hijackloader | hxxp://room[.]icu

Analysis

max time kernel
791s
max time network
768s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://room.icu

Score

10^/10

hijackloader rhadamanthys stealc doralands1 discovery execution loader spyware stealer

Malware Config

Extracted

Family

stealc

Botnet

doralands1

http://45.88.79.153

Attributes

url_path
/e36377ea7ac96c9f.php

Signatures

Detects HijackLoader (aka IDAT Loader) 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2328-1506-0x0000000000400000-0x00000000004F2000-memory.dmp	family_hijackloader
behavioral1/memory/3240-1579-0x00007FF7F5200000-0x00007FF7F5337000-memory.dmp	family_hijackloader

HijackLoader
HijackLoader is a multistage loader first seen in 2023.
loader hijackloader
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

explorer.exe

description pid process target process

PID 2400 created 2480 2400 explorer.exe sihost.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

1316 powershell.exe
1680 powershell.exe
4004 powershell.exe
3212 powershell.exe
Downloads MZ/PE file

description	pid	process	target process
PID 2400 created 2480	2400	explorer.exe	sihost.exe

pid	process
1316	powershell.exe
1680	powershell.exe
4004	powershell.exe
3212	powershell.exe

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
C:\Program Files (x86)\Spectra\Spectra.dll	net_reactor

Executes dropped EXE 4 IoCs

Processes:

Spectra Setup.exeSpectra.exesnss1.exesnss2.exe

pid process

4416 Spectra Setup.exe
1620 Spectra.exe
2328 snss1.exe
3240 snss2.exe

Loads dropped DLL 58 IoCs

Processes:

Spectra Setup.exeSpectra.exeexplorer.exe

pid	process
4416	Spectra Setup.exe
4416	Spectra Setup.exe
4416	Spectra Setup.exe
4416	Spectra Setup.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
1620	Spectra.exe
388	explorer.exe
388	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 2 IoCs

Processes:

snss1.exesnss2.exe

description pid process target process

PID 2328 set thread context of 4052 2328 snss1.exe cmd.exe
PID 3240 set thread context of 4004 3240 snss2.exe cmd.exe

description	pid	process	target process
PID 2328 set thread context of 4052	2328	snss1.exe	cmd.exe
PID 3240 set thread context of 4004	3240	snss2.exe	cmd.exe

Drops file in Program Files directory 64 IoCs

Processes:

Spectra Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Spectra\System.Windows.Extensions.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Xml.Linq.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\pt-BR\UIAutomationTypes.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\tr\System.Windows.Controls.Ribbon.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Diagnostics.Debug.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Net.Ping.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\de\UIAutomationTypes.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\fr\PresentationCore.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\ja\WindowsBase.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Numerics.Vectors.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\tr\UIAutomationTypes.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Reflection.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Security.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\de\System.Windows.Input.Manipulations.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\es\PresentationFramework.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.ComponentModel.TypeConverter.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Private.CoreLib.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\PresentationCore.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Globalization.Extensions.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Windows.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\WindowsBase.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\es\PresentationUI.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\ko\UIAutomationTypes.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\ja\UIAutomationClient.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\zh-Hans\PresentationCore.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Security.Principal.Windows.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Text.Json.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\UIAutomationClient.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\fr\System.Windows.Input.Manipulations.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\pl\System.Windows.Forms.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\zh-Hans\System.Windows.Forms.Design.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.IO.Compression.Native.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Numerics.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\zh-Hans\PresentationFramework.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\zh-Hans\ReachFramework.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Management.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Runtime.Handles.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\de\System.Windows.Controls.Ribbon.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\ja\WindowsFormsIntegration.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\ko\System.Windows.Controls.Ribbon.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\pl\System.Windows.Input.Manipulations.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\Microsoft.VisualBasic.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Threading.Timer.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\ja\Microsoft.VisualBasic.Forms.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\ru\Microsoft.VisualBasic.Forms.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\netstandard.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\fr\PresentationFramework.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\fr\ReachFramework.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\zh-Hans\System.Windows.Input.Manipulations.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\zh-Hant\System.Windows.Forms.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\fr\System.Xaml.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\fr\WindowsBase.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Configuration.ConfigurationManager.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Memory.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Net.WebClient.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\mscordaccore.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\cs\UIAutomationClient.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\de\UIAutomationClientSideProviders.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\pl\PresentationUI.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\PenImc_cor3.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\System.Dynamic.Runtime.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\tr\PresentationCore.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\it\PresentationFramework.resources.dll	Spectra Setup.exe
File created	C:\Program Files (x86)\Spectra\ru\System.Windows.Forms.Primitives.resources.dll	Spectra Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings msedge.exe
NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 698372.crdownload:SmartScreen msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Local Settings	msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 698372.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exepowershell.exepowershell.exepowershell.exepowershell.exesnss1.execmd.exeexplorer.exesnss2.execmd.exeexplorer.exedialer.exe

pid	process
3180	msedge.exe
3180	msedge.exe
1440	msedge.exe
1440	msedge.exe
4960	identity_helper.exe
4960	identity_helper.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
3612	msedge.exe
3612	msedge.exe
1316	powershell.exe
1316	powershell.exe
1316	powershell.exe
1680	powershell.exe
1680	powershell.exe
1680	powershell.exe
4004	powershell.exe
4004	powershell.exe
4004	powershell.exe
3212	powershell.exe
3212	powershell.exe
3212	powershell.exe
2328	snss1.exe
2328	snss1.exe
2328	snss1.exe
4052	cmd.exe
4052	cmd.exe
4052	cmd.exe
4052	cmd.exe
388	explorer.exe
388	explorer.exe
3240	snss2.exe
3240	snss2.exe
3240	snss2.exe
3240	snss2.exe
3240	snss2.exe
3240	snss2.exe
3240	snss2.exe
3240	snss2.exe
3240	snss2.exe
4004	cmd.exe
4004	cmd.exe
4004	cmd.exe
4004	cmd.exe
2400	explorer.exe
2400	explorer.exe
1188	dialer.exe
1188	dialer.exe
1188	dialer.exe
1188	dialer.exe

Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

snss1.execmd.exesnss2.execmd.exe

pid process

2328 snss1.exe
4052 cmd.exe
3240 snss2.exe
4004 cmd.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

1440 msedge.exe
1440 msedge.exe
1440 msedge.exe
1440 msedge.exe
1440 msedge.exe
1440 msedge.exe
1440 msedge.exe
1440 msedge.exe

pid	process
2328	snss1.exe
4052	cmd.exe
3240	snss2.exe
4004	cmd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	1680	powershell.exe
Token: SeDebugPrivilege	4004	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe

Suspicious use of FindShellTrayWindow 54 IoCs

Processes:

msedge.exesnss2.exe

pid	process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
3240	snss2.exe

Suspicious use of SendNotifyMessage 25 IoCs

Processes:

msedge.exesnss2.exe

pid	process
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
3240	snss2.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

Spectra Setup.exeSpectra.exesnss1.exesnss2.exe

pid process

4416 Spectra Setup.exe
1620 Spectra.exe
2328 snss1.exe
3240 snss2.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1440 wrote to memory of 4088	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4088	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 4808	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 3180	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 3180	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe
PID 1440 wrote to memory of 5104	1440	msedge.exe	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2480

C:\Windows\SysWOW64\dialer.exe
"C:\Windows\system32\dialer.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://room.icu
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc835446f8,0x7ffc83544708,0x7ffc83544718
2⤵
PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
2⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
2⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
2⤵
PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
2⤵
PID:3692

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
2⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:3244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
2⤵
PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
2⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2716 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2188 /prefetch:1
2⤵
PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6052 /prefetch:8
2⤵
PID:1684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6364 /prefetch:8
2⤵
PID:3476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2032,3036055182365352713,168597359528566532,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6612 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2628

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3868

C:\Users\Admin\Downloads\Spectra Setup.exe
"C:\Users\Admin\Downloads\Spectra Setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4416

C:\Program Files (x86)\Spectra\Spectra.exe
"C:\Program Files (x86)\Spectra\Spectra.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" /command Add-MpPreference -ExclusionPath 'C:\Users\Admin'; Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Users\Admin\AppData\Local\Temp\7518c515-7477-4676-b9b5-32c3d1766165\snss1.exe
"C:\Users\Admin\AppData\Local\Temp\7518c515-7477-4676-b9b5-32c3d1766165\snss1.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4052

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:388

C:\Users\Admin\AppData\Local\Temp\7518c515-7477-4676-b9b5-32c3d1766165\snss2.exe
"C:\Users\Admin\AppData\Local\Temp\7518c515-7477-4676-b9b5-32c3d1766165\snss2.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3240

C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4004

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:2400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Spectra\Spectra.dll
Filesize
542KB

MD5
fa82009334ae6e23e2b7d7838fd1d39a

SHA1
b2b2c429b4daab8ea897a063cdd3b5c30c00dfdf

SHA256
12e484059be602793bee2c8076e4538747afc9835b3148b2a2b4999177c9b0c9

SHA512
290fd603c1ab65bbc0bad1f26f159cfc36792504b4a6ed511f65ad36b61f0dde1948ced240f8776896a6e9406e4a28d70b4fc7ee0c355accd123bd50fc879ecb

Download Submit
C:\Program Files (x86)\Spectra\Spectra.exe
Filesize
343KB

MD5
fe679c33a1a35b4d79a14b75a06da59d

SHA1
b53ce38b720ffda213df09e5dcdf287009b8f0e1

SHA256
012d34f11ff4d603d5eae49b676d88eba49553deaeb9542df3fe8fe1a20f6d69

SHA512
2f4fabd17c6b6ef7542ff5bc79d726400e96ca3aef878ff5dc65ccd6ae8058f703084fa5969931a985fb8e0acedf19b37473967fc7f79130931147e9a09b4396

Download Submit
C:\Program Files (x86)\Spectra\System.Collections.Concurrent.dll
Filesize
270KB

MD5
38d21e067d7673194a84cced59066ac8

SHA1
e64362176f714b23603f3a67f1e741f12e35a832

SHA256
483130bfd1e57a0cbfd8a4f3c6e2353ac3f246276f9476c83cca1cadbc47ef47

SHA512
3fa6f78ff0cb527a8e82261549f24a8609d005821ac5c5e7257670dffd55472a134af3ef78d73779758303ae5a90728181cd4caebc871c5cfa4c309141201baf

Download Submit
C:\Program Files (x86)\Spectra\System.Collections.dll
Filesize
254KB

MD5
92063926c04f2e4bf5b5fde16542831d

SHA1
e7be34eaff2d3d8796911d21f1fdbb93bf231dec

SHA256
9193aaef3ea8f19408f88c25fcaf5880e7836d1c35028d7e4077f6090b083541

SHA512
e855ee37980d1da2d143ee39133b05fff81937e529cffe74433e73088549daabd3abadbf05f3765bf3ffffd50313f0ed966efec0eb244d7363241affd73cc29f

Download Submit
C:\Program Files (x86)\Spectra\System.ComponentModel.Primitives.dll
Filesize
78KB

MD5
1c59c00ab0850af4b4d2bafd6be47db3

SHA1
4c6185b2f42987e25a5fdf2aa30cf4150de25d5b

SHA256
133ec34432ab8fa4f63ade636193864b6a62a089a0c98d746f5532c8a52f437b

SHA512
8425c02c4afb274e862e4ed5dd1c766ebfa1bcf5bf59018d86238014a52603331a8b7c1e233f5a1f22171e90132ddd585db0d2561ff2cd287d703397afdff4b1

Download Submit
C:\Program Files (x86)\Spectra\System.IO.FileSystem.dll
Filesize
15KB

MD5
35e27f4c681085a4b096826ee8ea4f53

SHA1
cf3ea4304e5558c8fdd4422e4d72509cd91ea719

SHA256
7bd41c6b12b73e6e90476f2d56db8581664abe07e7ab9bf2917bb254ed1d75ad

SHA512
1f9e6519ff29524e57cb0b3576ab118014293aade8f30027ef44b1f29a8e9a54e7bcb3b288a92dba996053b16016807d93fa9f44f2c43666ddc6425ddd7ae4b9

Download Submit
C:\Program Files (x86)\Spectra\System.Memory.dll
Filesize
154KB

MD5
7e999da530c21a292cec8a642127b8c8

SHA1
6585d0260ae98bab2ad1eaba0f9cfe8ebb8a0b3f

SHA256
3af25e0c81c1462d0db86f55c4e5fd8c048c70685f9a566d29d499bc46935fb4

SHA512
a18b6649b5c2f9f96bf639863df9faad436759200a64f91fb2d955f33c71ce4b2d5798be982f692a247ac864d8acb63fb731b31c06333e5c7d9a9c895ecd6451

Download Submit
C:\Program Files (x86)\Spectra\System.Private.CoreLib.dll
Filesize
12.6MB

MD5
805cf170e27dd31219a6b873c17dce88

SHA1
ac90fa4690a8b54b6248dcb4c41a2c9a74547667

SHA256
ba7e61a00e7a4634b5c5a79b83126f75580ceec235c613000c3efbc01826cad0

SHA512
fa946aae906b66cb5570155a1c77340f2b6d4efb9be16068da03a8f1c5b5f37ad847d65cd1416017db19375dc6a72670300da4c766e6d9bb1a00374f492bd866

Download Submit
C:\Program Files (x86)\Spectra\System.Private.Xml.Linq.dll
Filesize
394KB

MD5
60ed8b2bffc748d6a2a1fed8fa923368

SHA1
be411429b9a649a495124558c5e5d95a83525d58

SHA256
0b63cebb991d1911a607993ea5b4639f34a2b0b381a73973542db2d3591e9f90

SHA512
b0a4ac2aa96d827258bb30f098512741ad3f93585e05ceae0255e15cd8dc9ab8048788902c1eb32a813e9c69c8a923200a716b4e00f579c22a0b425665e575f8

Download Submit
C:\Program Files (x86)\Spectra\System.Private.Xml.dll
Filesize
7.6MB

MD5
46aebfbd6d7e74d4d558da62d7600d25

SHA1
9c1cd44ab8b5e283967427e91cbddddfc0c2bf5a

SHA256
834e304221e742a831be5c5178892258e689eae35b730172e74161af2785aab9

SHA512
9c4499d174a988cc3830aafcc42f79defff37b16198f49cf5d2dc86f88809fcb44e0c300351f813d46addf9998f64448c50213f1721c6a307aad21c205db1524

Download Submit
C:\Program Files (x86)\Spectra\System.Runtime.InteropServices.dll
Filesize
94KB

MD5
49c86e36b713e2b7daeb7547cede45fb

SHA1
75fe38864362226d2cce32b2c25432b1fd18ba37

SHA256
756de3f5f2e07b478ac046a0ac976b992ef6bc653a1be2bb1e28524a4ff8d67d

SHA512
a9bd42b626158c540be04f8d392620daba544a55b7438d6caefe93b9df10ec2219f28959c4e0d706a86b92008275de94dfdf19de730787cdacf46d99fc45e3a9

Download Submit
C:\Program Files (x86)\Spectra\System.Runtime.dll
Filesize
42KB

MD5
53501b2f33c210123a1a08a977d16b25

SHA1
354e358d7cf2a655e80c4e4a645733c3db0e7e4d

SHA256
1fc86ada2ec543a85b8a06a9470a7b5aaa91eb03cfe497a32cd52a1e043ea100

SHA512
9ef3b47ddd275de9dfb5ded34a69a74af2689ebcb34911f0e4ffef9e2faf409e2395c7730bce364b5668b2b3b3e05a7b5998586563fb15e22c223859b2e77796

Download Submit
C:\Program Files (x86)\Spectra\System.Security.Cryptography.Algorithms.dll
Filesize
17KB

MD5
8f3b379221c31a9c5a39e31e136d0fda

SHA1
e57e8efe5609b27e8c180a04a16fbe1a82f5557d

SHA256
c99c6b384655e1af4ae5161fe9d54d95828ae17b18b884b0a99258f1c45aa388

SHA512
377f4e611a7cf2d5035f4622c590572031a476dd111598168acea1844aaa425c0fe012c763fbc16290c7b32c6c7df7b2563c88227e3dbc5d2bd02250c9d368d9

Download Submit
C:\Program Files (x86)\Spectra\System.Security.Cryptography.Csp.dll
Filesize
15KB

MD5
c7f55dbc6f5090194c5907054779e982

SHA1
efa17e697b8cfd607c728608a3926eda7cd88238

SHA256
16bc1f72938d96deca5ce031a29a43552385674c83f07e4f91d387f5f01b8d0a

SHA512
ae0164273b04afdec2257ae30126a8b44d80ee52725009cc917d28d09fcfb19dfbbb3a817423e98af36f773015768fed9964331d992ad1830f6797b854c0c355

Download Submit
C:\Program Files (x86)\Spectra\System.Security.Cryptography.Primitives.dll
Filesize
15KB

MD5
777ac34f9d89c6e4753b7a7b3be4ca29

SHA1
27e4bd1bfd7c9d9b0b19f3d6008582b44c156443

SHA256
6703e8d35df4b6389f43df88cc35fc3b3823fb3a7f04e5eb540b0af39f5fa622

SHA512
a791fa27b37c67ace72956680c662eb68f053fa8c8f4205f6ed78ecb2748d27d9010a8de94669d0ee33a8fca885380f8e6cfad9f475b07f60d34cdcb02d57439

Download Submit
C:\Program Files (x86)\Spectra\System.Security.Cryptography.dll
Filesize
2.0MB

MD5
75f18d3666eb009dd86fab998bb98710

SHA1
b273f135e289d528c0cfffad5613a272437b1f77

SHA256
4582f67764410785714a30fa05ffaaad78fe1bc8d4689889a43c2af825b2002e

SHA512
9e110e87e00f42c228729e649903ad649b962ae28900d486ee8f96c47acca094dbace608f9504745abf7e69597cdef3c6b544b5194703882a0a7f27b011fa8d5

Download Submit
C:\Program Files (x86)\Spectra\System.Threading.Thread.dll
Filesize
15KB

MD5
72d839e793c4f3200d4c5a6d4aa28d20

SHA1
fbc25dd97b031a6faddd7e33bc500719e8eead19

SHA256
84c9a95609878542f00fe7da658f62d1a6943a43e6346af80d26bcff069a4dbd

SHA512
a414cd9d7cf6a04709f3bdbef0295349b845a8301171ed6394e97b9993f35816383b958736c814f91c359a783cca86ee04802856486d4b4e0ab90a45da39db1d

Download Submit
C:\Program Files (x86)\Spectra\System.Threading.dll
Filesize
82KB

MD5
32aa6e809d0ddb57806c6c23b584440e

SHA1
6bd651b9456f88a28f7054af475031afe52b7b64

SHA256
e8d1f5c422ee0ba3b235b22028ab92dc77c1ff9774edc0b940cad7224a30ba7d

SHA512
fe43b3d6ed5c37d59a44636d3c7522a88d83e6ec074bf69d3cbb6e5454fdd8f0523ea10fdf6fd452cbd0e2fc159cf9d03dfad6b30e80e400e7f1773b5a2e8632

Download Submit
C:\Program Files (x86)\Spectra\System.Windows.Forms.Primitives.dll
Filesize
2.9MB

MD5
8129c2d72bcba8b50576e7c43e558832

SHA1
f4892f78d2496f3a2e1fa2380ff68fbeb62e2dca

SHA256
5794a3996a0b4ab9cb13f3de0f87d50462615a7d0eb1d243d9324a682c1b58cb

SHA512
40fafbf9590d2b2c8f487f44708e9e97ddce03b1487be5c7cb3d4c92bdb7100a98aebada379f63003f0dd9d447ee2b0b9dfa0b057320ac05f7f77b31c5ffa97d

Download Submit
C:\Program Files (x86)\Spectra\System.Windows.Forms.dll
Filesize
12.9MB

MD5
a51632facb386d55cc3bc1f0822e4222

SHA1
59144c26183277304933fd8bb5da7d363fcc11fa

SHA256
efc52dbbef5202d9ff424d7adc6e2249b66450a5fd5414891776fc617b00123e

SHA512
2a8d8e2ee8168e6f79476616385320f463ebc161c7393db2b18a7d35ca0111c5100b83954c5eabfe32b12cac3dbfdc514271dde4cc4468dd26235eb7020d9c14

Download Submit
C:\Program Files (x86)\Spectra\clrjit.dll
Filesize
1.7MB

MD5
8b81a3f0521b10e9de59507fe8efd685

SHA1
0516ff331e09fbd88817d265ff9dd0b647f31acb

SHA256
0759c8129bc761fe039e1cacb92c643606591cb8149a2ed33ee16babc9768dcb

SHA512
ea11c04b92a76957dcebe9667bef1881fc9afa0f8c1547e23ada8125aa9e40d36e0efaf5749da346ba40c66da439cbd15bf98453e1f8dab4fe1efd5618fdc176

Download Submit
C:\Program Files (x86)\Spectra\coreclr.dll
Filesize
4.8MB

MD5
9369162a572d150dca56c7ebcbb19285

SHA1
81ce4faeecbd9ba219411a6e61d3510aa90d971d

SHA256
871949a2ec19c183ccdacdea54c7b3e43c590eaf445e1b58817ee1cb3ce366d5

SHA512
1eb5eb2d90e3dd38023a3ae461f717837ce50c2f9fc5e882b0593ab81dae1748bdbb7b9b0c832451dfe3c1529f5e1894a451365b8c872a8c0a185b521dbcd16b

Download Submit
C:\Program Files (x86)\Spectra\hostfxr.dll
Filesize
342KB

MD5
16532d13721ba4eac3ca60c29eefb16d

SHA1
f058d96f8e93b5291c07afdc1d891a8cc3edc9a0

SHA256
5aa15c6119b971742a7f824609739198a3c7c499370ed8b8df5a5942f69d9303

SHA512
9da30d469b4faed86a4bc62617b309f34e6bda66a3021b4a27d197d4bcb361f859c1a7c0aa2d16f0867ad93524b62a5f4e5ae5cf082da47fece87fc3d32ab100

Download Submit
C:\Program Files (x86)\Spectra\hostpolicy.dll
Filesize
388KB

MD5
a7e9ed205cf16318d90734d184f220d0

SHA1
10de2d33e05728e409e254441e864590b77e9637

SHA256
02c8dbe7bf1999352fc561cb35b51c6a88c881a4223c478c91768fdaf8e47b62

SHA512
3ecbaf20946e27d924a38c5a2bf11bac7b678b8c4ebf6f436c923ea935982500e97f91d0e934b7fd6b1fc2a2fd34e7d7b31dbbe91314a218724b3b2fd64c4052

Download Submit
C:\Program Files (x86)\Spectra\mscorrc.dll
Filesize
133KB

MD5
53e03d5e3bffa02fbc7fb1420ac8e858

SHA1
36c44c9ff39815aa167f341c286c5cd1514f771f

SHA256
23a433398be5135222ee14bb1de6334e7b22bad1a38664a83f1cf19dfbddd960

SHA512
f6aca16b90f6b4efa413dc9a8f1d05e83c1e3791b2cb988f9bce69d5272a0077c1edcae4111a494d166b5e3ab4e25956dead4e93ee1e43417c2b7bb082292170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Filesize
1024KB

MD5
82113ea16a7953678d888070da1e9f16

SHA1
a3aa2d86fa086c86363aba28931c101b3edbe63a

SHA256
92e5416c340f92f1e4a81fb7b44a20abb3734b27581aea2522be60d7320a5f74

SHA512
adcc7d1fea6c3e8648fce699df95027b1817953522df446fe15fbb8421c3f3e75c740b7ec162d6380e572ae53b8a6d25bd0228cb91cd4dc3b4e37734ea9f0459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
Filesize
1024KB

MD5
b3ccc91730e2f4b81dae4de58caffa3b

SHA1
91eb102e4f3d94e4daf6d1812ea4a5043494d39d

SHA256
c558e6bda52f0b4a1fa05d1372b2a74041faed00f74b66312bacff65319a42e5

SHA512
0a6e2019b3e4a088794f2dbf2d92f7999c19d4fd9eabdd6aea8dd932cf920f536a78db38bf4110040e1f3af2309f66d1db62f78d5d6e1ef4554e0736033caba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
Filesize
1024KB

MD5
53dd8be68a2bc02d55d63324f7910cc0

SHA1
5793f7cbd57f04f9b3f25f81059b9d3e59a04f18

SHA256
6f1f2216c599f50b0a44e0c9a578365b5880ce1836f8e2422d7a90b3b5cc9eac

SHA512
8eb051e2f5be8e8834d88eed1fa86d4882796e89a1a5a4cadc7cd761d5dd13a98349c63abfa5439e9428ab2b2a381ec60bad3766f0008169cea647396156dd21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011
Filesize
1024KB

MD5
9292ef3a90f9495eaaf09fe8a5cdb32b

SHA1
e3c96f01d806827dd4f2f88985951e9f4eed6624

SHA256
00064b4d4cb2568a53097093d94ef754a854a648e68b946f2826b61ece92484c

SHA512
900ab891c5576c49eaa7beb8f174773739fbf137567f5509af153e79eb77baccd8770c95dca643956d12dfbbbd11cc0a1623ab574f252f3d8bbe5811bf8f9620

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Filesize
1024KB

MD5
9ef84ac04db76e9e3cb3574ad6238646

SHA1
2f34a6cefc0536350cf20cc5f57c3b13353d2e27

SHA256
078be9cfc47819ffbfd4d2a13d98daadbee570e7fb997ba460a5c68256970c96

SHA512
ed7fa3d22b4ce7fdc2181693994ee2668a4659a6c2ea8dedb52930c363cb8559f0db1fb9a3625761dd7811278b8a80d6afd340a2172339cc90069f81d7280e33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
Filesize
1024KB

MD5
86cd10af3bdcba91bae1617b5c62f13a

SHA1
e6527dcb9fa8544664675f5f229345c134897ce9

SHA256
039f29afa28da6f10e8c22e4f50637c4034016d764048ab345de0c0379633284

SHA512
9bb92efea6ae10ca9ad5a92da6b02d2324c8da15dc961d09abdd5bfb835adfff8faf042c87db89c9fa3ec1819ab8562075b51d1a8fe7fbc98f4cb0782e772dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
Filesize
1024KB

MD5
2ed9ac133ea954b3b88f2767d8a40455

SHA1
329f7372597ea0220df8b74fb867cf584d02fc72

SHA256
cb38349df87f57ce64dba571e5d32a3586122b59c29e8ea4b7705caa0f23cb84

SHA512
0699e9a32ebf3a1cf8bf7d2ab1c2837a1136fa8b81624c139bd7947d1fcfdf0a4c3ed2d9e3cb94747a584f0e38f8e8da90554402b49f08261f32ecab10813a5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
Filesize
1024KB

MD5
d298dc19a0f5c32e839b3d4c5af2a5c7

SHA1
c9b94a9b3e9ee83d0a5be121980bdf2d6b4ac05a

SHA256
6737ded5a5c6448c97054baf29a9db85b8f8b0ac027335fe65cd921ec0658dd3

SHA512
6546f336d29f8c8e2556e46579d0fe4965c0cb0951ddda3068c797178a6a4cf70c2121f5adc3e6a4d3e456084eca5f80fb1649d7b75aa8f16e0894a22acfd68d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Filesize
1024KB

MD5
e504579598dd96aa3d0e3704eeaad268

SHA1
63f8dc989d28673e188b1d7ae710f8c4d527c2fa

SHA256
226f4d89444d30e6a6b9fc92e8c61902919326eb9513d02fc6855d123dbda60f

SHA512
a24681db693b63512ece9f02bb19c5ebd3ae5608184ba58d62cc07171d83a0e87238c1dc3d6d7ae3bb9d73c2bb531be392e069de5f6fde1da83cbcb222cf8264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Filesize
1024KB

MD5
e53aedc1b14ffad0b0f877dd8cbb9412

SHA1
21245ffa96eea0f4fcc43856d674354404b174af

SHA256
cd5f274dc7ac02d47121009465b1c33fc7714d08baefeb072aceb3c2ab31e32f

SHA512
3cf474c97bef235c84ad67bf2ce574ac1248332696ec3c10dff3a1ae0c327d1dd10328f3a3e86a69b6e8ff1fed0e6025268dec58a138cad854b7b5e28094a39c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Filesize
1024KB

MD5
208d00c84e16988f25a4616f1d9507a3

SHA1
515a03297be0e38a38f5209956331f9ee668ba5d

SHA256
fab9f69e151b524f5d5d3d2ce55376fc883da08cb4ef80b72419a65dda3f3fdb

SHA512
50d412abee750d34e6e5d2b59e55e02a3b17a3102baf77f3cc75942f9e69805bfd9023a103b6eeada17a9c72293f38f82e3b378868fced52bb97b32a6c31d75e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
Filesize
1024KB

MD5
62e6d6d2633f1392b6d37887d7a1515a

SHA1
93f657f95cb48b690b2681631c3acd92829efeb6

SHA256
768f0c7a15348e0da0d5aa753b6f3fa9819d971f078df6ba7e00364fc21b0d9e

SHA512
f84dcb949c45828321d88ad6e07eeb28985cd89f12c6965b6434ac1c43571ee59146138be6ffb44795424a346b57fac36e2f56703985bcca0b0fc46d996f2dc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f
Filesize
1024KB

MD5
f03b691cf63061b95e0752a516c053e2

SHA1
3ca3d6ede545188d00f793ee26e45d7a952971b5

SHA256
51820552014f88e6bc8753472611bc4e4ac89b2341494268840e7b7a5a08f9b1

SHA512
899d4705c738d97f2b16bc42e9bab959a3c42e4c4994ba050f044649f8e2c18c26cd78c7a23bce470bda3ed016d4606338a52bb98e3586d17deb9aed976436c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020
Filesize
1024KB

MD5
36092f876ef667baef094749ee6ed014

SHA1
3673e0e894033ff63915c3a49c640a4903d9910d

SHA256
838dcca96d0489f20e4f4966ed7adbfdd1d359d0f27e8e0172bf832d5face38e

SHA512
0baf7c88d4fd41a6bfeff9052942b0c96c7098341552b0d03a85c27ac91eada1bcb615feb3f0d3457d55bb46ac4d2bb11d1421bac26cf5fdac4993920649f6a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
Filesize
1024KB

MD5
ad5dc4e459385280a949f6602216a690

SHA1
6e8e9075a61e8f5bcb800e2c25ff0a2bbdbd8588

SHA256
6161b67e8be4d28dd476b6b8c2f4292484ed1d37ddbbd1df0296de33d98bf070

SHA512
b59fe60de24289a13f21b1de9cdfad2ba05b858648dec4e97e06c5ee7d95fc63c0a7ef473e126fd0200f76ca420326807d4da378e051fa7eaaa8795172cc5e87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022
Filesize
1024KB

MD5
b54e4287e08a3545bb84869ad2a6ac4e

SHA1
103adfc4be8d9a7a34674ffe3b6515d822169e63

SHA256
971cdaddfcff41a4b7fd9ece39ffac14a72b52ed13775c18972d9360dfdc0059

SHA512
5d710d70df6cf9752723558d0b09f4e8c4576a44c22c7a2426c066893dab8050862f93cda5db2d606aaa9b7115b783e8563e068902ebd8ce4193a1780ebf625a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024
Filesize
1024KB

MD5
dcd1188f43d11fc5e00bd2553dd7ddf1

SHA1
73b287bdaa92ad24331ed61819aad914e851d183

SHA256
537fe990f29f542d48183b9e789cdc2f97c8094adbaa6aa46d27e146e03d9142

SHA512
6ecbf92f0408e357795467239c0b9eb32ef5743d175044dea8674a9ed8b729108796664f1952f64834642e4d42d6df7d47d2381c5cb7ed121261cd8a8d89205c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025
Filesize
1024KB

MD5
ec09a2a83a7bfbf588b500dbd82c8b34

SHA1
5b5e5711b9d12fac6b9ae929814028efe12a55d8

SHA256
050c1d6bb6cf435acdf9559da2369fe309886473ea4dba4d396f9b3a71e21721

SHA512
4c6d0a46e6b0597d07fd12bad8e7649953dbdde3129652c1559c33fec087a3a6e7bb2e8f3976e9d76c73346a7e071afdbebc97903336f030fd73a129b6838e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026
Filesize
1024KB

MD5
a46ab9edcf7aead99231a2cc48ac85dc

SHA1
4d6a48e4813c2872dcca0c2fa92dd87761ce8925

SHA256
c41125244c327c702bd88c03c404b4a1a761972bd81dc3141f7c90fb3c03d90e

SHA512
5974c983c137fe66e364192ccfed3b9f23379f708e38f281b71060b2f6b431fe7b3661596f28ecb2d455b3c35a05c3d1cfd27acdd89cd44406dbd2d515b3d446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027
Filesize
1024KB

MD5
1ecc599801aa428e6ad4c3e62f8d7935

SHA1
1ec429b89ac65d62e0f548f7a2f7052489714620

SHA256
2bb89d878ecbc615cd42c30a2652322abd570f75475ec898e8ee179d585cca95

SHA512
744a7af078c5cfb48c467fbdecfc12ac4b182e3fe800ebb01c23b8aede5e52bfc2905471b3b33249b480b40f753291b116c268a9215025f9d5eb5bcbcc5a2a9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028
Filesize
321KB

MD5
3b2dc69f29c3d711037e0fe9ace4a444

SHA1
d1aab28f9d06564a23e2ea36446c5ec94e3ec298

SHA256
dc3ba867d9d13830d50e91d92d0ec92eb0d8ba11670073933319946f8dfa7906

SHA512
085da52aed8aac03a49825f5963c65cf0fd3ff01f95af82e6f6a70a0f89d336d941b6b755f640489c0cc3dc8e86612db6487a89362d1358a473c5b993b6f5222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a
Filesize
1024KB

MD5
2e3e3c3f1022ae0a06d2a76999db20ee

SHA1
85dd79ebeaa20c74a31adebbaaee909976d52901

SHA256
99a56b9c1ffa79828033f8bdf3d1cf6ae0359cecd6a27b8c84bd4287838f277f

SHA512
a65f09937e369230499106127fe3c97784ddd178585a5b56d3f1b7dd842aef46910ac381deeedc6fa268441609c41aea61ece1838182ceedbf86e0056e5f81fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b
Filesize
526KB

MD5
867eb0661f4b1401c4ca0b1aea217ca1

SHA1
cdd64a93d25093699bb8be85babfb2d83e51fe10

SHA256
63554658c456384973381a31b0a10d4a80c8e60b3a22e4555a72d49172bb14dd

SHA512
bf6b012ab7d3346c971e0ba1905a0ffe72612a2e388f51fd5375c82e6f7c08a844b4d4c9ec88a7d2b395676e71306617a4fe2055415ab4dec8e5f49b5977fca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c
Filesize
1024KB

MD5
323f37dc0ea9041b7b7ae9919397e12a

SHA1
27ed10edcd47c288272a531d1495b6d3c574d151

SHA256
3b9c7f0f28c0591b2076698e00805fb38a60d59f21ed70e765532c1fb7cf77b8

SHA512
7e8395553821534690674a466cdd979c7366365219e5b753087985384f9c5b2053a206aba69d4cebbc2598b031f29b7fc7c114ce873e85d7f4606c6760f44bdf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e
Filesize
1024KB

MD5
275a7812a5a067193e42864cb0ff1885

SHA1
1c6ccd921e0bf830c3264bf0fba70ea18b9d5835

SHA256
0d8ec5e0fd62853e4245f42883f8e50535716bb58b607d165cd0594bdd8d93f4

SHA512
92a74ff2124106ad1353dc3890259be1cb5392de4ca977b8aca1d313243e99091c219b0644cbc8862f4f90fdb60fdf725642d54e9fdbec5e350c355cf39135ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f
Filesize
1024KB

MD5
29b2bf5c75c605bfddc45977e1f44a0a

SHA1
9ebb4eb98a58311a5fd997ca48e80b2f0a3092d7

SHA256
6de36d1638bf0a45f77efca421a8540d5cad1b4991e02e3faf7149a3a4ba1943

SHA512
d6f3df37e11af36e072a84b0c2b2ba1f86670506a560cda94c83c9736db71489bce00cac04ca7e672c8f99b25e4382e880dea435eb7767f2eec7882f52706da9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032
Filesize
1024KB

MD5
34adecb055daeea4c0af2b62f8334a17

SHA1
6ffd248e5e9aa80f0b11db793dd9ed13a0750b37

SHA256
f7a9fba1bba28d7e753fb10c36619fac3076e4b77a903c5d363a749a06bf3080

SHA512
f8a61e9d794176eccec98116dfe4f8d4bc0543047de5af00c063fa4d2ada62705d96a0c97332a3cbc2dfb2f4f5edd406dcb1dfe92a153b62f943e5999bcdbbfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033
Filesize
1024KB

MD5
9a0206b45c897a894f6b89336ab571ac

SHA1
0bae0dd7ef5abd5dd246b750d4f52e45be59eccd

SHA256
9ce6b2d70127d780862b314715a9953943f397b1efe98a7b5882e6b8cdf0e59c

SHA512
b24fa7939f08b6fdedff3f0e39a900d5d2e35de4b2f4d2b572ab535349adb3d2dd75571d821c69d819bb8479dd32dbee40d043de6fc35f8ba13adc31fe6bd8e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037
Filesize
1024KB

MD5
307076507b64af55f45832690b293c16

SHA1
d990c1fb47991a04c74ecd7693659b1fba5ae269

SHA256
e4882b6a51078e61d0852b8a04c9077a984a9faad4795274f1dcb8a37d597263

SHA512
f06cbec2d8457ef48e584bbe45ecc8726f257ff8d63a1722e4362af9b5550b359bfff0f7b1bf6a48a03a5a357be9aa322aa366a2d656ffc05bd9f91a2bf7f196

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b
Filesize
1024KB

MD5
0ec2e95427f90e66b04fdffbc5cd7e81

SHA1
2a76ad39811aa69bf051ca91afc83744c6e68050

SHA256
bbd2fa8b6562c2d584d8bb642e1e3ff4cd83af34182fadf5a89b6da00d133242

SHA512
f529c38ac02ffd31a6b7874d0ce302acb3f7f9fbf517cecd51362bcc4f0e8490406435a76363db20783967be7f158ddd8500f043e64195755646e26b506f1811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
Filesize
1024KB

MD5
bd9a0c00343726bb621734b1026668fb

SHA1
703154af74982a7422144d01d0dca5ea4236e19d

SHA256
b984a94db3e570370c643c78dad66d0cbc52bc16889a0812fd5a19cd7c238ceb

SHA512
d37836690bd92f1179a99b25e690f73ce0f892b7ca108732b6f92601688a26cba405ff4c87ca0a85179510a69d4d1b4d90605279f7cdfc1c08f064b4cc926565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003e
Filesize
596KB

MD5
f79e54f73ccdad21d75d893350cf09a0

SHA1
9dade1b849ee9ee1d7dd91891f548c2b4bcf2a42

SHA256
8034b1cd776f8fcc04e2860a5ff7495fd2d75e4aee22f2bf277a45e28c8bd13d

SHA512
c9a4bf973f5f7a34f61f5b1955d75fd9a57b05dcd428ac1738454e325ecaf37aa0bb4cb5f22dd0c0bee0d8520e33f915475eba8a088475e3fa7cbc4f50d73748

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047
Filesize
16KB

MD5
728c186ad6f8c20d836e8d1eb4245a1a

SHA1
54a90a9f5760fb4bd04d4b079c6ba34fd1d5ae13

SHA256
3dfd1ed2e477b8f21f1e3bfa1ccca23b60b12653be7617210fe3af5619cc461d

SHA512
9dbf3d969af92e8a514f1c2f860a65818d5871e43dbe3b95978aceaba2dca5dddfedfee670ffa74387a64073743175c131d0638d493509b9a2e2555ee8e4ea14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006b
Filesize
1024KB

MD5
1c7c0ccf1062f9b3e861e3bc5f5f7256

SHA1
354435f73936d90e64efdf2ba7a0029f83fb5aaf

SHA256
27ae6d3009668801cb16948f49b1cea601e3a95dcde9d3aadc9933a4388f648b

SHA512
242fad951240f1f28caa2444973b883cc89ddb4479f196e505496b74990a706ad0f5f557da5f192e785247773a2bf8ae2175fe9ffeff9f7d2d834eff4e188f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006c
Filesize
1024KB

MD5
cf27dbe184f3e99197773be75794611c

SHA1
0af6cabbeba4d1db15ef9ecfecb4d8f277c269e9

SHA256
de8e91627fe7651d9987bda25d42f31d68d67b3ab6cab4cfe1b8c890d27000cc

SHA512
d0f49715037095044f40a85888c85aec44f4f8416405dedf89b746aa5666bfc2a11c301ba9a35cfef4dc14ed2a1ef73bd40c9ce935285ec2771a3e4c66ccbcc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006d
Filesize
1024KB

MD5
517e0a868a2251f23081c406b4d90a25

SHA1
5d323c1d7a080be9e4fb00a779f2f0ed8a37bf94

SHA256
ba93393d9c203387a9e75eb231cdda6e4af8563da0976e3f730f361e14adefe7

SHA512
a2e53699acca043cd0002545a3a324908d3e6c4ee336d018f9bacce76704afc4b8710560967a1fcbd4bc4750ace89b73b12b14378a30108d109dec293a8bd6bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006e
Filesize
1024KB

MD5
3ddf1462b9f662dbc287cfb5e633bb2b

SHA1
60d8eb4cd9a9ad4d352b3c606fbb2ed4bea9503b

SHA256
810ae83c42ba5f5d11b2f367c3e8c75c722acc7403875421f5aa10bb23b011f4

SHA512
9988c64f1cffb8a0e424c712da20d47d790ac6cff62ecf6bb8707c5c08a9898bb5e199312482e99c31b58e0868f298e083d52be625e95e08faf7030ea488f89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006f
Filesize
1024KB

MD5
238a924af6020cde897ca06ed6d4d72b

SHA1
e439b91cfcfa4c026d16497a32926664039118c3

SHA256
7fc5d7f59248f89df73058ca30d1cbdaab8396e81f60b1197e9e04a3de650a22

SHA512
1733cd2ecc23f945028c5016168cac83d8adde4210e0f5f224ac025d66929044a1b65a720d4b202a0f191c2148f61cd04629bbec00b54bb951b619a3cb857609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000070
Filesize
1024KB

MD5
41c8d4f92c12654cc858b71d2dda1fc8

SHA1
79a3693b0c3c928c3da3707cd0c78e38be0f3bd0

SHA256
179d005456854de37260ba9a340363e6473548c0150724827852b5242ebe027c

SHA512
73750769fdad1f3fe2b55a1a8b050af998d6621f87799e7edff81a7e413f11fe77f9b3a0a25be5984dbc3df7e3cfcbbaba1e1b848886754d1968b4eb9fdfa4be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000071
Filesize
1024KB

MD5
73e0d6b32390758cbd360684afafe9bb

SHA1
bf5a3e9eee5bb773abac4f407afab3e4a9dfb8dd

SHA256
f8f81c38689a606df11a437f23baa48acf21e9c6e941c83ed2af69d6022dee23

SHA512
8c6977bafbca9ba90e1971f64960217c37767064ccc35d4947116d8e4ebfcba4a2021b4b260b41525f6938b4be069508b9c8a4c41591c3c6cb7a43dce50f46c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000072
Filesize
1024KB

MD5
39495562b7f451829fa7ea3a99b51d24

SHA1
1e6a6d7bc61ce389267eec4e4d5be1ed21213856

SHA256
9b77a4500c22c0037dd5c05ded9316b528dac5eddc3f90db159f48b3dc5c8d10

SHA512
962a341b421b7bcae566b23cb34200bc630c3996169181d61daad35865a572a8bdcded87eef0baae798c6fcd302c055279f02f4758c67ae0cebc1cf7fce5b56c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000073
Filesize
1024KB

MD5
68e0dae9705dc7d04e7b7886f15be108

SHA1
19a22143c47c2ad350fffea2c34b114f00542e94

SHA256
75bff3c29f195c098d6e5c1a06ca99d8db3cb20633c38aed10add6975fc83465

SHA512
702c5017320a83176a6d1b4b34910767583be3cc6fd292b00b3914ceaf1c6fd93a4af1365d6a033da8c9327bf8f899ea0b1aa69d31191a719cbb8269adc745ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074
Filesize
1024KB

MD5
aea386a8960a8b63696c6cd0c0f3e920

SHA1
701cea7c51ef1f1a2cf0a071ec4f49acd3e907f5

SHA256
6d5ccba32e0d5fdb4f2d9a6f87886c3e88dcfd67a6f08ba5762df34671ef9752

SHA512
e306f21963b5887ce835c8128c8c5f1e108844f8161bbc1edcdfd37719c2a03ff8867a9b410ac738b3376fc706164b77d874807180efed805dd47eb06852c21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007a
Filesize
453KB

MD5
57d53bcbecda919ac074904699d14f6e

SHA1
d33f61f5bcfdfb23365a7cd14309e439dfc83e8a

SHA256
231f54060f0536abab4077521d28a3f2ee326e44e67ab58e5c7738ee8f833549

SHA512
54e9c71b4475f306ab1127fc63180cc0401344032eb176b6a5a7ff828121df7635ca40b4dbd9231de85cd9affdf1975fc1e94f33508378cd4c7da92b6f3b55a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b
Filesize
507KB

MD5
c76cb5d581212195a2e252d86a5b1bd5

SHA1
96529190a709fdda43b8ce5cbff617af597a21aa

SHA256
91b949b34f283607e3b982f5c70dcb714ce26fe55ffee94c7d54863b4237da27

SHA512
8dc7c56f226e0b26c047ef4c80ca0fc76ec39b92e43fade1b390d66845398d7b4cec9f86b39f8d0ad7652778e119a64e3c0a5d3eb92a628ed3758fb52b741ba8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007e
Filesize
1024KB

MD5
59e515201c8f3cc73856b7e75549a15f

SHA1
903a78a952ab67dfb1d58cb54089975538514c62

SHA256
3010a6419252c6c5c4f2d2d0e356951e9828439632cf73e0bead31405444d7d4

SHA512
6da10a23d896b9f40c011f3062cb1979cc0f3fbe1e46c357e2662bb162ab3965d3b8677f1ed1a5c9cd454a4da3709f99e32ae9535cc0052c6359b5ada647ffcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007f
Filesize
1024KB

MD5
5a3233504f6c0d8ba8ab6c609454b9fe

SHA1
f5a267182ab4a0439186553177eeae04f7a60260

SHA256
989faabde43a7a6de9bfe52123e5aeff497eafc41eed25dc29e25e545ddc45e7

SHA512
96ca61d32336f34b7eb352be1eefe253cac96e4c94dc620964cada568bc24198f9a57675a103e961abcda16ae66081ccabf3eee7ac672988be52cb2bc3b468c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000080
Filesize
1024KB

MD5
fea68ba4b099e91189016405ec488257

SHA1
63017483109ac84396893fbffc8888b93715a9e4

SHA256
92c117acb028c866019a6bc6031527387a2516b5e25b2164fd48078962106fcf

SHA512
499eb78a1c383e6dd9845d765fd6ffbe26fb84dacb5ee8ee2f21093b602719bba0b81ad89ea19f7f6da017ed6fcc56ce1448542988899bf405484fe390b43e2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000081
Filesize
1024KB

MD5
1053f547b741e820cbb7fb0d1f6f28a6

SHA1
30691534cedcb13d449631caa5b19232fde7d61f

SHA256
6eaeb1dddfff951ae8b34b0eb6c11e3f8658eb726f5c799a7ab54e439ac7fdea

SHA512
a8a054b4b8b168c216eaf50dcdd33070c13d9a0ca6cc3b16b8bc902a61f61b597a5f2b4f56417733f95f42c4521822da127f1c868c96ca2a2e4c371f7d04eb86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000082
Filesize
1024KB

MD5
8891d05869b6f202ccd96b2c52fa3f3a

SHA1
9d790ef2558971726ef28e189d72778cac13c196

SHA256
0e20fe80b02371085b65ea46697f8a57307a4d697116aa6e4031d51a37ac53da

SHA512
c14fcd8e9b19ce5be755d422f039b623fb96bbec454ebaddeb69aa31d37bbb3a4d35b4a20dc3e6db272ac4b5770221bbcf1e24a52b7eeafd792820b3e817e065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000083
Filesize
1024KB

MD5
f8df483b75a731789d5f54b0ba5d096e

SHA1
540096c477a1412e580f2909014daf43b3afb66b

SHA256
bc0475532bb4aa15a6f6af9557b973801b4061b892f467986df080538a0da1f4

SHA512
e8e83134327f0ac554d2308ad69606aa312bb6c59016b5f33da68e474886a3c48b94fe09c344c6334fc5f15589f48244fc16f4e5a21288846fccff6a7860bc1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000084
Filesize
1024KB

MD5
2744008ef0c543bd835f6f5fcfbe2b08

SHA1
65407968f21f66a0b477e2bd016562c1956ee843

SHA256
cc3f68e93b0f68f13e0e59c7a7bc7f78d86add12e30ca1a30c3d96bf14396b17

SHA512
0f6bdd864b14ddd6204f61101f51947fe23370c1b7847dabfb527ce8add5cc5124b55a597cea4ebd4d101073128f43265cf3a2aea30aeacd262bdeb06310dcdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000085
Filesize
1024KB

MD5
ebbfb859949bf9ebe3570fb0fba85cb3

SHA1
b95105c86a3716388c010983663762d6b1bd30f6

SHA256
f8aa31498f54a30c219ac3bbd995488defd88e0e36ec972949ec8b6f0f443c38

SHA512
40b223e25bdc837787b05b9f660e08fc26f2d78eb0eba3f9efd19d1d4b3151889ff0e470146d279227d9fa97a4e48f50a0ccf52128a64b18bc8a2305b2f8097c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000086
Filesize
1024KB

MD5
577d65cffe3935457ca049532ac5afe8

SHA1
04c9f9cd970c383e4d6b49a4f81f84e520c1d12e

SHA256
af750279cfb2111dc203b0a4fd2e184d0eb9d19a64ebf99e744cb310636b65ff

SHA512
1471426d10f2121d6187e09405531c637dced192ce4ca49e7ff61f51a48b73babd06de18a928a28dbeba9bb729c2878dfbd959715723aa41a957ad3edd7fa56f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000087
Filesize
1024KB

MD5
f6a646f39ca98121d84b36ad3023ac77

SHA1
b43a553268f6b265157d67b655b35b7574d79d81

SHA256
f2508f49ac38ae64f6bcb40f57d7c4ffb0a4639506d6a7fe14c73a118c183ce5

SHA512
71a0c93b3891715101bceb599a1cc3bc890494cb9240938fb7a01dd590ae5e3967bd9d7ea453dab5c7bc25297599b2ceffb8e2477ac6d4da95a3b4762d360a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000088
Filesize
1024KB

MD5
d89233413efbc736f0df7e08434e8496

SHA1
3e5149b2248f74fecd3ccf471d369a7b2a2a192f

SHA256
c42e298d2ef2a2e177a7a08c7a8641ed60c0c476c7402d6edfc0545a34740ce3

SHA512
2251b58dfcf280f2b759dfc22f29e9deb10cbbf8765f2e65f13ed8dc1e871bea98441f32018b3e3d9c79fe2f4bd127e0fac4c677b7fa34bbdb130eb989cc3a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000089
Filesize
1024KB

MD5
444102a6649333d6bc873701468c8c29

SHA1
4fca812984abb0339daffd48e141eefd09d39cd0

SHA256
2fb575408913bb8436e6e97ec6750a8781fe7deaf78c22ee260a10a1468ae16d

SHA512
ebb4977b1fb7ecc2fa8f47fb6f80f9f71fa8acbc55dde17bdef6b2ac02a23c909e8ed78ff131c8ea6b0091e124d8f0df4477cdae1e435600592effce52d339a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008a
Filesize
1024KB

MD5
c70b595285ab5a1a60fedfe8a6480c26

SHA1
2fb63de03a456b4f5f1d88c3c5c9058ea6d071ab

SHA256
771abea72e603f72953fc3c9ce6c5df6563266f7487c208fc1d9a26860197150

SHA512
59c67b5dd1cde84a5bedb2fd688562e9d6a034e72651cf7a930935509f676e2e09211a2ded01b074134c29d49c8a23a4afc87e13a80482aeb792a3b64441b587

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008b
Filesize
1024KB

MD5
1fb1bce608dffd21b90e2affa10f7cfd

SHA1
6349b3048776cef998318d42889076e44b0d5322

SHA256
d19d0ac6ddff386bb31d7b37f72cbdc6f246af644c20226d922f19d1ea6a614d

SHA512
2a639b3f9d34d7df449e33cb8b69a5e25af1c728455c5b2d32e8d9eebeb7d9ff93ee6e9b0a7314f3868c7f5b19155fd89cab392dc9575d5f79de76266fbdd89a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008c
Filesize
1024KB

MD5
3f2ee57a484231d1453eed13584f8c8f

SHA1
4eadd12d554b01db62309f48530b05be70e4fc07

SHA256
56255558df2f444a76e6bd28012ddf4458c005bc24767d14275e1fbc672c1a88

SHA512
4358fe9a62f6f60ffe364bcdf82e97b8d3fbdd53fc982dd7d853dd9ab5c13aa9e3c6e3b721ad5932a3dbc54a4452d55e2e0c1d543b1fbb029f65133ec743b219

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008d
Filesize
1024KB

MD5
4f5f479dcecf6f22ef7a2ef91fed10f6

SHA1
92d565a5dc5d91d9681d78a7a1220ce0f23836ab

SHA256
77f993af413a8467d216358957ed7890ff60602775cc6e952262f0011199aa21

SHA512
95a2285e52206655c53e8c9157b44023f19dfa52518d493c03cf12bcaecb2011f33473583f764ef28f486912b7cb0feae4316b062dc52facd71ea80ef5a72980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008e
Filesize
1024KB

MD5
e4c3299c97cfdb2c5053a40943c57740

SHA1
8b8a42380d1039b8c24a524cf3ef6a9f484cd3b0

SHA256
f9738e4de5a398981667e6d5f2b63e2ed9da06542c647f3076f1697e4c299cc1

SHA512
96cf3f9d8460a8143d406fa9e2f64dab923c49c98a6c637245211ce1241731850fd4aac87b2f2ded2724990d55874b8ab09f4a9100e288abfeb462226b909f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00008f
Filesize
1024KB

MD5
701b538ce47f2e82491c89b06bb186b2

SHA1
c150618ece1fd12ecd5ed9bc997709ef6290d253

SHA256
d0efb586b7e252fd2bc5924c5a2dc2063a17b085f14701feaf43f877100ceb4c

SHA512
b5e61f657717937aba9df68dfca2dd46252960b2c6fd9855a2be167f75079ddefe51dde85386fd37f74a818aa3ef7b814e4e71e6b0bd44fcb4d06d7c16032f4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000090
Filesize
1024KB

MD5
2a87bba0fe276f43f511f7cf949e0b12

SHA1
47efbb93ac33f9f4ec4184c6d03cf40ad86cc4cd

SHA256
3d4f84f6de19a03111644ddc1dcab4f5c0402f185ec684d6e92929860d57f8c8

SHA512
3ea62c71fdbb84509c6a5b6395edc446bf017795589ab91ea71fc8eed17d3e741fbafb612192dcc7c8ba1b462285dcefa8d315540f3a07b8211d22e83285ae9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000094
Filesize
978KB

MD5
8a9ebca97bad4681f8aa4142ebbe7d3d

SHA1
6387004eedae92802cc280583aefdbd6193ebf2b

SHA256
6e0b51c6d976598a667fe4fc5009d9e464232cad3b0938470ec45b3ebc6a907c

SHA512
e2c3668bd0023db821cd64f1aaf80803d021f271f8eba6aa242224083b3adfa7e2176e84c3582db0e254f9732e820edb95293a97827c8fbe53c95ebc78d08942

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000094
Filesize
978KB

MD5
ea86c53c8a5dfc08e008f4792d443fec

SHA1
ce62945db9f2221b45472fd3e46cd8b01f1bc2d0

SHA256
6d05fbd38c6ed0e7148777879ce1ba51ba0657a70485cb6941b5fe8b532b6dd0

SHA512
22993fbe74b13af545df54722c61f033285d81e509ad8663c169a37188da157d42c44cf711eae4f3c3f6e6d05476fc45f976d08243207bcfd556268525c58949

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000095
Filesize
1024KB

MD5
39d36cd5cca903eeacf13532483e0afa

SHA1
8c563860e8349cd5512272777ece6520959ef691

SHA256
0153619c311cc7c0a98def9d551500e53431effe5033a38b12fb660772512d6c

SHA512
97f6f273808d5421c58cb51632b31eea0f4ea129bebceb23529de91aee0f9b3b9de8f8019f397af0d4153b7e8c3fd204ee5009b0689ea702777efaa647391d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00009a
Filesize
1024KB

MD5
96c83700af5dda6827cbe791bea24266

SHA1
8b167691c1312428fae47955d9a8d951b4b94eff

SHA256
dac23b653bcb18d2f1f804619d0a5b9b9daba2ed211b6bddd0eb95b5045cf4c7

SHA512
23bc3e9ca5db5ca1375ed5ebb0bad2918b3d3fb51a5d5c7e970e761b450bffed6fe9f004ed657d8ef867673891c4845b8336b65896893650812fb632da0567aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00009b
Filesize
1024KB

MD5
c03d17334f5893307e1bd615a9a80709

SHA1
295433c2390b1747c028e9d7437d01e7c0177173

SHA256
84bc0cd121ea8948b4efcc0da356387d2f5ba4e323ac1c33334729aa5d48f148

SHA512
22a76804b042ec1bd3ccfcb5852ef5d990f2f0610c3d0a6bcdd55a942cbb2dcb8945d6c13787ca8155d6abe9413b2048be7781d87a9d965ba4364220a07a630c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00009c
Filesize
491KB

MD5
50406bfbcbbc3a7caf728a600e45bb24

SHA1
69990b4a171fbc27ac3709cfec5c469c29d9ae73

SHA256
e038c09fa6a101b575737b3e6bd7431a2656b47a911d90eb7968be34531633a7

SHA512
ce8bbb16648bf634bba1564c40fea9bc68008070f7b211b2a432b7f44d15b729edfa4fc41d41fbca73a98236889eda43f081fd576c8f27bc995d05f3f7f265c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
552B

MD5
e57c48d37b493332ba726de883b73420

SHA1
59ba0efb891f87b07876eddc4b322b8a2e424d1c

SHA256
617b3f6b861ec6fc48d38f5824d2f59140533d103a078c1cf03040babfc8899a

SHA512
1ca8d64baa80d1b3ab295f0cd89066ce21377da76f41e98ef5bfba598ca1fb897c9ef56fef0a96a117c6eb41d399358d195f04a202da2e32799b8de3d76b58c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
480B

MD5
7920797a715ff9ee051f12521e34f522

SHA1
5e76ece6160e955b35a2295bb5968b016cf70f5d

SHA256
84dd208fa8b5f296c6bbcba522f5b5e3b5c9b4c1a5b8532cc39b5ea9756ae4d5

SHA512
c611d11120522912c9673be7a0bd4189e995d06fcac86d2706ee13489d9987583bfcb3c053601fd5723d34e13ad42830de6ac4fb76504a98bdf55c3653db2d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
432B

MD5
6ec12a64abacecc7b4198ad5a09f3dca

SHA1
1897fc815c2e659f16a0f00ef50c43cc4efbcf59

SHA256
d2fbd6b03596c7d8bdabbb62ce6ddeced825135d47ee5cab9efdc2be795b45e2

SHA512
b5af7f5172cb2780ef4c8be3d228715382ce07c5844c2910a91624dd272016929b53c53b2c2e6015e711d3fbd68a8be871846f361e4118dac57b3fcc8784ccec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
576B

MD5
f040b0cf9f7843b1737214c6ebce5089

SHA1
82007813889be414df28d1cadd34f5dad68295e5

SHA256
15c172d2e0acf46e46d33f8442eeb854c9b1d0ca34dee71630327c932c135702

SHA512
b9dc5161bfc3f60cea696e96fb0ae6a5a33369c4f0baafed80399a30a61a944364196fa8136d6d0e2761b085056523520a262536d54ebef9be2013122c0d8c24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
180B

MD5
00a455d9d155394bfb4b52258c97c5e5

SHA1
2761d0c955353e1982a588a3df78f2744cfaa9df

SHA256
45a13c77403533b12fbeeeb580e1c32400ca17a32e15caa8c8e6a180ece27fed

SHA512
9553f8553332afbb1b4d5229bbf58aed7a51571ab45cbf01852b36c437811befcbc86f80ec422f222963fa7dabb04b0c9ae72e9d4ff2eeb1e58cde894fbe234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
319620acf36cfdf83fccec1f4b2580a1

SHA1
f8a197a579c25b5743bb90d291e60c8863018d82

SHA256
a4f42432f380b8488e54e8c1519d09ddfcf58a38aba569326ec764ae1282c9d8

SHA512
5639c52f37befca110cb91a4fcda680ca9626396c285ef4c8095ae658d1e4100df646c02167216f7b0df3fe24f9d838b8bb884301ebd690d9e5e16630f84d410

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7dcf2c33fdc057bff48e5a2c7be9cdd4

SHA1
00cc6e0f86395a713ba19c0d2d69eeccf9ccc124

SHA256
002777be9992782834d86974dcca3ab4e4be736150691ad4dcf455192327dab7

SHA512
1eac0c837ff57814ab9fb491aef133046ebc88bf0a977553a171f49dc4d4c95938e9232d2bd82e3581fa99179d0092d1b38ee7fb4da0867670b352749a6dfb60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
ea393542ed72c3de3dcdf8d91026ab6a

SHA1
5605fc969b4b860eb48ce07f1f4defe40c8eab65

SHA256
09b9b06ffc8976da53710497a542039b1f2948b11e4ac3e705f80af333c4e24c

SHA512
ad0f58caf7ca8b013023dfcd4f4dca42253787aac7603d7e01bd71dac707086c5de9eba1525425ac0d7a38c538a2e7a825eae36749bab089c58866ae068c4238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
13e44b2e5b2d812a9f91a7015c892951

SHA1
1384fa35a9133183b2d34f0049c854e31cb39f2e

SHA256
e96ce7913a4bfb08282e77f3c0ead212c2de4d7d02d47280dbfe2e4605cab7a6

SHA512
88aa7f4e9cd7c8c7f3eb3dffe10281bcc3b663324c3f0824369f0e1de8ba48e4ec4d018f4f354a5b6ed29f34015ce69802c4912b8a0cbda06ec759c53b2b1f9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
865a12157e79b7b510d12b6753e09c3f

SHA1
43e2b9bc3ea82035a4e912b328c07210f22eb34c

SHA256
30d133785bf5c475334f8cc5167594a710106456580078fa02888551c69dfc24

SHA512
0318eaeee81e1dda827e8119adbcab53f2b5a689241c3d7d3eb08710238a350a1723cb2e271bf978441fdbbaf382ec782992c25b4c22b2abe0a8d3f71c4e6738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
9198df8c3393b80309072b6359f755fd

SHA1
de5ae1f7e818e0d84ec29493ed4d10788cf1a56e

SHA256
507bde92c3fd8a95b4c5f41dffeefe33f275e03c85f64e31ed9432bc52dbccb8

SHA512
1971d9281404d47e31b60e71a8ec91cc4f9e9af0e24fe14c9a2824a7fffca11ce3928bee3663d713eab038149216082f81605485bc0334780adfbbb87c19d494

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
10KB

MD5
c06792e5768aab434897d450c6aa4ae0

SHA1
271ffa2e9bd733e6fbc54fa89ff98babc6e41ac6

SHA256
11d1eaf21632a5585c689cbcc7034cc30e9adcdf89d3a792d3180fcf4399ab4f

SHA512
c566c7658d7c5ba2a254886cfac4c8276ebb39d120204563f5de09d5540032343e6135fdd4c3699b86844a1f7b3e107198977c1dc656f3950681d79a10c34bb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_scosalhm.shr.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv9D61.tmp\InstallOptions.dll
Filesize
15KB

MD5
d095b082b7c5ba4665d40d9c5042af6d

SHA1
2220277304af105ca6c56219f56f04e894b28d27

SHA256
b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c

SHA512
61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv9D61.tmp\LangDLL.dll
Filesize
5KB

MD5
50016010fb0d8db2bc4cd258ceb43be5

SHA1
44ba95ee12e69da72478cf358c93533a9c7a01dc

SHA256
32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e

SHA512
ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv9D61.tmp\System.dll
Filesize
12KB

MD5
4add245d4ba34b04f213409bfe504c07

SHA1
ef756d6581d70e87d58cc4982e3f4d18e0ea5b09

SHA256
9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706

SHA512
1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv9D61.tmp\ioSpecial.ini
Filesize
1KB

MD5
ca79942e51abef2e6ef0ca518039c103

SHA1
bc54e80086a4b38642e526bb979cd7d03871f20d

SHA256
20ff5830ea2ed8e4f71143476568a21f0ea3e20634949c20b8e18c0333eaf9cc

SHA512
5291ab9fc3d0fe7ed46a6ed159329427f445ed72f55967a786740c3d0bcc98fd6d2b2a39743c2ca366d7c91e9884460f7636199a226292d9d707f0cc729d8291

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv9D61.tmp\ioSpecial.ini
Filesize
1KB

MD5
9f892faa6055ae0ec024726a1a54dd80

SHA1
2256abff767703b36e132d19f38ccadea169410e

SHA256
24ffa99a28351c342ddcdba4c59e4ac4652e4ccca57fec7205d1cb477e4df62f

SHA512
5e281f91047cdd3dfc277004b82bcd14aeae362d65b7e50ec35a608f9e2e104cae4e4e5b0c5e93983450ac65f4cbfc94cd20aeb9ef72cb56cbaa9b0427e58fd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsv9D61.tmp\ioSpecial.ini
Filesize
1KB

MD5
8dbb55050faf401350ac2a119ac037f9

SHA1
326b52873d98399ba833743b0ed096caddf187a4

SHA256
11fc4186c61ad0f4c8134d00ad66d0b97395e7cee60f334895e3708bb85e528a

SHA512
f9533e7d99341a641ed0bc640d646d46147fbbb97dd161f8a75a6164f94b6998bb5945d5f3214156fb5ab7fca990ad27189cf756e07ca27efb315195771dbd7e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Spectra Setup.exe
Filesize
47.6MB

MD5
9865ea7b0c864c9cb7b402d719cc866e

SHA1
dc9e1f78e8b7211ed2390a513cfb1f42d1468c6e

SHA256
cced68e78da1e155cdc09eec9df2bd6e41d8597fbc0084b10e741ebebe7f46b7

SHA512
0ad597ce5bb9f526143574bfaf29076b1ce8dac69b5750b83406914e2005a9f21039f438b05fb03f1c808c93b0f57811c1e4f1c46dd44e10ccf71efca880e4f2

Download Submit
\??\pipe\LOCAL\crashpad_1440_AXFQABJXESBHFVWX
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/388-1577-0x00000000006D0000-0x000000000090D000-memory.dmp

Filesize
2.2MB

Download
memory/388-1514-0x00000000006D0000-0x000000000090D000-memory.dmp

Filesize
2.2MB

Download
memory/388-1515-0x00007FFC91B10000-0x00007FFC91D05000-memory.dmp

Filesize
2.0MB

Download
memory/388-1516-0x00000000006D0000-0x000000000090D000-memory.dmp

Filesize
2.2MB

Download
memory/388-1518-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/388-1551-0x00000000006D0000-0x000000000090D000-memory.dmp

Filesize
2.2MB

Download
memory/1188-1602-0x0000000075F20000-0x0000000076135000-memory.dmp

Filesize
2.1MB

Download
memory/1188-1595-0x0000000000850000-0x0000000000859000-memory.dmp

Filesize
36KB

Download
memory/1188-1599-0x0000000002670000-0x0000000002A70000-memory.dmp

Filesize
4.0MB

Download
memory/1188-1600-0x00007FFC91B10000-0x00007FFC91D05000-memory.dmp

Filesize
2.0MB

Download
memory/1316-1463-0x0000016707FE0000-0x0000016708002000-memory.dmp

Filesize
136KB

Download
memory/2328-1508-0x00007FFC91B10000-0x00007FFC91D05000-memory.dmp

Filesize
2.0MB

Download
memory/2328-1506-0x0000000000400000-0x00000000004F2000-memory.dmp

Filesize
968KB

Download
memory/2328-1507-0x0000000074960000-0x0000000074ADB000-memory.dmp

Filesize
1.5MB

Download
memory/2328-1509-0x0000000074960000-0x0000000074ADB000-memory.dmp

Filesize
1.5MB

Download
memory/2400-1591-0x00000000043C0000-0x00000000047C0000-memory.dmp

Filesize
4.0MB

Download
memory/2400-1597-0x0000000000EE0000-0x0000000000F4F000-memory.dmp

Filesize
444KB

Download
memory/2400-1594-0x0000000075F20000-0x0000000076135000-memory.dmp

Filesize
2.1MB

Download
memory/2400-1590-0x00000000043C0000-0x00000000047C0000-memory.dmp

Filesize
4.0MB

Download
memory/2400-1586-0x0000000000EE0000-0x0000000000F4F000-memory.dmp

Filesize
444KB

Download
memory/2400-1587-0x00007FFC91B10000-0x00007FFC91D05000-memory.dmp

Filesize
2.0MB

Download
memory/2400-1588-0x0000000000EE0000-0x0000000000F4F000-memory.dmp

Filesize
444KB

Download
memory/3240-1579-0x00007FF7F5200000-0x00007FF7F5337000-memory.dmp

Filesize
1.2MB

Download
memory/3240-1580-0x00007FFC6FC60000-0x00007FFC6FDD2000-memory.dmp

Filesize
1.4MB

Download
memory/3240-1581-0x00007FFC6FC60000-0x00007FFC6FDD2000-memory.dmp

Filesize
1.4MB

Download
memory/4004-1583-0x00007FFC91B10000-0x00007FFC91D05000-memory.dmp

Filesize
2.0MB

Download
memory/4004-1584-0x0000000075050000-0x00000000751CB000-memory.dmp

Filesize
1.5MB

Download
memory/4052-1512-0x0000000074960000-0x0000000074ADB000-memory.dmp

Filesize
1.5MB

Download
memory/4052-1511-0x00007FFC91B10000-0x00007FFC91D05000-memory.dmp

Filesize
2.0MB

Download