee143aec5c4fbdac863
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize4KB
MD5c578fb3ed5724096d115c6eb074a3708
SHA1bdcccb551388910787d23c8c1427a26cc9180508
SHA2562a88ab8aac2bba398db99031879953aea73943096a99b1568cefec9e3db15b09
SHA512de0155024747ce9a2bce5c22eaedf14c7d538b69961ff1f61a491cfdb3729c3d4c255e74e42f3f5c7540a8da074ead1e39a02d17c5a0feca3b01e001e158cf70
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize941B
MD56462ccc4a63ac80522b2ca31429c43df
SHA102e9da616ceaff5cda6ebb747b485e4f16c97ca2
SHA2565c1b79283f35b6cda2e8a89906689f433e84606dd3c737810f9c1b616f25963d
SHA5129817e9e24149ab072101bd99dd0a76f9cbffed4d1d1adc3b99490ad27584780a27e4f11b049e0759a31393d457847e0a7db37bf406813f031833f85666d5e7a2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize1KB
MD5f7571f928e417b0cd64ed9df0082841f
SHA11d2cb9c8cdbe227f66948582f98ca1e88ee79b6d
SHA256a8a75cdb4ff1344d4474ad363b68d01d99da1b601824e1b1a5f4d8e420cce0a8
SHA512f4eb56ae1e6dfaebbce57b3fb2a747af6b11c4b130dffae57cb6b643a8055aa9551dbe35736246b84fe65b77006ea1722a0a8873a77a54f489fec278edb4e1d0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize477B
MD5442a322a619dd2e74ba39e078936903f
SHA102daa68bc4006c31317938f58ba9a5a8098aeeeb
SHA256c4072d268ce8008b7c938bf8e7d6c8b2c2ed607e577c473f810aba0b838d4017
SHA5129bacad13a00a1ee048d6085fbf43b786381ca3c7d878762a2f54659f8119fb3f69a00e6fb384b1e7d1c0459b7b6557240424ff4c1c140971de8bafe8c4329f5d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize4KB
MD52b970a78e2922350dfd668b5035d430b
SHA1757c90fcad85272d1302ab10606220bb1cd70124
SHA256a02112081dc0d21fc2dc1fce6669021d7b57a0ece4794aa18c918af08b64a257
SHA5122bc81f332a9f55d231b0118f9a3a3ca4a3cf0d72624c91a9f454c0e72b1a8a7de9ff0e3eec8e8b8bd9ed5359c02d32eb2bb31cfa1c7b79221f96743bffbdd8d9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize1KB
MD51d8181670ec359108dd4024563fd9cd3
SHA177d80ffc760a3eaa9b02a20dc75bedc5a80a4aed
SHA2565165419222f361239acc0b0a28b7db0ff20d16451a0d2f3e69cb192bba106d43
SHA512fac6f0601790ec5a6162de6358c844618870d886acbd2294b923167b90ef9ea5ce148dd86eecd78e2089896b9c67d0423a07843f3301e16c0b575667e1ba09e2
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize5KB
MD505f9e4da750c47eab79592bf52fd7989
SHA1fcc72c52631f83ddb7a4b3d5607963e911607ee6
SHA256376624263a96d98b4a1581fc8ab9fcf0ca839f025a4d81b77c89d30f33997629
SHA51240cb5bdc298a767363bcc7795f8c605e34b1e5c046250da661d3f11e1e4ed77fe37fb90e6907761c0b72ed4d39cd23bc015222b63dc24b4ed5639948f4d6038d
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize5KB
MD52f139036238645774e4c742f3398deb8
SHA13d0be55bb481d6691e10cd7cf34625716a7c3bf3
SHA256b1d43602d389122ccab1929e4933fd04e3ee39ce824474076b2a0804545c8de0
SHA51280352b5d5f843a15f47708152f500adcfb25fe72a6724e6355ed9b65426d397d9f4963aa950e733963788a43f5375ff60e613d458678d28edfd822002fa0394b
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw
Filesize5KB
MD50e644376ce7739d7fdb2806c10f22b64
SHA1004305b18c4349e02f439afb38113e4d951f7c71
SHA256497b032d576d2e3fd97cba3de0aee662db422df2698f36bedad97595e65d0568
SHA512482f74f2b138bb0f8bac1cf44c278e273550f478bbe43fda1561a03431b210d1531354e55d371a3c9542fa8017f3efc90f236fd4b9d4488ae8db6fd549f4e018
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\StatsSessions\session_c2db57c5-e79d-4045-9971-63cc7418f88d.raw~RFe700267.TMP
Filesize381B
MD5092495b81962ae7f9d3a85fcc1d04594
SHA154e68e756baf5154214a2b6c2e225afd94c25125
SHA2562911764a6aa7d543076733415c76b050a89726273ef8239fdc41d2ac49285cef
SHA5126a86050aa9088d08165eb34d60ffbffdb489ea3a65af8a9d1159a8ce18d4ecf46f0a7a156dd55c0d633b034b5ded25f614ef11d4f9abb9c781845ee9e61170fd
-
Filesize
3KB
MD5fca27372b7f447ac210a798619cd84bc
SHA1d52154257a03e2d3e796eddb50a74648fa3b9e3c
SHA256365e286a356eada0645c74b8a100559efc6dbd2b16caa2aaf049d57ea394f4e4
SHA512a14818e0a9b5d7e41d1dad7baeb606c8ee8a39e202b48cea2edbc045791623d8af0e525e7af98b474b6e8737796c8d91aade38f1eda7e835dfa0d4925800f935
-
Filesize
1KB
MD5609f2f9bc4cf541f74afc4f80d6632ce
SHA1a75da71345533dae437ad922f6f45cf7c28b3dad
SHA256f4cfdaef93a615009fdd2ac9e4703c3b2ddad4252e6345512773de7d3b32bd52
SHA51208a780147165e23239c4c99c8f5c773089b3d2df48f7655a032958273029f53d53e367c8a243fbe97b4f87dda0be034b306378aa652974822462f3b85a078f8e
-
Filesize
3KB
MD50b16a3cc9d2fb441b68cf549f73300ca
SHA1463f629cde2d603f80e9bb7d39e053384bfbc89a
SHA256de1f80bd987b812821ffe624ea0585afbb7dd699bcc6a0ca69435c7744df9900
SHA5125ac14c8f1ae3c19a64539c83ef1c7a44ab4041d978275523f685b88110249fa04e261d6f567a0609fc6649a07aa1b62acc0a04aae13c0b93bebe24a0ca1a8057
-
Filesize
349B
MD516b6dd78281ae44b1be0678dba207518
SHA1f356d97f6b965e1beb685bb998c2b978599ae26f
SHA25644308e7e9a5bb5255265bd874b6ee830fab0b126759e5529a1dd43628d3e18cc
SHA512164d7d48094873dd5d49af56ebfae697a0e04d15fee2b51793e14628243c9bfb849ba0f41b931a31815beb453a7a542799eb8bf9c39ff09587697a825b5d095e
-
Filesize
529B
MD5840f68c797064c4afadfd9a2d94bf086
SHA1743c381e4afb23ffdb578410d1c098faafc94144
SHA256eac1d87ac3e0762ac2222e61967895be9b1edac70683496ce20b4c50e97e4406
SHA5124e505948ef40459f020ed757df0986c20bf4640478bf859b2d08a0b1b40fbf2b06e3e56bbaf94b22b680c65aa8a3eb2aa733ee4fe67f0fdd5026f8730b2afc9e
-
Filesize
2KB
MD5e359006ea2d123ac1ad5c365a1bd4c92
SHA146041e50ac640d4b61c21f3e3c23f0291e8284dd
SHA25603ca6b188f955e7001c885951252a29478753a3a5e0d932e7a95dd7fd0127f3a
SHA512f4e6980637837cd872efab569532df0c89deb0df9f21c9b744e1927f75c0ed4869df3b410a4ce855fed4d2ad8fb27ec3620bd6acecd8496ca3e5491a24adf3ec
-
Filesize
3KB
MD565183f17af4fa87223fb6d76ae05d5c7
SHA139ae1d12e03655728cee9ddb0dad29c8c8aef1d8
SHA256f50316605c2256f6398e0b12c3cbb428f6ea91b96364b44a491323817a546d90
SHA5120588a6c888a8b1380f86b117b1b2fca57f5f63a6b3bf7bc7b23c98dd7935190ee20a4bd87b3211a4df06f8713ad00c2a18e969b3aa63d2c5c8ddfa8a7f9d4a05
-
Filesize
3KB
MD5998499a4e5120b5230078b06ac298d51
SHA165d29df71a35367d6408e4c7c581deacdfd041c0
SHA256c34c9115f7b02575cc5d69a4d112666ba2d71562acfaf94d9653c8f2355c4a49
SHA512434813958eec25e1f2ae89fa40a678b0680deb8737ed442ffb79a102f291428dd709e9f0e1379d2bc1f2b2aa3238a14ce8434a9ffcf68d011e5b65b377135eb8
-
Filesize
467B
MD5cb56f6a02cbb2d5658f10de9c4a5a0fd
SHA13aff90742b10e95019a809f2636b4c26eb449bf2
SHA256c34023e870414297dfbd118b5f8faeef4c1d5f0fae177d89a2b0ccfa753aef93
SHA5121ea667d882c4c3032caa51500ae271ccec338dbb6fd318f92760b197ccc702ba219c11ae77a2c02d7d39163f5f964df6b138b324ad32ef3d756457508a3a83d5
-
Filesize
3KB
MD5eec2dbb938c273895849c5274071f4b6
SHA17a51a7bd11f87d18c41b03610b545fafc5bb41a6
SHA2562a6a0426039497427b689e2a48fdd13b5312c5b522c4e640da90a6729e833d7b
SHA512b2cb8f968ebe77343944eeeedbb6e617bcd10db53bd374bacd06344455fcf45d93a699fae5a0e2bc96ae1aac90dfd8e12af2cebcc1da0ec1280006632436dcef
-
Filesize
3KB
MD5dd0a94f8f093da730a25868a9d34fd75
SHA1f56069e163b88f1ddf18837392d67510e89db96b
SHA256e8346891c92a42a5ffba450c6dab3fd8c20189da11bc377942bdd0c8ed13aa1a
SHA5122382869eedfb3a2f9de8f766b39b1d6e04715e83325cac362d89ae92a99480a2278ef65df8bb3e0dd0ab16c616278807c4beacd14c0967c09193fd5eceab15c4
-
Filesize
3KB
MD5ad7226c16f8f69f4113d2ba0c72eb901
SHA16246574174cfbb443a3760521179e3395e9d2315
SHA2568ef9060b927e4958a7f3e54aae15b615cc97746cfab1b88d8884f0860de73648
SHA512f153b351572b5252d44b47d42c6376f8b4896a67e15199287aac0e71a07a99be675637f292c7321731304554bbf8544354d3e8db6d49b4fba5601bce8a7ebe29
-
Filesize
200B
MD512ce5223afa786bb6c99bb02c16484b9
SHA1a9ac6e4ac661b3d2f736ef6d6165f56d7b28394b
SHA2565825549d9412e598939ed41af2f5d09a21f0cf885b115b6f07ac6703abd8158d
SHA512d9699f710fe6961817ce7dd36180b60b7c1a574b637b8becdbebab7e4238bce5c66251d54ce18e6b937431373b3648490c67e101548aa582039643b90c1f7883
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp1620.1.1985495870~RFe700f87.TMP
Filesize171B
MD56e1f084a2bfc384ed1913dffeecc8417
SHA1511d8a18f20aafa7fe274bc3a53fee7366f172a9
SHA256bbf02c23b101732a61e68203e7e7759a880e1295b6800c53dc53aebee0e9078e
SHA512e0a5799516852d5f0d7a221903a5be9356d4f2a8b238249a81e55a0c4d23995ee821ce939ffc28a2efd302be501254a9ffab04789656d1b31e6796d4940d9708
-
Filesize
3KB
MD5daab7d671bd4041e6e26552126143f3f
SHA1bcd1329b2549b0754979bfcc395d26b014318cba
SHA2564c6bbf3d91d5c41a3907ce5073a64f25dbcd7df5f0896a8f127b38f638595c7f
SHA512f55a22dddd5d18946169f036ac9dbbeac58ccdaba92dbf09e4440be363a8a996ff1cb6a7c84c246e73fdb246d70491b43ad29eab4befa5a3316d10341dfc43d1
-
Filesize
1KB
MD59633601b9e89b1a941ef412d5bca77bd
SHA1d67dc9d0e8f9222bf2fb7919e4b45e20c4746676
SHA25615b57b91ad494ae2decfd0382faf7b42b6f3d4d48e4351439e6fef9658ebab83
SHA512a275bc0403f8e46b45ceaff0b940990cc52c5ec8f86f837bae9268022e0c7157a62eadaefa46f2bbd7011abc23f3ecf87051b021664bdfbae691abb0c3106ff3
-
Filesize
3KB
MD5760bcc77b6d1c4c070506552a3e8b2de
SHA13a5409e8c3eed995877b719aaec5b497eed182db
SHA2563c6c7769451bc24e1bf92b03d0321e46ab8fb28c96295f7a9c3c2933c04b072f
SHA51296f54cf3a34de4a2845ffe45cb152eb95a013de259a34a4d5dd6f4c2b6dffe3397ac0cb079bb71ff0d77a8d48a98d74786ff809d141cf2bf3efc82018db3a206
-
Filesize
3KB
MD507da3a68909ab14c2d176b39d13104f3
SHA1dfd2daeb3bc6ca6c8327173affe4c7599acd72f8
SHA256001bd4108248389f41785fe5fed3859072de2adf1b290e063a85b291864caf10
SHA512148633190d58365a1327f0c1365560d62a02c8a7570f914c98542cb6ee33f9f3d81901529ad2a9567929cf9a85100065794327171489aac3a3443fc4a279b8de
-
Filesize
380B
MD5bd92bc75591896431fbbc02768f7e44f
SHA1b2c391dd98889ed5558032e971936e7ad3072c5f
SHA256911190f41e7d57e98ac715918ae14ea55ed3914ae67ac09c6cf330015ba10a3e
SHA51223770175fc500e33c99141d2a25b88078b285a6b9bc307e9daa03998b0b7fe03d8f6788777ef6fd4bcf84cdf87eb3783ce300beca505ad9da9f364fd6a567764
-
Filesize
880B
MD502f369eb4201903c985e978257160204
SHA15f36956b7e712deb08ed61067594a490d01388c1
SHA256e1d04936f18a297026a741cfd2c52fac6ca9969f4a8f5b422937b2fe9ea6730e
SHA5126bff040866476e6ee37bf5c15b4b79edf9f1e2b87e082d180a1a496077fcc5eb0d9b9d7650f8b70407abd875851e062712871390f9ee825c45aec5157c4384f0
-
Filesize
942B
MD5a096c4dbe75cfffeb5be6f8b63901da1
SHA1e717cb1d47c36b595b28e410cc818aca40e6e82f
SHA2563e879f3ece238cb7613cd212cdc9c247d093dc3ae0250bade0666f2eb811fffa
SHA512a1b54c9017ee3de32edf552eb92c19a59d9f438707bbd8a1837fb58bdf28d89af9002ab600c3e868f3c4897f9faf46efb182c10d1df1479f4e5548f93cf7fdef
-
Filesize
3KB
MD512afb15190a8ca6c3742edba409808f4
SHA1762ea14092f8db4bc7906a8627aded1f9f7fe588
SHA256d0ec1b7501b8c8bcb0b52845b89112dfe7d715b295fb9264523a108a122450c4
SHA512a98f948cdf97dbbf35dca7cd48bb31e8b7407ceea3251216b4415c433977887880e49a1410fe38547a0e3295da9a910288403a04925f9b6a41b17c997291af58
-
Filesize
2KB
MD5ba242ac2c6bf51b66aecfb3b0ae63ee4
SHA1f64089e93ae561ca39af54aebabd14341b0963f1
SHA2564f6c5c14a04349edc295e9e7facdfae21f5f9f08093050ec8340bbd3a3806fae
SHA5121adc8c65c3e5ff3ad0e052985c40b5580a6cf3064a52085f14698f0871e550deb222043c0e15c432d31ede11e7c563e8d77f51c55dc9fbca57bf842f17275a3a
-
Filesize
3KB
MD5186d30fe570fcc2cc5e11dc3be61e3e1
SHA10cc72ebc813c4b3484f7c01526d852dd573323a4
SHA25612075dc059cc23f7bcaf3d2ed0c860cf5da95bdfbdc0077ad702a7cbda7ad685
SHA512e579a9b43ce8b1b2ea2d0dd43b5a7857bc7692c6fd84d49007234f72d169eb6388dfb73f41d044184a679319e2f74fb6446683f159116b639ddf2451a46f74e2
-
Filesize
3KB
MD5c17afaf34bb0cdd205ec621331779e94
SHA1d07aef7aa2c52a721ba1b1c7ee79b73a0206a473
SHA256082e14353b79436ba9e9c2b1c9dfedd798147963a25b98e79473ee1b3c1c400c
SHA5122e38be115ebba6380fcd606c0be4eb2ac9d380b87d9914bf09291c3489dbb0492819e440af9411d4270d69d29ab9593252e66eb92cbb65b21654673adfd24a33
-
Filesize
3KB
MD59d8100d7d23d4ec387635d1dbba54539
SHA1a5f40b7af5793b0c3feed648f35215f574a76c20
SHA256b713e9e779ef90716ce2606b532227647f50fb5c09c60ea86d28c273a1aa45c1
SHA5120d9c18165009f0dae23d6846b3139bd6f9e10538ea92ed573f5048a86ec7c45d01d4172bd90526ebfd13f0d2439fc9cd0a0c6e9574fe69927c7e335b15403ec0
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp4548.0.150115340~RFe6fc38a.TMP
Filesize327B
MD5b0c8fa7f7d2b236c04e706299650a8e6
SHA1c729bb79b56c6196d1b1fa8dc88556746f1aa3ae
SHA2565e2794901689d9bda51c2fed902a8100185ce7b8f209e40c26fb8d6ca4e6006c
SHA51218612f79b5016d925f603b0c896bec5c0e23888f1f1a50c5bdf4680190a191ca4fdd272eaa62e10a13d6f581d3138c42a7fbfe97e9a89d83192e25c8804be363
-
Filesize
224B
MD52f487be09bb8fdd6a06570ba09801cc9
SHA11970b13a01b2d8b9e1e06cccc5ecfa762e88e9ba
SHA2560bebd38103af24eab868fe902aba0fb978271ae64f69228ad17d3b80ac25d75a
SHA5126062ab337ebb2f6818981550f7b88d5ce9adf972869384c7db284fbd502781a55799a2e03660c2a897495638060f3f07e3c8c30f7d9c400695ddf72bd2927f92
-
Filesize
200B
MD5e281b451446988d700c8688149be9814
SHA1de5f629a7926699083ba4bbfae7a7e80865a448e
SHA2567096901af9557bc56dfb1169b9ded9b91d5da5ebfdef7d3e6096ac09b7883486
SHA5123772c48389ec5da7447d92bb2769c8040b9456707832844c96ae67ad3690f6bf114e705af8731ac8ec28db849d4cfa8c1c606f2d3d0973c1da4794a90f0e9928
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp4548.1.1264549414~RFe6fc82d.TMP
Filesize171B
MD568bb1c744f6d643dedca4ae12af7c7f0
SHA115675fe016788b72659fdc71baf592821df75397
SHA256c2d01c02fddf3b5a0699024cdc75f2c234b4003ee16baf72a9c2906d926af581
SHA512e4259938029bb8b3c96f4c1a8a6db73a1cf2ad3434f3f5b20a5bce868ff82f5b9eaf58cdf43773f9ebd0265fb1421deda9fba0f0af6c3cc3bfe41e1c50f86dd9
-
Filesize
3KB
MD5eebfab174e85b4aadda869afafd461a6
SHA11f7b399221e337590130a6ab0baa7ca597f8ebae
SHA256062a7295613037bf003d13a383517dede722848c2e730cd1f5e88fcf5ef5b9ee
SHA5123430eff35350139820d11c7176464b8345ce2d738228e1527765800b73d3dee72bddada9f89871ddf8232d8353ac1d6c9c6cbdcb17d00d6a70ae83a7893c1e3d
-
Filesize
3KB
MD5be4b3019707a9597c1d03a42dac53441
SHA131b5605a127b2c975b1e2405b7c7c042d3b4b8e6
SHA256212804b4af3d6c6e9c07e86052c82bdbb613da052e180e294a5f0db2d4608c78
SHA5127084f75901cb3899d4b67390ef999017bbb9003537c84f64bfcbad504a4e8e1e80fe8e55b91a25749cfe65e468eb5705abaa403a82d87eadb854b0d2098e9992
-
Filesize
3KB
MD5efdf7fceb179eda618498636f8aa14bf
SHA110908181b7e175bebbf0d523b88f8397e80419be
SHA256195d09a6682dd63b25277a710cdb25ce13bbaec5805ffced4fe28cfb8163ac58
SHA512a5def27ce979c9fcf43e4d0c3d297f5f22b2e9653a183a5b9e9b122b69368dfc2032c27474a892aaedf41232d0285bba95de86b529b32132c86f0a9d9481d487
-
Filesize
3KB
MD5c9280cb083922da36694f3b2a8db3c17
SHA1a70c6e7b8785ff8a4e94a81571f23add7510cea2
SHA25648682689001c3902adcc5d6f98e2a287f3b847276716b8f89f9733f0d430dfbb
SHA512fe8f7260b7c6f9cd57c8fad702c9ebb59b8689c0c2068b0edebdac2e6405129227c2c75cd822c75bc84e4f5e7fde2b8ee4f7c8b0df5636c8ef0e353530693570
-
Filesize
3KB
MD53c33affd5edb3fbfa33bc6aa5f15ad44
SHA15e83734913e325531e2b35a99b3511a7e67b5325
SHA256f8b065db02bb48a156e826f2e0223b1f2bd2abb7176eab00241ca010381c5a75
SHA51274bd15119870ee0ade8eba2a6dd59fe5b48e24cef67e240230186ff7525cb153fd9dccb01c480d41a74fbd14703f9aa4c201f2cc3b3b4b20fd3ab6cda33e7b69
-
Filesize
2KB
MD5c6f67b05bdd7ab49bf02a680acb83526
SHA1fd93d11d6b77bc69874c05657d87c0111a77e969
SHA2562483e22a0e23ac89a5bf521668619be6e84b7ac0fcd44cc8431a7813a3f35b8a
SHA5124855b8f02a4826c4fa9b3a35e4b6a5472bf3d1beb2308160958312918e269534dbf8fe51edbfe2bdebdcceb7c28a5d8950e05733874e2242f9a994f64ecea4de
-
Filesize
662B
MD52c9166fb2cb7e3882d99541d6179965e
SHA15d479533ab8f6ad571be4d0b22416d1f39f5a798
SHA2568c266aff6185099266ab10d1d86e91c84b17d6d59f16f133fe4db972796f399e
SHA512fc4f6ce5a88544a3b43c1fb09fef5e57e01e799cdd69069b10961e4fdc6e3fbdfe005373ec5f0157cb6c0e2dd21b5134c2f025560fd02c2468afb0f083350930
-
Filesize
3KB
MD53119dce3e0fa92e1130fe30cf9346ab9
SHA1c581908e647b4773d03800c3fe10b697aa7fbbb1
SHA256f0e0dfd6aa2879f9c23d048affe28e8f6190bf450514bc683d56b5a682ae22e5
SHA5128516679b2334cec286d07a65fe8ab0bb0ccdf1197b7a504a2b98776cccb323c2a9b2decccb83a898105a1e9ae560a0ef2a2bcc3486606cba5ed4557c2d2cc1b4
-
Filesize
1KB
MD55098135136231f94e854c009fa02f9e8
SHA1b71418d6ca8efa9e669047b1689b7419017e334d
SHA2564af6ccd6467a365713def79ea291fcbbba6435933702f1c484b0686111aa5dd0
SHA512cb98220c176ca5aa0a448ffa3018d2011bad8fb78f208dbf224fbf393325d1f763bb1040c111477f3c7b6ce395a7f84d602dfd26320947d52cf6d766667d9c96
-
Filesize
429B
MD5484985acde11f2df9b1f350bbd6ca5dc
SHA14f03a3e37da29d8ea63e1cf3c7ca783e55f315d1
SHA25683d499735471ec6de4d657b701249ab03c171a6dcd835c88633386e877fe110f
SHA512de6db5e7f1c36e0017d22063a610d80d1be59f32df7a670d65029752a0debc22c9374f2585c030b7c373bbc3309dae70c6230317f327c9958588bfaa89a7a34e
-
Filesize
482B
MD57818e9bcaebb1acfb61882f55dd0ecbf
SHA1772609ff6715aa69f69d2556206c110e05657db3
SHA25656801154ec14099ebb5ae615bf8b7948bfdf029438eaa8a9bbb409599fc6423e
SHA5128ed10449892eeac5d68edc57566eb96df92ffcf17e58b6d7fef8f1a05ff357f2fafe21d8aca17cceef042c3da2c3b0b3887d8f3391234ca0040f056b187988d2
-
Filesize
600B
MD5e7c30804c9cce993e7c84c0482835682
SHA1d6ec7e1cbd5e20dcf6d2377b959b412394bf794a
SHA256d56dd4fab5910705b3e1bea6367686bab3e73ed48ad2734234ca518a20df6974
SHA5120cc3f9d8c15e6e9a57ee1f43899d89725cc18da141d32288d11f81acd58b62933eb9dea1d2e293ea9134a6f2e357fc74c17d7cf296c471742b5d60087efc6702
-
Filesize
3KB
MD50d3889b3687cea90d75940068436d474
SHA1c6b4cd298c7751bd20a29d175ca5d51524bea67b
SHA2562b2a9e09aa7754736f07420cae175a40014d829b9e92054675e5fcb62176f5db
SHA51258b0de8429940f802a833c26af3ba9b8322826bb4b4e227a0f4466b02c2443a2478b2b26caabe7f0a17b5b83961cba50dcfdd4678ece6d30820f876065c0c476
-
Filesize
200B
MD5ace171b01e3f669797a8fe9cf00968c2
SHA1f504dad607918ced490aa271080e13ef738d694d
SHA2566d0859f2ab653701742c669b780c5afd4c65ec6b7dd93ad6c96a8990141befe1
SHA5123ab70b32cc4fa41ef8990cf94956350733b0ad21a5823e15af2108dccf887346a9e49bc179aef629a6ba5555fe7aa028dcd0898f6b0df1d34012f5f0a61d4969
-
Filesize
224B
MD5f215c0ca7442647009325f6378602ae2
SHA129d4389f8957e473769dce815168c4212cefc085
SHA25626767f1a529f5c01c3a2eae13d1f9c2556320fc194ccf4fb7b47a623942e1b41
SHA512b978efaeb27c3fb28e9b31fe140876cde6c4b830c163b75f584c815224977a7338487908b23bd23b86d6adbbdf2c5553170bd613c04c63c4fcecb6ec108598b9
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp4832.1.1111072529~RFe71fe57.TMP
Filesize171B
MD564c36765a7263ac30b349a625147f889
SHA15906a0f3cf1eef2ba4dca8152444654e8ba2a64d
SHA256648c9cd98702eba53f667e7c649a83a9bcaa11e46ee3ee14ebd9a940f2edce5a
SHA512a1bd43a5b242688d3ad69cb40d0536463dc61d3b45dae88e617793860726f241b55d5f58f608bd787d727b7c1d1a96bbc6e58434ef97e8e17426132caaf59d0d
-
Filesize
3KB
MD533418280d43cf1b1d04aea2d9ff0b368
SHA1f57bbd06ef45494ba1a560ca41fb58c748ab678e
SHA25664761a0670456f621a12c057c41cf57a7fb5a0d6fe7a7c94cc97d012c1977517
SHA5127328ca275afa73cd68cb346e8b1421daa5cbc00ff811b689abaaaa19e393da228fb2944daeae5bcd9754e99945d435f6102ae5a0e6531d50eecbdccb3198b6c4
-
Filesize
1KB
MD5635a08619ad36ee5dd1954ddaba24352
SHA170c6ccc8528052fc5a460f0fbbc39aeefc43ffab
SHA25618f3c6e11446f1a1cee3973d8f8bba6d4d87933e273f97d14bb72cec8a9e392b
SHA512003d7466169ad6893f5bd6f31883bb65c81c1694828f7c5b070864d6e8cfd1c601389c1a4251718f38c407fe975cd711fc429dd4c66dc86d692a3a724cee9175
-
Filesize
2KB
MD592dd5eadc3f927cb3799c7d4548328fb
SHA1e099e9ba261112c076b1ad6eb661d4d990f917ea
SHA25644fd8f69c8a9bc352103b04e75c15e70ab0bc71d0b8dd6429d3a767e12066d6c
SHA5122391dc3195f2221f28b62840a4bcabadba22cb4ed9e7bdb77a0f36204e29c17d8877a895f8aaf8777cdf4c4ee1d6660b881371119922126314fe0ea2062742bf
-
Filesize
3KB
MD56286b5da029d966409ef5bcd06bb2ff2
SHA1c37d5ae47cbde4c817000bd1bd855ef17f47d09c
SHA2567747bce5be2af8a7382d37e5e889a1923eca70ad15b449857d2556f9b50b5afd
SHA5121792a670bf063a6002eecc825b520ace09a84063c0c748db4753efd8f91a5c4b0dfe0654237f258c99894d8359bd20b15d7803d14b9c08a766980cb3fc17d6db
-
Filesize
3KB
MD57a038d67a9dcea8364409793e079f523
SHA16d20df1c8356473e9f94f2629057b357441bdfce
SHA2566d69143dad8e271d9f7ab8aa6df898af401ef6cf4f2909dbaaea61efc15b1ddc
SHA5120d165929c7d17a13ed11f4aef187de09263e379cbedb11881c8351e6e974762eef630cce280355563ae53f570eb265ded598c3bfd8b83209f9157e5933f41f35
-
Filesize
3KB
MD5c64d8b1e2033817c7f1856d59e806fc8
SHA1767eb21dc85a53e594674b02cd4877235fb2b755
SHA25653d8dd3bb8b1f5846f3541e6a94d8b733a516d9c2ccb77bd597e2c0cc975b719
SHA512b44e04ac83f27cac384b869c81408d1f1fb57a58197fbbf178a251cc8d36bef75b94db33ef1076312b0475d71e9ab199eaf4482b09c7faabeeb4e78746558d97
-
Filesize
3KB
MD5ab0073abfd38fc2e7a42b33869680751
SHA115683e3c7d8c94eb5ec9a8e6ef1afcb1bf9dc925
SHA25680acea1102a04e12534f78eaa48fe066d69177057ea4bb6bcc1fbb8a0f93501a
SHA5129172efd93c18a63b861af481234c8e4669858f5dc27d1c066d59ca63894d33841e39a2eb39acc66e5ea5b7f9a00f85e98f31a67c429ef907bbc89daaf22b9f04
-
Filesize
3KB
MD578d7ad4d45ca765f92c8ac1defdfee44
SHA14d802dfe7789147d0cae8a5178a910cb014f30ed
SHA256323fc2e47992beb26616234b66d39d12ef94e715de6d965c7bfe0504aa99a26a
SHA512229d46a8e8644362f5d3fe77eb4bb02a8dc42291ac838ee9bf36582ebb8e02a56c4a6137c2ff14bb65d135c4e8d37457f8e92bb1582aa86c2e4b044b858f6f57
-
Filesize
3KB
MD5bfbbe954926d609b97e1862781b4ab41
SHA1285905cd0cc8faf38791891c7a300402225d2ac3
SHA2563cd8eee2785e287b5140148a0a94e70299498b69f0df5f2a6e60a2c0366ff8d4
SHA512d060b4beee2c3587f30353b94c76c4996fa633f2fec1851842acc860fd684d5a55aa39ca950b62ec8877b2694b6fb120a8da5a2f2c799fe739ea3a5486154dd2
-
Filesize
476B
MD568575191f7f61b629e4cbbf00bb7c7ad
SHA17dc5ee958f16f1ccd8a20c9a134fa6c7fefe23d0
SHA256ae8500d99d93e5985972166120bb52a6f538f940d4cac8299c4c068196fa0a7b
SHA5124a5a4033f51658a959b4d545fc4a320b9b7b2355f968a915c21f6fcf372db02282a7cb4526dab679278fcadb05773f2cd48eab40da52bd2821eca2601593a3dc
-
Filesize
414B
MD53b82ec3efde5433806b1dedb2f3ccbe7
SHA1ee290d076fba774d3cb039165215a36e745371e5
SHA2562a33080597c75aced76a06280394755a0f785a3751f8dfc122fcce9b2f398a6f
SHA51234f7070e1ab7994f90f7ebae5847176d2da5b591464d774c5a59ca0bdc07313e8846aae17ad37c6f41239966ee9ffd786fadd2e08e9f50a20cb0d048ebac6da8
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp752.0.1069387324~RFe704f5f.TMP
Filesize296B
MD5e2e1c52553aadbb620f9ef4f1783ccf7
SHA11bee44c1b95fea03efe79f3eeda4d1811b68e81a
SHA256fd71fc5e4b683f81b895c1d06950114ac9aaaa81e729ed0f7745e30ff4caed1b
SHA5121381118493c7550ded05d9a989ac956d1af1a216b4efdd8b0a46e5d54bfd5c019ce92fc8fd5d6724caee095987f33440b057c8f78f21174a1532414cd434ee5d
-
Filesize
424B
MD53524056ffbed0127b228330aad657624
SHA1a9b1c7fb662b181fa9861746bc26bdddae4c350c
SHA256c38004f4e6a38618b54bd23955489f7cf701825153c118b8acb8aa4e35343b63
SHA512c6cbf5112f9103d7e9118949a6f1cc85a9dd1ea5470bd9608db2ee4e5e9531236e3dc6c2cd9182fa4aa9f306a7bc4975a904a18e6d66970a111fc37ddce98907
-
Filesize
200B
MD521cbff4c0c9f03d9efcdf7c0931d6bd2
SHA187485d8cc2a6714fc80a9ba64a941db7567ba27b
SHA256e330169894ee7da0d6c90df8a24fb5acfa20e77c9dd7a68733f90764c4f59973
SHA5122f93346b8290a05716e35924e47322d83d09f0d0f3bab20835318bd831ea5e93fa3a5cbd1d787445f97f267ef909544ba38afe4bd6aff9861247c77f74f03e40
-
C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Default\ssdfp752.1.929696602~RFe704f9d.TMP
Filesize171B
MD53b97a8a3ac47a2f4956526a598f58160
SHA1de39eade96d24c607bce743f106c0483dbfc46db
SHA25672176a63467f9350434c7ddb67da1b47cc5e2016f3cf1f3e8dca1f570b9de2ec
SHA5126624f5288e4919beeec4b66e58f0f4318e0c715e01f3c77d38c599fbe756809e53f748ba5dedfca6e8f84486b2b11a3c82442f54a70198d737ae43d200c0425d
-
Filesize
2KB
MD5a68a5029a4e750fbe8fb66771c7d4598
SHA14f74739585464cc382d1778c42997efb8c918be6
SHA25693a3f214b77e0f42504f95a3be0ca9f9165b61215c43f6523e1a3919c9523c53
SHA5124cfb8c09a697af069b403028741a9ef7440198beaf58eacd9f6579f8949045655129606db5a8c491b2069dadb84b55207d61ef7646afe1ec0b646ac49e7ca2d9
-
Filesize
3KB
MD57ecd205b5b5222bb95778affaf4c2ba1
SHA1032a6a40efc23e029f8e029fdac02f535052af9a
SHA25695304a4a4bc878149c56895c92f6f5db4fd556c61dbb7c0dcc62bb1112cc0cc0
SHA51268970bb9810d553404f354cc51f556da06997c1f64ec4e3737257e6ad3a149d2633206d035b0c24842477b43c7fb503f491ebc6451178e682de947bc72037b2c
-
Filesize
3KB
MD556a9b93c4ae3664873ac11c6264b3edb
SHA13722e496eec06dbece3b4be8d938bb5146b6c33c
SHA256892dc8e498283976a1c6ed4b2b2e943d3efad4d5b9850063654b2f31113eb525
SHA51222e2a00565ef4aeb152fd3bd333b506534efc1365d6ad1b92399d053a58b61af132b6b675b94a43b5471bbbd1c3c2468391f7006cdb902c63f74fea79678c983
-
Filesize
3KB
MD5a7137e892b712b617fd56088d271b3ff
SHA18eaac92513361142e2a8f4086b5b852ab2e5e63a
SHA256a9f68d82ddb7cf93ca4dd36ec258da9d4498ecf5e1e96fb6759538e81bd3677d
SHA512fae6b4187a8efb5eebbc7e284321d3ac2e8e7e46507263246387b131092ac657be86dbfbb2dc1316453e0c06460f79534eb80cde3cdc99304b1a2ae9eefe4ff3
-
Filesize
3KB
MD5cc01d388889e66b5f0d02585ed9c431f
SHA18402d35d2afc5daca39fe9479a42cf670f2779a8
SHA256f94c40c7911b168c574c55ce72c0a6313112d3f3b1c42f7189f674158cc02889
SHA5123b635e2762e9f4ba18ea0fc1de92363e489e615aa3dee6a75c58a493d8d485f34fc33f340056877df26cfce54272270ed4cc04b48d77891fe7f9fe6dc1925f22
-
Filesize
3KB
MD580f7cd3eef546dfac2761c751a01cfb6
SHA1d86a346f7508300f8bfeef2ffc2c2d1c6ebaaf67
SHA25693a3850900dfaad2bdd4b4de5b69f29490da69f606104a46a6423d3adee3c6c1
SHA5121f25de69a4b9aa1e31416f9457ba770fd9c9506c8a3ff2fca7165851505e3a552443dd1e877bf727d38f25a935b412dc869fe7204a84791639191405cb2e656b
-
Filesize
2KB
MD54360c7280e04fd9ca8814968df9f94c8
SHA105076673a8d3708b0ab26be3a4a186faa5dd7bd1
SHA25659658b9c7cf27f6770ce88bcc8a975ef644f07d798d6cc889a96cb0892da183c
SHA5122a25e7a2fe420481fc50d9352b92e5a3b07d7d47351ef51cd73bad3cf34b2689f2ff6391c90e2cac62b460304f8f34b682985bbf8fb53c352fb6d3886a3e88ce
-
Filesize
500B
MD51ae146c50ad18b67546b0e9c19cd5df9
SHA13015f948a823f21607fd5932e35623491c2d3790
SHA256e9267c50e4c566b7e751edc276735d79fd68d14f2694132c3f63f7f592df8540
SHA5128f75a1957e69039941208c003e630f10c63042a7fe20e8ac151fa45fb11733d87ede7c0f5af8175538807a9d615c8398c38cbb258d92284c67566fbc9aad5659
-
Filesize
792B
MD5e9ac4d59c7b4bdec3d0aaee83fefc0f5
SHA182a54eb93beff2056860bb1002aae773b20e33a7
SHA256620b86b4051de5f6c18d967fce26f192d01a17635852828aa3d4b329a13e367c
SHA5120e5c89ce8b8c21b9289d8bc0355fc3340c27eb79ab2397697ef247ebe5f9b1c2fb57c59f038e42bccbbff4000c02d9e3be70a4234d7a2f1bee4d376c100b59be
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
300B
MD56cfe10055599de73f0b37e05d69a9454
SHA1718c057dc9f0d6288e5c28ef655d12d6b801fac6
SHA2562c73a989c1ef2761f45b0a4ca3e50b69387e6dc71c10de66fc4228c5f232f900
SHA51276b98c31d634db9c5760be82996c8b98ee67b97bc1402a0e5ea0989a270d74aedbdbdf16eadd4bfad9cccfa5ffdcb1df475bd9df9738342ddfcf3523922f2219
-
Filesize
1KB
MD5b324dab28eba376f8391bc345feb019e
SHA13ea4f7ced3497f0dcc95905872b28c861be81aaf
SHA25633aa786aed7925d4bb6369a19ea3637cf590704071af26f79f6e83fec1b37aa2
SHA512712974b72b69c5c76c3a689a8259995afa38225f8f21647412107e9b97fa04879ceeaff5eec6031574f7c1b2fa4d89e1ad70f56f7c20add6519494a5a576cef4
-
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\Partitions\plan-picker_5.29.2\Network\260fdd53-5b14-4367-8be1-d815958844c3.tmp
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
C:\Users\Admin\AppData\Roaming\ReasonLabs\EPP\Partitions\plan-picker_5.29.2\Network\Network Persistent State
Filesize300B
MD59fd17f6a35daeac7919590dfa21f9b22
SHA1d6c6d456f69587361aab4ee5ab38989175f578c5
SHA2561edef53e487ea26620e65c234093ee6a9fb4858abf57013b12dcc9d09598d785
SHA5124afa88a00b2393e007a8a9b58cce712576577a0690de9599578e67475cce9bfaed4a712657a3e3fc07782aea85b743feda262756f38ccb21ffe4e5cabb125d7c
-
Filesize
500B
MD5d8d2c3f204a88ace3e2db8a944876020
SHA12ee4f71986a9b551d7b95074430bbfd632d22802
SHA256710f9e2e69da3820bdf86f9b234d69c518a28c2de158172a6aa2eb41648dd534
SHA512ad2df744696bfca6512b9e4237cf039251143f93adfa6e81d44bd9e0559209816db686e28fd3ed1f1b041183680bb019d21df139b3eaa4a4800a336d47386f57
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN\Partitions\plan-picker_2.15.1\Network\Network Persistent State
Filesize500B
MD5d393bc80091e630516e0b0f0e4d09c22
SHA147c4e4f15e0be14914ab6d312a4ae19db1a1668a
SHA256d333988dc8070dab01b329d0c768e0fd0e3d341d5f92a17b2ff4d2d50aeb547a
SHA512632862e61038833e95dead7a83ecaedbac584f75ce268e8af16d637d3d986866f1d395c9bb90932bad6fa7ab621214a257e627f1195ba149b37c6ea061fa48bb
-
C:\Users\Admin\AppData\Roaming\ReasonLabs\VPN\Partitions\plan-picker_2.15.1\d03ad198-dac1-4019-bc1a-d1e415c1154c.tmp
Filesize86B
MD5d11dedf80b85d8d9be3fec6bb292f64b
SHA1aab8783454819cd66ddf7871e887abdba138aef3
SHA2568029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67
SHA5126b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0
-
Filesize
1KB
MD5142ec3542caca05cc9b56a269f8b3fcb
SHA18086a849472f848622b17a91405aa7a9bb1b7650
SHA256ec57a60035daaccedfa8a9ecc3a0df2f49ecff71c185eda8c4f6b4c313da09d4
SHA512e8cb6e4ed1dbf118fc544c29e7b5cab329704b9c0e0e9185593e7e8366eecd608d11d00879a8c10b357901d3e19b244aa962264510ab6b1e3d6b21b61639d260
-
Filesize
2KB
MD5db319b5adf02e7105f7a0f9064ac4506
SHA1f4554f9ce5f02ef0deb4ee8a1482d5d5fd474b4b
SHA256dd8b1d1f96e1308946cc7d0a69e04cceabec239cbd171f9c549cb3848e1c57a6
SHA5129abc02b0b9aabb537c560cbd8c8cdc0569aa5730e21c54d8e5c7de549bb6c2937625aa188ead854eaa2f17c47a5b724fcec4f2e12362c1f721ba0f873cec345f
-
Filesize
4B
MD55b76b0eef9af8a2300673e0553f609f9
SHA10b56d40c0630a74abec5398e01c6cd83263feddc
SHA256d914176fd50bd7f565700006a31aa97b79d3ad17cee20c8e5ff2061d5cb74817
SHA512cf06a50de1bf63b7052c19ad53766fa0d99a4d88db76a7cbc672e33276e3d423e4c5f5cb4a8ae188c5c0e17d93bb740eaab6f25753f0d26501c5f84aeded075d
-
Filesize
14KB
MD553bde34cadf0f870d0418c9164c6d156
SHA19b8d827883e89d027bcad0d51b86461c67651f7b
SHA256834e90dba3a3a82944143a0ade922e2a402a2310a6bb3ea883cfc290d81eb38c
SHA5127e85d1b22185b23f09d4e4e066ce78a86a7993d1daf69a70b2309890a9c75fe3e697d12c44695d40dc74f3bc060f41187fcd5e0859766dbfc7822ba5f2e4f674
-
Filesize
13.8MB
MD536f8adb499e6f6f9318f7bdb1d2bbd75
SHA1709296223ebc2a31c0f0d37b535b62431c4e5991
SHA256a7d9bb906fbff13c6d394325e32a77d6286711e74611bfc993fc9a48507906dd
SHA51246c41a5300231aa83cc2445e1310d8ae878c590f06d1fc78b0d56e5370acff207fcb3e468666cb920308c9c0966119427f5a940d2849d4babee3806493ad1152
-
Filesize
3.0MB
MD53efad2b9aa26c79a459d42aa9a1f6700
SHA1918375ad488a446ff41c01beff95ade8e2270c0c
SHA25665e5e3734278851e1a014050c720ad104c4f5c79634da72a6f81f9cd85e2bc63
SHA51266fd7fefd2d823332fb70c383c7c8f7826518798716824535b6675a8feb863ecca8087aa2e8777f82944ec1e2533aa17be5f923d390c9002f05ebc2b86cc42b6
-
Filesize
20KB
MD553aefc398dab88e18fd4304261514605
SHA1700b5c7c0b634f727fbf2a7995eb7989cc64ff28
SHA2568059000382390906529dc627a9c2d6aa260740910c5db51c357e203430b48f75
SHA512bf7a7eab64fc3e3e43fcfe54451c127807b435a19dcb425392f510a4935ac889b4be30cf51204c3d6c03c8030bfff548f7e0a2e52964f8f29456145e3e84238a
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E663C78920A8217B4CBE3D45E3E6236_75C1BD04B8F3DBF3882A89F51074A729
Filesize1KB
MD5cb8f440aace270105aaed793e624e945
SHA127ae36ae32c2c38c6c353f326c94d771b4d552a0
SHA2569b590079183833750e49b9a517218f62d9f92ad08ee84c17e71df1c090f1a001
SHA51245d68a8c8d2541be202def7a456ce608053ae1090c2da2fa0f0941cd6a9bb2ac16503822a8c6d32bb775b019348ed112bdb0973cc3f44d290f6ce12ff24822bc
-
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77FBC64BA73370EC2F659BAD977FF2AD_9767A5403B067D539A02E2AD0F3C2C4A
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Windows\Temp\nsbEF.tmp\tmp\RAVVPN-installer.exe\assembly\dl3\10ba56ca\a8a6c903_b4a3da01\rsTime.DLL
Filesize130KB
MD5dca214827f4635b07f6f0de3f54bed0a
SHA123c1ef65b4da7545ac200bab6c9da4e98e167c20
SHA256d1b0cb36f2edbc587e943d855da3d9ada334d438bfdf0aaad99c12efebf040df
SHA5121c665e52f976e5288320b9de4ed5e5c25c97c6517283ef8a7ab74e35816f4408e680417e00282c3590c6b7c77cb4f477f0f89805355a5c1087a7fa1c2d173f41
-
Filesize
44KB
MD53f3a7bcb9a3b11a26aa8822dbc58ab8b
SHA18f8385cd1342977f1262740ce486684b83168cb0
SHA256b40d8dcd7b774574e22626b035a27c574e7d718b84574319b7ada371e2f8993f
SHA512db5baae8c1ad679bd11829f24bdc1e4c3bcb236c317184c1219cdd85770930c9360f5d6aea52e57650770e9b1aab3f6611237cbbbdac53dbee2d6586f7f04fbc
-
Filesize
150KB
MD53351152f6ee87e97682a0a7c459ef614
SHA15312f9da67fcfd573dc5e45f6a7cc35fa463af89
SHA2566e2673687ba029074657f0d1c4410691ee013eff2223d0c7695dfe4f70c62f1c
SHA5122b7ecb22746bf907ae4da891e170226da4f180ade27e41a16e1ef9e11f39e5e35b9eac3fcfff520dbb8a8888a1dbd1ca2459ab58ce8dc44a424c5de7b8132de6
-
Filesize
341KB
MD5a09decc59b2c2f715563bb035ee4241e
SHA1c84f5e2e0f71feef437cf173afeb13fe525a0fea
SHA2566b8f51508240af3b07a8d0b2dc873cedc3d5d9cb25e57ea1d55626742d1f9149
SHA5121992c8e1f7e37a58bbf486f76d1320da8e1757d6296c8a7631f35ba2e376de215c65000612364c91508aa3ddf72841f6b823fa60a2b29415a07c74c2e830212b
-
Filesize
156KB
MD59deba7281d8eceefd760874434bd4e91
SHA1553e6c86efdda04beacee98bcee48a0b0dba6e75
SHA25602a42d2403f0a61c3a52138c407b41883fa27d9128ecc885cf1d35e4edd6d6b9
SHA5127a82fbac4ade3a9a29cb877cc716bc8f51b821b533f31f5e0979f0e9aca365b0353e93cc5352a21fbd29df8fc0f9a2025351453032942d580b532ab16acaa306
-
Filesize
218KB
MD5f8978087767d0006680c2ec43bda6f34
SHA1755f1357795cb833f0f271c7c87109e719aa4f32
SHA256221bb12d3f9b2aa40ee21d2d141a8d12e893a8eabc97a04d159aa46aecfa5d3e
SHA51254f48c6f94659c88d947a366691fbaef3258ed9d63858e64ae007c6f8782f90ede5c9ab423328062c746bc4ba1e8d30887c97015a5e3e52a432a9caa02bb6955
-
Filesize
177KB
MD583ad54079827e94479963ba4465a85d7
SHA1d33efd0f5e59d1ef30c59d74772b4c43162dc6b7
SHA256ec0a8c14a12fdf8d637408f55e6346da1c64efdd00cc8921f423b1a2c63d3312
SHA512c294fb8ac2a90c6125f8674ca06593b73b884523737692af3ccaa920851fc283a43c9e2dc928884f97b08fc8974919ec603d1afb5c178acd0c2ebd6746a737e1