Analysis

  • max time kernel
    901s
  • max time network
    932s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 14:48

General

  • Target

    https://cdn.discordapp.com/attachments/1252274452150882436/1252620694655733893/Krnl.v2.exe?ex=6672e16e&is=66718fee&hm=dba3be7a98d079e0353fe1820c264ec865d6222244af2b73c90001fa801a04a0&

Malware Config

Signatures

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in Windows directory 38 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry class 16 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1252274452150882436/1252620694655733893/Krnl.v2.exe?ex=6672e16e&is=66718fee&hm=dba3be7a98d079e0353fe1820c264ec865d6222244af2b73c90001fa801a04a0&
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe808046f8,0x7ffe80804708,0x7ffe80804718
      2⤵
        PID:3112
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
        2⤵
          PID:3788
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1912
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
          2⤵
            PID:1444
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
            2⤵
              PID:2244
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
              2⤵
                PID:1948
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
                2⤵
                  PID:1152
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 /prefetch:8
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5100
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                  2⤵
                    PID:3804
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
                    2⤵
                      PID:464
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
                      2⤵
                        PID:224
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5844 /prefetch:8
                        2⤵
                          PID:2080
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8
                          2⤵
                            PID:2884
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
                            2⤵
                              PID:1280
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
                              2⤵
                                PID:4844
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2624
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
                                2⤵
                                  PID:4528
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
                                  2⤵
                                    PID:4848
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                                    2⤵
                                      PID:760
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:1
                                      2⤵
                                        PID:3872
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3464 /prefetch:8
                                        2⤵
                                          PID:5024
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6628 /prefetch:8
                                          2⤵
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:4748
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
                                          2⤵
                                            PID:2624
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
                                            2⤵
                                              PID:4964
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6612 /prefetch:1
                                              2⤵
                                                PID:4108
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
                                                2⤵
                                                  PID:1556
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3752 /prefetch:8
                                                  2⤵
                                                    PID:2032
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6928 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4080
                                                  • C:\Users\Admin\Downloads\FiddlerSetup.5.0.20243.10853-latest.exe
                                                    "C:\Users\Admin\Downloads\FiddlerSetup.5.0.20243.10853-latest.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    PID:2892
                                                    • C:\Users\Admin\AppData\Local\Temp\nsj6790.tmp\FiddlerSetup.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\nsj6790.tmp\FiddlerSetup.exe" /D=
                                                      3⤵
                                                      • Checks computer location settings
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:852
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        "C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="FiddlerProxy"
                                                        4⤵
                                                        • Modifies Windows Firewall
                                                        • Event Triggered Execution: Netsh Helper DLL
                                                        PID:2924
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="FiddlerProxy" program="C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe" action=allow profile=any dir=in edge=deferuser protocol=tcp description="Permit inbound connections to Fiddler"
                                                        4⤵
                                                        • Modifies Windows Firewall
                                                        • Event Triggered Execution: Netsh Helper DLL
                                                        PID:3796
                                                      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                                                        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                        4⤵
                                                          PID:4620
                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
                                                            5⤵
                                                              PID:1388
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 1e8 -Pipe 290 -Comment "NGen Worker Process"
                                                              5⤵
                                                                PID:3068
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 0 -NGENProcess 1f8 -Pipe 29c -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                PID:3124
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 1e8 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                PID:2284
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                PID:5244
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 2a0 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                PID:5424
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2d8 -Pipe 2cc -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Loads dropped DLL
                                                                PID:5480
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 2d0 -Pipe 2d8 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                PID:5696
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 2cc -Pipe 2f8 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                PID:5868
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 2b0 -Pipe 2d0 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                PID:5984
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 2e0 -Pipe 320 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:2708
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 308 -Pipe 2dc -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:5844
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 0 -NGENProcess 310 -Pipe 2e8 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:4812
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2b0 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:5724
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 0 -NGENProcess 2a8 -Pipe 328 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:5576
                                                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 0 -NGENProcess 34c -Pipe 330 -Comment "NGen Worker Process"
                                                                5⤵
                                                                • Drops file in Windows directory
                                                                PID:5928
                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
                                                              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe" install "C:\Users\Admin\AppData\Local\Programs\Fiddler\EnableLoopback.exe"
                                                              4⤵
                                                                PID:4308
                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
                                                                  5⤵
                                                                    PID:6008
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 0 -NGENProcess 290 -Pipe 294 -Comment "NGen Worker Process"
                                                                    5⤵
                                                                    • Loads dropped DLL
                                                                    • Drops file in Windows directory
                                                                    PID:5868
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 0 -NGENProcess 270 -Pipe 278 -Comment "NGen Worker Process"
                                                                    5⤵
                                                                    • Loads dropped DLL
                                                                    • Drops file in Windows directory
                                                                    PID:1796
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 2ec -Pipe 2e4 -Comment "NGen Worker Process"
                                                                    5⤵
                                                                    • Loads dropped DLL
                                                                    • Drops file in Windows directory
                                                                    PID:984
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 0 -NGENProcess 274 -Pipe 2d4 -Comment "NGen Worker Process"
                                                                    5⤵
                                                                    • Loads dropped DLL
                                                                    • Drops file in Windows directory
                                                                    PID:5264
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 0 -NGENProcess 280 -Pipe 2d8 -Comment "NGen Worker Process"
                                                                    5⤵
                                                                    • Loads dropped DLL
                                                                    • Drops file in Windows directory
                                                                    PID:3616
                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 0 -NGENProcess 2dc -Pipe 29c -Comment "NGen Worker Process"
                                                                    5⤵
                                                                    • Loads dropped DLL
                                                                    • Drops file in Windows directory
                                                                    PID:4504
                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
                                                                  "C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper" /a "C:\Users\Admin\AppData\Local\Programs\Fiddler"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  PID:4052
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Fiddler2FirstRun
                                                                  4⤵
                                                                    PID:1320
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe808046f8,0x7ffe80804708,0x7ffe80804718
                                                                      5⤵
                                                                        PID:1768
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7044 /prefetch:1
                                                                  2⤵
                                                                    PID:3280
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
                                                                    2⤵
                                                                      PID:4492
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7276 /prefetch:1
                                                                      2⤵
                                                                        PID:452
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7420 /prefetch:1
                                                                        2⤵
                                                                          PID:5132
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
                                                                          2⤵
                                                                            PID:5256
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1900 /prefetch:2
                                                                            2⤵
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:6048
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
                                                                            2⤵
                                                                              PID:5860
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,6634809751423624611,14084882796613504841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
                                                                              2⤵
                                                                                PID:5932
                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                              1⤵
                                                                                PID:2552
                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                1⤵
                                                                                  PID:1280
                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                  "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                  1⤵
                                                                                  • Executes dropped EXE
                                                                                  • Loads dropped DLL
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4472
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fiddler2.com/r/?Win8EL
                                                                                    2⤵
                                                                                      PID:3952
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe808046f8,0x7ffe80804708,0x7ffe80804718
                                                                                        3⤵
                                                                                          PID:6088
                                                                                    • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                      C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                      1⤵
                                                                                        PID:5684
                                                                                      • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                        "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                        1⤵
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:3220
                                                                                      • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                        C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                        1⤵
                                                                                          PID:3988
                                                                                        • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                          "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5728
                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                          1⤵
                                                                                            PID:5344
                                                                                          • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                            "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4532
                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                            1⤵
                                                                                              PID:5436
                                                                                            • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                              "C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe"
                                                                                              1⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:2780
                                                                                            • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                              C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                              1⤵
                                                                                                PID:5868
                                                                                              • C:\Users\Admin\Downloads\Krnl.v2.exe
                                                                                                "C:\Users\Admin\Downloads\Krnl.v2.exe"
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:6112
                                                                                                • C:\Users\Admin\Downloads\Krnl.v2.exe
                                                                                                  "C:\Users\Admin\Downloads\Krnl.v2.exe"
                                                                                                  2⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Adds Run key to start application
                                                                                                  • NTFS ADS
                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:6092
                                                                                                  • C:\Windows\System32\Wbem\wmic.exe
                                                                                                    wmic csproduct get uuid
                                                                                                    3⤵
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1484
                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                C:\Windows\system32\AUDIODG.EXE 0x4f4 0x504
                                                                                                1⤵
                                                                                                  PID:2304
                                                                                                • C:\Users\Admin\Downloads\Krnl.v2.exe
                                                                                                  "C:\Users\Admin\Downloads\Krnl.v2.exe"
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2288
                                                                                                  • C:\Users\Admin\Downloads\Krnl.v2.exe
                                                                                                    "C:\Users\Admin\Downloads\Krnl.v2.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4676
                                                                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                                                                      wmic csproduct get uuid
                                                                                                      3⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4284

                                                                                                Network

                                                                                                MITRE ATT&CK Matrix ATT&CK v13

                                                                                                Persistence

                                                                                                Create or Modify System Process

                                                                                                1
                                                                                                T1543

                                                                                                Windows Service

                                                                                                1
                                                                                                T1543.003

                                                                                                Boot or Logon Autostart Execution

                                                                                                1
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Event Triggered Execution

                                                                                                1
                                                                                                T1546

                                                                                                Netsh Helper DLL

                                                                                                1
                                                                                                T1546.007

                                                                                                Privilege Escalation

                                                                                                Create or Modify System Process

                                                                                                1
                                                                                                T1543

                                                                                                Windows Service

                                                                                                1
                                                                                                T1543.003

                                                                                                Boot or Logon Autostart Execution

                                                                                                1
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                1
                                                                                                T1547.001

                                                                                                Event Triggered Execution

                                                                                                1
                                                                                                T1546

                                                                                                Netsh Helper DLL

                                                                                                1
                                                                                                T1546.007

                                                                                                Defense Evasion

                                                                                                Impair Defenses

                                                                                                1
                                                                                                T1562

                                                                                                Disable or Modify System Firewall

                                                                                                1
                                                                                                T1562.004

                                                                                                Modify Registry

                                                                                                2
                                                                                                T1112

                                                                                                Discovery

                                                                                                Software Discovery

                                                                                                1
                                                                                                T1518

                                                                                                Query Registry

                                                                                                3
                                                                                                T1012

                                                                                                System Information Discovery

                                                                                                3
                                                                                                T1082

                                                                                                Command and Control

                                                                                                Web Service

                                                                                                1
                                                                                                T1102

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  477462b6ad8eaaf8d38f5e3a4daf17b0

                                                                                                  SHA1

                                                                                                  86174e670c44767c08a39cc2a53c09c318326201

                                                                                                  SHA256

                                                                                                  e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d

                                                                                                  SHA512

                                                                                                  a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                  Filesize

                                                                                                  152B

                                                                                                  MD5

                                                                                                  b704c9ca0493bd4548ac9c69dc4a4f27

                                                                                                  SHA1

                                                                                                  a3e5e54e630dabe55ca18a798d9f5681e0620ba7

                                                                                                  SHA256

                                                                                                  2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411

                                                                                                  SHA512

                                                                                                  69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                  Filesize

                                                                                                  64KB

                                                                                                  MD5

                                                                                                  d6b36c7d4b06f140f860ddc91a4c659c

                                                                                                  SHA1

                                                                                                  ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                                                  SHA256

                                                                                                  34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                                                  SHA512

                                                                                                  2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                                                                  Filesize

                                                                                                  67KB

                                                                                                  MD5

                                                                                                  9e3f75f0eac6a6d237054f7b98301754

                                                                                                  SHA1

                                                                                                  80a6cb454163c3c11449e3988ad04d6ad6d2b432

                                                                                                  SHA256

                                                                                                  33a84dec02c65acb6918a1ae82afa05664ee27ad2f07760e8b008636510fd5bf

                                                                                                  SHA512

                                                                                                  5cea53f27a4fdbd32355235c90ce3d9b39f550a1b070574cbc4ea892e9901ab0acace0f8eeb5814515ca6ff2970bc3cc0559a0c87075ac4bb3251bc8eaee6236

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                  Filesize

                                                                                                  41KB

                                                                                                  MD5

                                                                                                  3c5aac3450b3eaa0f417971ecaee7b69

                                                                                                  SHA1

                                                                                                  b3af55759f53c11420de104f5398f75e4610cf9d

                                                                                                  SHA256

                                                                                                  5a62b6653dff9c9f5b183c5010455b6c4c30750c0ad75af829d5b767d0a02562

                                                                                                  SHA512

                                                                                                  7eeeae645b45250d6b32454c052abd0cbff37fbc78b92006ec74a5d82d4c908f9bb9e873e9c1b2aaeb499c5639ffdc88a5ea550c5ab1064afdd09147d365fb71

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                                                                                  Filesize

                                                                                                  63KB

                                                                                                  MD5

                                                                                                  710d7637cc7e21b62fd3efe6aba1fd27

                                                                                                  SHA1

                                                                                                  8645d6b137064c7b38e10c736724e17787db6cf3

                                                                                                  SHA256

                                                                                                  c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                                                                  SHA512

                                                                                                  19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
                                                                                                  Filesize

                                                                                                  19KB

                                                                                                  MD5

                                                                                                  2e86a72f4e82614cd4842950d2e0a716

                                                                                                  SHA1

                                                                                                  d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                                  SHA256

                                                                                                  c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                                  SHA512

                                                                                                  7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
                                                                                                  Filesize

                                                                                                  88KB

                                                                                                  MD5

                                                                                                  b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                                                  SHA1

                                                                                                  386ba241790252df01a6a028b3238de2f995a559

                                                                                                  SHA256

                                                                                                  b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                                                  SHA512

                                                                                                  546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
                                                                                                  Filesize

                                                                                                  1.2MB

                                                                                                  MD5

                                                                                                  60df9d74e78547c08a28ee2c4274e43e

                                                                                                  SHA1

                                                                                                  fff0f4c007b0da36fc0657892881fc28aa773e38

                                                                                                  SHA256

                                                                                                  d6dd2fad8470f70783c17341af7358f79a5c902c182e6f2a377817cfd29f10fc

                                                                                                  SHA512

                                                                                                  80f4e51bf98da4dc8c60885f8c71647f3e188ad9995afc5236bf01aeb5df36ea00578a90f662e1020ab4becfca2b17d99eb79f673ebe7b162ebf4b3873440599

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
                                                                                                  Filesize

                                                                                                  50KB

                                                                                                  MD5

                                                                                                  87c4d18321b426fd6adbc788f35c0ab4

                                                                                                  SHA1

                                                                                                  df9c95fdbca41f7eb42c4029c4ec54a0c453931f

                                                                                                  SHA256

                                                                                                  460af128001790b2b9908de47d89a6b6e8bd44458e8b406741941676781cc50f

                                                                                                  SHA512

                                                                                                  f6e77451cbcf925eda5565c824ac74878e3eb8ab30c57b559a0ce01373d84f98b4387f3b3274b9aec8b23d537d9789c181e10075b732acfd27050be47724aba6

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
                                                                                                  Filesize

                                                                                                  104KB

                                                                                                  MD5

                                                                                                  7a483288e82f48f8cdcdcc975544b5d5

                                                                                                  SHA1

                                                                                                  595824817ad3b180cf0500ba4e2cee0f28d43da7

                                                                                                  SHA256

                                                                                                  d2dec720512133d14bfe30b6327f55fec8d64a171f7c0156edf1ef1e4f5b9404

                                                                                                  SHA512

                                                                                                  cfb70f3ba88f84a8fb9631af70ce8ebe3f4316c002dc822a4eb821610e377939c0675e75526d8b3fc370a375d78b96600927d4d002f0c89c67b6b83bb93e1c7a

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019
                                                                                                  Filesize

                                                                                                  41KB

                                                                                                  MD5

                                                                                                  ddc9f5dede068c5bb375b24839845592

                                                                                                  SHA1

                                                                                                  e54c02cf673cb2929d75876d559fceba65454afc

                                                                                                  SHA256

                                                                                                  a8ce7ca09c32523d3c0bc43ed3df8a6d20523ae55b1c8e7228b3ec3be6682ab0

                                                                                                  SHA512

                                                                                                  b0c806d8c03e6f27235be923f5a4482e3d04bbd2628b28f90c6865c692eaf57cf0d74ce27ed59bd8c75547062e480286164fa0508787e7edb8a8f61a519cc6a2

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
                                                                                                  Filesize

                                                                                                  24KB

                                                                                                  MD5

                                                                                                  1fc15b901524b92722f9ff863f892a2b

                                                                                                  SHA1

                                                                                                  cfd0a92d2c92614684524739630a35750c0103ec

                                                                                                  SHA256

                                                                                                  da9a1e371b04099955c3a322baee3aeee1962c8b8dabe559703a7c2699968ef4

                                                                                                  SHA512

                                                                                                  5cdc691e1be0d28c30819c0245b292d914f0a5beaed3f4fc42ac67ba22834808d66a0bfc663d625274631957c9b7760ada4088309b5941786c794edad1329c75

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
                                                                                                  Filesize

                                                                                                  203KB

                                                                                                  MD5

                                                                                                  99916ce0720ed460e59d3fbd24d55be2

                                                                                                  SHA1

                                                                                                  d6bb9106eb65e3b84bfe03d872c931fb27f5a3db

                                                                                                  SHA256

                                                                                                  07118bf4bbc3ba87d75cbc11ddf427219a14d518436d7f3886d75301f897edaf

                                                                                                  SHA512

                                                                                                  8d3d52e57806d1850b57bffee12c1a8d9e1a1edcf871b2395df5c889991a183a8d652a0636d5452068f5ef78d37e08ce10b2b2f4e05c3e3c0f2f2230310418a8

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
                                                                                                  Filesize

                                                                                                  185KB

                                                                                                  MD5

                                                                                                  e2bf35562a50aff11f6cbb56a736701d

                                                                                                  SHA1

                                                                                                  aad917f83a049d1acda1b45140f457afee74ec1c

                                                                                                  SHA256

                                                                                                  69dd04fa63e062fdd125f56d3926c62f440e2e60b37d86f206c41ee4f8b2ab29

                                                                                                  SHA512

                                                                                                  05d6469ea3332dd972a5be3e30394e0cf5e337fca5b44782f32d7081f5154714216b52f6401fbe88b1b756011c2d3d818f6f0d0e8d9ca21ed17cda3b01c72269

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
                                                                                                  Filesize

                                                                                                  119KB

                                                                                                  MD5

                                                                                                  71b999d3717e2457f6ceb0d998ef1543

                                                                                                  SHA1

                                                                                                  4e7c2eb8cacffa7450dfb4f6b4a51c96c659138a

                                                                                                  SHA256

                                                                                                  099be968b9b9a638a00af9c76939cda23b4ec4a3031861f661a2a06ba4766985

                                                                                                  SHA512

                                                                                                  b5f7f0828d2a71d97a70ce3258be67f31446208d1efa54b4bcd7834a6236bddaeebf0eefb75e37c663e1962e3b66d8506e37078ed62c87da9e1e8fc0eb4c2cdd

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f
                                                                                                  Filesize

                                                                                                  37KB

                                                                                                  MD5

                                                                                                  fa623d2502fe105d7ff5c273a9534673

                                                                                                  SHA1

                                                                                                  d59251ac0e7d0293a71ca0cbebb49bee68fdc460

                                                                                                  SHA256

                                                                                                  667a7909d2755d2458e46898d7bd6745e07b4eb82a17bef228271c21285ca249

                                                                                                  SHA512

                                                                                                  51db83c040e95beb0a15ea386ac5437d09780e08f5399fff7e2b34aab74b05253da482ead77bd257f086ec21f576aa8ef38780baa0d9e3c3ce1bd93547692fe6

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020
                                                                                                  Filesize

                                                                                                  20KB

                                                                                                  MD5

                                                                                                  87e8230a9ca3f0c5ccfa56f70276e2f2

                                                                                                  SHA1

                                                                                                  eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

                                                                                                  SHA256

                                                                                                  e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

                                                                                                  SHA512

                                                                                                  37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
                                                                                                  Filesize

                                                                                                  42KB

                                                                                                  MD5

                                                                                                  76336c0908504b4384afde216436581b

                                                                                                  SHA1

                                                                                                  16627236d0476ec4e0d287b23b6faefdcd0f915e

                                                                                                  SHA256

                                                                                                  17837b74bb9293d1fb0f07c913f31be18d37c6a08ccfb0757328e960c41afb4b

                                                                                                  SHA512

                                                                                                  b2787f7dadf27684c07e1305118cff8866b84b70f84b8cb1f2d9190bb07d89a295aca9223409b75363eeaa2468cffa072db56eeb3ce17b4ab1d972dad4bfffbe

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023
                                                                                                  Filesize

                                                                                                  56KB

                                                                                                  MD5

                                                                                                  342e152ce9d9ef895fce298a61a52570

                                                                                                  SHA1

                                                                                                  c2cadef1ca66600d5c2c6dcbee3355bbf901a591

                                                                                                  SHA256

                                                                                                  baa20b7c5a3388f6da66e839b2b187662d3ffc570704a0b9382cfd0874922394

                                                                                                  SHA512

                                                                                                  10196f93f2d8fcf8e7a7ff6e9706e42be64c075833331cb48d938fd1be321e8c4f926a9c888add217540380773ca2c4b269230227af8fe945344ceb6b26e40f0

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032
                                                                                                  Filesize

                                                                                                  100KB

                                                                                                  MD5

                                                                                                  c8150f4f58b130db8eea98540584fe50

                                                                                                  SHA1

                                                                                                  c476ad0659c5ebaba081669b3c3c6a9dc96aa9ce

                                                                                                  SHA256

                                                                                                  7a4550f0b77cc11ef10b67b0438625a2ec6bcc25f1648b9690e9284e1852780c

                                                                                                  SHA512

                                                                                                  35cec0871ad85adc9ea10c9c9e9de7c5dc3bc6394e30b3b7bd751c4e529f8a681fdaf02d9bcd0db1afb617534b3d76ea8c68bc0a5822ce0b93c77ab692601b64

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034
                                                                                                  Filesize

                                                                                                  75KB

                                                                                                  MD5

                                                                                                  89ac9b8d4e31191245d7fdbacd74c88c

                                                                                                  SHA1

                                                                                                  5894a1b3ecd337ec8eda7431b3238e08f7c106a9

                                                                                                  SHA256

                                                                                                  9896cb846aff84e4697f7606cea3f2b538f94aa34112fe4b7a18de4a1c4a2f5a

                                                                                                  SHA512

                                                                                                  5509fb65267691e8085dfea7a0a7f985fecac236f392c7dc89112b1b7b7c4a5f4eec063345b8bac1e479c600d6756abcc9be11ac742bb0353cc04037c79d7632

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038
                                                                                                  Filesize

                                                                                                  100KB

                                                                                                  MD5

                                                                                                  c33a90c595a490e004c629661c770651

                                                                                                  SHA1

                                                                                                  e3cbbb1f792efcba61b82de95d1f538a58d8ecc9

                                                                                                  SHA256

                                                                                                  3804a90cb31137ad5c1b632746633a42f8454f5dac3675cd4978b76c289b0c6d

                                                                                                  SHA512

                                                                                                  4b3de22c28b2d7aa953dd2a2f4c696c6035c970346fb6f16a5bbd1916e72274433dfd16e57f0e213cf6eb0238d2612d3b0349ce3010a7366b4561db30a1b621f

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039
                                                                                                  Filesize

                                                                                                  94KB

                                                                                                  MD5

                                                                                                  550395a697c75020e3c640510e43273e

                                                                                                  SHA1

                                                                                                  ac0c259f540d9a7241e881f39f1224640dd9b57b

                                                                                                  SHA256

                                                                                                  0734384439dd55146564908da14df0c21fce9a56957300ef5f35815262021c3e

                                                                                                  SHA512

                                                                                                  6f47d1cac516727046ec7ec1eb17808bae91d1d9e6e6718ec70247bf57c4c4822b3804a9698a8194a98a24411a766ed3aed8de576f588e3c72b4c5a642469374

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  e1d7e4650ec6ea2ac1e70853236cb46f

                                                                                                  SHA1

                                                                                                  11d1e1dbdb957e60f7eb4ee116ae7c4a845bf7c7

                                                                                                  SHA256

                                                                                                  15a25ffa2de4fb811129dc4e448de10fb13f88a30a3938c499d1b48a64800201

                                                                                                  SHA512

                                                                                                  29da0a31da0659dee0b510b01ad125ca946aa2e7cb31d1d56ac8794a8eaaedcad87324b295ee62df3d6aecfa011e99656402bd48b94dfd5d24ea2dd5e25fb9af

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  78458f58c185a5cbacf76e0228510b7b

                                                                                                  SHA1

                                                                                                  72e020e8c9b47beb2661080d21a7e7da7c676dee

                                                                                                  SHA256

                                                                                                  f9c26b74676ba46c4ea893f36110d107b22171ca4e81985fd864146565cc9edf

                                                                                                  SHA512

                                                                                                  d85e608cd3cd5bb5924b09da22f31978375611425db27d15c2a17599706266029d49966fa8c3aec084bc2e43881f9cbac2c112269ca3728513468973b52c1ee3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  e5b140c07a955ab2002e831e6e2d26bc

                                                                                                  SHA1

                                                                                                  06d96c4b8c54cd252e106f244036b3a45f4c7160

                                                                                                  SHA256

                                                                                                  105096716c7966aebe53da5fbc76558097096d8434c91771a672e8931bc8e5d6

                                                                                                  SHA512

                                                                                                  f1e1d6a29cdd1447a15cd49fcb3fa633e97cf3b41462c2ec3481b222f237318eb3dc51d379d4448d1b2bd95092838f47c86a4255bc1c69cdcf8cc8dab101d65c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  27f4c346adf2ce160a0f0e4cf7552033

                                                                                                  SHA1

                                                                                                  01a445d35d7e9f8acf8a2e354ad04f39b2e8ff9a

                                                                                                  SHA256

                                                                                                  79e66928ba00004d8494027ba2f2281becce84cd6b1932a4674007d0689c136f

                                                                                                  SHA512

                                                                                                  fc5caabeee817f22951b81b289db40d52190407dd1437aca0a641dc735f728ea1828121c71440070907d8dafffb89f747a0278028158e86156afb99d53d10aa1

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  b388434a327e197da54ed3a1b6b71e4e

                                                                                                  SHA1

                                                                                                  ae8e38eb9c33d9550423c25d8c3fc44a213355f1

                                                                                                  SHA256

                                                                                                  8485cbd5d1b667787c5f49f69ff1cefb7a677ecbbbd0300a16ec9be16d021b95

                                                                                                  SHA512

                                                                                                  d15f4424c923951e387c1ced0bc36347905be9cbe7e01d44b3c7d19f1789e7c28bf038cc22529e12db0183ec73b9712411d1d6b6c2572d82b5c6721ad33947aa

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  8b885bba40aee6fd9a947d120326e093

                                                                                                  SHA1

                                                                                                  bb58e613e318fea0a127e33febbfa7dc5177bfac

                                                                                                  SHA256

                                                                                                  ab7bdfb53e0f02a760e2f69b703edcd39d44697edcee86e380d385b0e1a82d6b

                                                                                                  SHA512

                                                                                                  182f6c0d820cca398ba6f8fbce00531af8c29d08a0338b53b192b6ffd11b1f183c8563abfdbda6b8a951c8c3ff000ffeb2e62e8a3587fca9458b61cf7fdafe87

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  f937d32b362a48bd8f51d1ac6983fdf6

                                                                                                  SHA1

                                                                                                  284b3fa41e9abc69b060c6d1e823246b6dc0ef4d

                                                                                                  SHA256

                                                                                                  ef8af87678ca04696288e21ef00947c85cbf19d83b61d2cb6314a4850bc22f31

                                                                                                  SHA512

                                                                                                  6c15799c035cec198c9b35c792fe379cd7ee804799024d0f421c6e5d14c8efbbbfc439b4bebdbf7f0b267c16352a18785cb4ee0095c0181cf895faa369b9188c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  6KB

                                                                                                  MD5

                                                                                                  f7cebb0680fa8934952dceef4259aa90

                                                                                                  SHA1

                                                                                                  8218dac10448e62c3647d950d86d99d4c7fadcc8

                                                                                                  SHA256

                                                                                                  70eeddf71d37a068f69ddc3947d98aa8eb903228c166a5ee0b9e6bf7fc98626d

                                                                                                  SHA512

                                                                                                  a4e34b0aeaf723190871129edee34dcc1894ba29b0e02515c8b3aa598de598ffcb90199ceeefb948e62ec6f9dd79d782a51d2bb2fcb67117def996b3b98cb84a

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  7KB

                                                                                                  MD5

                                                                                                  c26bef1c2a94d2ff97353de344d2e7cd

                                                                                                  SHA1

                                                                                                  3e8c0a74fcf3c7abd9b97be150bcf8708c2f8daf

                                                                                                  SHA256

                                                                                                  2bb914c3792c29397caef498c11bc48b852bb84185d4d8cc11cb152d15cdc4ca

                                                                                                  SHA512

                                                                                                  a95b563f8b0205116aa385f6d506fa3c34e37e4a47dcfa49fd0e1d8894eda898f4d4e2e94b9acf3884aedfd9dacb194925d6e3ad68442c04ebbdcbfa8ccf6a07

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  10KB

                                                                                                  MD5

                                                                                                  579db2b85dd94842fa86ee9027f2ce19

                                                                                                  SHA1

                                                                                                  97c5b1dc9fa6e38d4ceb0d65e6dafa580fa5455d

                                                                                                  SHA256

                                                                                                  a3dd04f8f0b485bfc3b509acb9ea831d953611749b6b95dc76137fc4f4224532

                                                                                                  SHA512

                                                                                                  a18caf12f2f9aebb7701532282d085e69523187e142c5ab532b6f170b631897199af229e1e94b413077404506eda810e34aa2d49f8952efeee482f57f8ec2058

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  4231c01738c2fc1a43f332ce5bf2d9ec

                                                                                                  SHA1

                                                                                                  f948789c2f0f1cd593ec0e362ee5799fdc8e4d9d

                                                                                                  SHA256

                                                                                                  cc2e0f95d8a97aacbd8843aaa97c7e0cac2bc073245a1d00d9c8b1b274610ef9

                                                                                                  SHA512

                                                                                                  c57b67ca2b3bd5bf1fc193ab88d161fe0b1039d9cf6aafe366003444c6e684980ca5b17e6dd831b9ed5419ee2867ee4908df6fed5e237ed9ad739c0e13d3b71d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  967d97a401025ce40baf6b4e66d3039c

                                                                                                  SHA1

                                                                                                  d40621257a1ca964c0d78655fc15606b5a2cbd45

                                                                                                  SHA256

                                                                                                  b171ca1aebdb8dc5777399ffdce73e967495200cba360c93e33327481ccdcc9d

                                                                                                  SHA512

                                                                                                  679095f43badd0213c15c45557df09b16b5f7ce2c86165eb6ae4280b159ebb8263e88fb97fadfb3faed5d16406f196a2e845af8c3fd215f7539e90d5323d8df3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  cadac4ed5593a3c21abc021da4aa1f3c

                                                                                                  SHA1

                                                                                                  dcb8ebb55bad97c6462871667e152d4bd4bab7d7

                                                                                                  SHA256

                                                                                                  e53c07fb5bd2cf5d78cc04850c87e52c555249a4544ea96f4842e24ffbe8345a

                                                                                                  SHA512

                                                                                                  97f6daac7c305aae3a4cee189cd852fea05cb34df56e6a85b6e687839bbeddcbbeca57671b553f63db02c10e24015702dd38917cf5ee398d74d160112cba7a83

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  d1b7d95257e8d4f4e84bf9e4e1c88e90

                                                                                                  SHA1

                                                                                                  ab7c4072adb081aff21c14a3cbadf26a9688d634

                                                                                                  SHA256

                                                                                                  7839a224596e96b2c470d52650a856a4305496078270b3729711fdc15382e209

                                                                                                  SHA512

                                                                                                  37e624d5f77562ee2f018f95198676f727e7c75677410b7cf0a37f8fa8442af2d8e0a3fb803d961244a05bf55d474c64e6212316121f94e329766df821fdcd12

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  481cbec32b2789a8516e4be39240fcf9

                                                                                                  SHA1

                                                                                                  c7ee30459c8055eb6e3259aad9e22206a10b58c7

                                                                                                  SHA256

                                                                                                  137f2bbfb32b46ec72a893b17c53c3441a1c64554632f6c1944762dad0b04aa7

                                                                                                  SHA512

                                                                                                  05c0becebb2aa51da497524500b9ad4fbd4afec222f642b09e369f82b21a9b919050eb8424351251191c1c687ae8eb035fb835deee43ea05c812e50de6565cd7

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  7e57ab6cf4269bfb13ca4585576135ae

                                                                                                  SHA1

                                                                                                  e3c8ded44772cfb14fd235c140ecf4b094434aef

                                                                                                  SHA256

                                                                                                  b8b42288334d42038196656ff71aacfe71b26444724fbaa926733c1bf5c095e5

                                                                                                  SHA512

                                                                                                  146208535fc3bf9763b9752c986d5cd64d284d2947c3a6d9b9117428ad20da836e65eb88cc7f2871f2bc8a1b72a786e3fcdd7a85060acba176c1afb1fb2c2600

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  fa869a2416d4548aec9dce8fd94a6960

                                                                                                  SHA1

                                                                                                  85fb260674751af78c96c1626629e4dd956c3160

                                                                                                  SHA256

                                                                                                  ac6614b7bbcb0939c0086bfddcaca262d88499383651c35ac5ca15707ab7a850

                                                                                                  SHA512

                                                                                                  cd3d4359886bcb9568110824f499270f313509d35617e2f3db4bd696d9d171f90329de236eccd4f1cc94d3acb75db5314173c96882b2e30ff85ed887843e633e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  75840e7339747839c36f95e757e2a47c

                                                                                                  SHA1

                                                                                                  e7e6ea4917916d011c03e8af01ee8225c6bac36e

                                                                                                  SHA256

                                                                                                  af8b3db21fab5472b9e59fcca4675281d27c29710c8b3379d2943a2e56eeadb1

                                                                                                  SHA512

                                                                                                  7811a96a724a338391326d4a6c380ae7ab6f7d1ac60c2d65b658bf2f7e6df4ae5315d1d3acce1a076ac76e9ee5a45fb8a471641c3d42b312294e34fc65c0f259

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  31cb858221f7e959c8a1c1a8ddbd2368

                                                                                                  SHA1

                                                                                                  9515d26b976da814c01c26631ede3490519ef173

                                                                                                  SHA256

                                                                                                  329d87540e88c184f07c52f24ac03b469648def980bab23667e92c9a8e2dd318

                                                                                                  SHA512

                                                                                                  651e30ea9ee90c6d7c06931828923dbf4b9899d015470dc312077540232bde74abe33947e0574e76b6ac35aac1190bbbe57b86deeee4467de6fde89c2f7393d3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  bc3a1c01194f21996045a0f4f74f1558

                                                                                                  SHA1

                                                                                                  6a4440daddc450546cc85763814702b4c048ee94

                                                                                                  SHA256

                                                                                                  fab4ec3fb4558fe378984d65864c86d6d7f921d7465af42ac3ca24b9b0127a8c

                                                                                                  SHA512

                                                                                                  2c2d8da0e46c9433d6fc5ff3d952779c27d796d3852f39b936c3ae6731daf0a01d208c1bfb9966c3a34675edca167894656ac277dcfde34dc10c47296ecd25b3

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  3KB

                                                                                                  MD5

                                                                                                  7bbed07244c3a0cdc55dc34e1226db9b

                                                                                                  SHA1

                                                                                                  92bc240b769c970aa56c9819e53540f3f85e6eff

                                                                                                  SHA256

                                                                                                  f754837f064c6f161e79a8b9160d9852c8e6bc58cb5f823b3c410daf21c5c07d

                                                                                                  SHA512

                                                                                                  cddfe5057c4b304d42f9da9e224d7e09a85655ab4192da5aef72f73fd2ebfbc15a1d25af34aa88c3579d6493df512cde274e38862aa8a4e257f7bff96e1695c0

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  a4220bf67b1338c2d432f36506652c27

                                                                                                  SHA1

                                                                                                  9682d5358cd82e5598aa4161a18b5fa750b71370

                                                                                                  SHA256

                                                                                                  7afd3db291dc00f739596b9a7224a12be0597b98c9f14a1a75d3a8f6d7516ef3

                                                                                                  SHA512

                                                                                                  c71c453b5f187debe428ae5b60a49dff09570b62792845d522c9aaf18fa4bb088f5661b77373d1d1e4dca10142e6a0f0a737d3e1b57b8553a615deb749aea631

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  af1a0ac75e553f341af8ab206e6dbd86

                                                                                                  SHA1

                                                                                                  1735f6909427e235ec6da45e9203753f4e1eea65

                                                                                                  SHA256

                                                                                                  cf29f1cb38eba7dcefe1279758cd8151c888fd74ed19acdd5fd17aad95845d13

                                                                                                  SHA512

                                                                                                  06169f1b039a79b4d581ac6654d7db7e3b6d087982b4d535a9aab8ec2816d26c63393efd7592d7d5d4fc9a08fe28b6c3b742c4251858346c70d8cdc691a9162c

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                  Filesize

                                                                                                  4KB

                                                                                                  MD5

                                                                                                  cc9bbe8585077fa80b53fc41f7b6368d

                                                                                                  SHA1

                                                                                                  413bbe996d45e90aa6c7ebfbfb3625b1bbc29c85

                                                                                                  SHA256

                                                                                                  ce641699acba16c6d8ae7edecdadee621b052c8b0e6b650318130d46d3319271

                                                                                                  SHA512

                                                                                                  29882cddef5d4c8a363e57a1371d30b34928c10c398397dc482a464632450561562355269c6bfc48a4997ef6ef0bc1eff275a2126415f7f51fff4367a646d71e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f1d2.TMP
                                                                                                  Filesize

                                                                                                  2KB

                                                                                                  MD5

                                                                                                  ced3ca953fc3485b5c8f8e4ca5a3d2e4

                                                                                                  SHA1

                                                                                                  84552b005fa88b9e213d42529cf677c56d17aeaa

                                                                                                  SHA256

                                                                                                  4897cad908de5aa7ac7cf84eaf97bdd8d45f51911a565602d262cf739cbaf4f5

                                                                                                  SHA512

                                                                                                  95b6ec403f269d5ddcf5eab418c1f9d702a4fbd4ceb953fa84d9a65a19687a510b45c07d9905304a9bc95e1fbd21a19087c1f4c3b415775c150c0b80d67ccb16

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                  SHA1

                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                  SHA256

                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                  SHA512

                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                  Filesize

                                                                                                  16B

                                                                                                  MD5

                                                                                                  206702161f94c5cd39fadd03f4014d98

                                                                                                  SHA1

                                                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                  SHA256

                                                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                  SHA512

                                                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  11KB

                                                                                                  MD5

                                                                                                  80a46cea47cb792831ec5b32ccf29d4a

                                                                                                  SHA1

                                                                                                  9ea9e7c4dee1cdb6ba82077098d8a232857b646f

                                                                                                  SHA256

                                                                                                  6bb61874d90987c4d41228a8f2be1259bba562761053ec350af72423d32195b5

                                                                                                  SHA512

                                                                                                  993c83fff89ece578cb012ff7e34d4c2d80b9543ed92962a26b75c84dc52745e1f1cfd4e5f85f58bfeb6b58ce69ce095f22db2ddb304c05255322084014773dd

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  838640d1231d651ee06a4a0b865908bb

                                                                                                  SHA1

                                                                                                  2ae2be91aa91c0ce2a139bdc107278e9b4dec539

                                                                                                  SHA256

                                                                                                  d253b28fce502eb11607931103d801a198f0f9075f6d79332e23fd26c7f77d5a

                                                                                                  SHA512

                                                                                                  824b960a96efb8918b54611ae183fa9a36cdee8aca5b2bfc36dd4fe24fac3489b139203d6651b1766d1eb8b436ec5a91448bd89335f9a9f30b1275fb699cb32e

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  cbd6ee7e9b6e4d657e5fa1147f511be5

                                                                                                  SHA1

                                                                                                  5a2a5b7330d03b4e200ff85e7c287f6f666801a8

                                                                                                  SHA256

                                                                                                  5284b106f20b2158e2cfc8f1caeff35bd15a2c9762d5b5a9eae8d4401bc18e8c

                                                                                                  SHA512

                                                                                                  39cf72164cd02717beeba44ba196362fa185b12d98493c9aacab98c9ec827e15ef080770f5d49fe5af8bc23a6303d0ab3ddc0813c387ec88515a38abc813773d

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  3cddd092f0897971f09beca031e2007e

                                                                                                  SHA1

                                                                                                  aaad3a6cc5152fe3e29786fc3cead9b544be8797

                                                                                                  SHA256

                                                                                                  e843aec8740d714ece611b2d861c943311cde4acbcb2dac995fca80dffc4daa1

                                                                                                  SHA512

                                                                                                  b9cec454f3985e4bb4e7de1b3d3020a28070661833826ba23548f228b0b12e18a2fce30135a41be6f3b66df75e8bf165d5f777fe2cb2165ebbeca381ce9ffe65

                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  b5ca4e0e423c6563c7f1123d240e82e9

                                                                                                  SHA1

                                                                                                  28de53bca8b3ab31bd69cb5f9ac1ed1281288975

                                                                                                  SHA256

                                                                                                  752e2bc6c1720d6225635aad4dc4b0c855ec79bb6b330be7ce52298cb1f4e84e

                                                                                                  SHA512

                                                                                                  e4e64a943124d1f6a7a24223e8c54b40887835450435b7a4a964da39c4f804e0272bcaab49b6eb650c9dd7632f399b520a264b242f87eb5f79b513b1c628867f

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\Analytics.dll
                                                                                                  Filesize

                                                                                                  32KB

                                                                                                  MD5

                                                                                                  1c2bd080b0e972a3ee1579895ea17b42

                                                                                                  SHA1

                                                                                                  a09454bc976b4af549a6347618f846d4c93b769b

                                                                                                  SHA256

                                                                                                  166e1a6cf86b254525a03d1510fe76da574f977c012064df39dd6f4af72a4b29

                                                                                                  SHA512

                                                                                                  946e56d543a6d00674d8fa17ecd9589cba3211cfa52c978e0c9dab0fa45cdfc7787245d14308f5692bd99d621c0caca3c546259fcfa725fff9171b144514b6e0

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\DotNetZip.dll
                                                                                                  Filesize

                                                                                                  461KB

                                                                                                  MD5

                                                                                                  a999d7f3807564cc816c16f862a60bbe

                                                                                                  SHA1

                                                                                                  1ee724daaf70c6b0083bf589674b6f6d8427544f

                                                                                                  SHA256

                                                                                                  8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

                                                                                                  SHA512

                                                                                                  6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe
                                                                                                  Filesize

                                                                                                  3.5MB

                                                                                                  MD5

                                                                                                  d8d686a8e171c52a856187dd6d5b18f2

                                                                                                  SHA1

                                                                                                  53bd857635684130bf340995e452457a61bcee23

                                                                                                  SHA256

                                                                                                  892ff0f941cba2ef1e8d5f7ddb14002e21c95f21a132c50762a4c79ef9fdc475

                                                                                                  SHA512

                                                                                                  fb1f026d92cd2cbcdc0ce9a4bb81a370999cca77c99c5db2b6089a510f55af9aa1c908727fe3f31de3ec8eb3142b3b1f7e2deeca641e2b9d56eb3543ebbbe714

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\Fiddler.exe.config
                                                                                                  Filesize

                                                                                                  261B

                                                                                                  MD5

                                                                                                  c2edc7b631abce6db98b978995561e57

                                                                                                  SHA1

                                                                                                  5b1e7a3548763cb6c30145065cfa4b85ed68eb31

                                                                                                  SHA256

                                                                                                  e59afc2818ad61c1338197a112c936a811c5341614f4ad9ad33d35c8356c0b14

                                                                                                  SHA512

                                                                                                  5bef4b5487ecb4226544ef0f68d17309cf64bfe52d5c64732480a10f94259b69d2646e4c1b22aa5c80143a4057ee17b06239ec131d5fe0af6c4ab30e351faba2

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\GA.Analytics.Monitor.dll
                                                                                                  Filesize

                                                                                                  52KB

                                                                                                  MD5

                                                                                                  6f9e5c4b5662c7f8d1159edcba6e7429

                                                                                                  SHA1

                                                                                                  c7630476a50a953dab490931b99d2a5eca96f9f6

                                                                                                  SHA256

                                                                                                  e3261a13953f4bedec65957b58074c71d2e1b9926529d48c77cfb1e70ec68790

                                                                                                  SHA512

                                                                                                  78fd28a0b19a3dae1d0ae151ce09a42f7542de816222105d4dafe1c0932586b799b835e611ce39a9c9424e60786fbd2949cabac3f006d611078e85b345e148c8

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\Newtonsoft.Json.dll
                                                                                                  Filesize

                                                                                                  695KB

                                                                                                  MD5

                                                                                                  195ffb7167db3219b217c4fd439eedd6

                                                                                                  SHA1

                                                                                                  1e76e6099570ede620b76ed47cf8d03a936d49f8

                                                                                                  SHA256

                                                                                                  e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

                                                                                                  SHA512

                                                                                                  56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Common.dll
                                                                                                  Filesize

                                                                                                  192KB

                                                                                                  MD5

                                                                                                  ac80e3ca5ec3ed77ef7f1a5648fd605a

                                                                                                  SHA1

                                                                                                  593077c0d921df0819d48b627d4a140967a6b9e0

                                                                                                  SHA256

                                                                                                  93b0f5d3a2a8a82da1368309c91286ee545b9ed9dc57ad1b31c229e2c11c00b5

                                                                                                  SHA512

                                                                                                  3ecc0fe3107370cb5ef5003b5317e4ea0d78bd122d662525ec4912dc30b8a1849c4fa2bbb76e6552b571f156d616456724aee6cd9495ae60a7cb4aaa6cf22159

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Editor.dll
                                                                                                  Filesize

                                                                                                  816KB

                                                                                                  MD5

                                                                                                  eaa268802c633f27fcfc90fd0f986e10

                                                                                                  SHA1

                                                                                                  21f3a19d6958bcfe9209df40c4fd8e7c4ce7a76f

                                                                                                  SHA256

                                                                                                  fe26c7e4723bf81124cdcfd5211b70f5e348250ae74b6c0abc326f1084ec3d54

                                                                                                  SHA512

                                                                                                  c0d6559fc482350c4ed5c5a9a0c0c58eec0a1371f5a254c20ae85521f5cec4c917596bc2ec538c665c3aa8e7ee7b2d3d322b3601d69b605914280ff38315bb47

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\ScriptEditor\QWhale.Syntax.dll
                                                                                                  Filesize

                                                                                                  228KB

                                                                                                  MD5

                                                                                                  3be64186e6e8ad19dc3559ee3c307070

                                                                                                  SHA1

                                                                                                  2f9e70e04189f6c736a3b9d0642f46208c60380a

                                                                                                  SHA256

                                                                                                  79a2c829de00e56d75eeb81cd97b04eae96bc41d6a2dbdc0ca4e7e0b454b1b7c

                                                                                                  SHA512

                                                                                                  7d0e657b3a1c23d13d1a7e7d1b95b4d9280cb08a0aca641feb9a89e6b8f0c8760499d63e240fe9c62022790a4822bf4fe2c9d9b19b12bd7f0451454be471ff78

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\SetupHelper
                                                                                                  Filesize

                                                                                                  18KB

                                                                                                  MD5

                                                                                                  94dc69e00d3c9728e5b9924907930a11

                                                                                                  SHA1

                                                                                                  61a8df9ccf28af1da33a69158de6a9a59a01f848

                                                                                                  SHA256

                                                                                                  b22130b228a0777d7fef3cec8a0ba3789bca488978d1607e36dccc85f3e8372f

                                                                                                  SHA512

                                                                                                  a02e5d28dc1cd95f534e26abe5be2ff076e39c164ec37f44717c2ed6c8c013e0230ad621cb33048f79d5df23bd9dcf2748c747b5c89c777982b7ce4799a24673

                                                                                                • C:\Users\Admin\AppData\Local\Programs\Fiddler\Telerik.NetworkConnections.dll
                                                                                                  Filesize

                                                                                                  34KB

                                                                                                  MD5

                                                                                                  798d6938ceab9271cdc532c0943e19dc

                                                                                                  SHA1

                                                                                                  5f86b4cd45d2f1ffae1153683ce50bc1fb0cd2e3

                                                                                                  SHA256

                                                                                                  fb90b6e76fdc617ec4ebf3544da668b1f6b06c1debdba369641c3950cab73dd2

                                                                                                  SHA512

                                                                                                  644fde362f032e6e479750696f62e535f3e712540840c4ca27e10bdfb79b2e5277c82a6d8f55f678e223e45f883776e7f39264c234bc6062fc1865af088c0c31

                                                                                                • C:\Users\Admin\AppData\Local\Progress_Software_Corpora\Fiddler.exe_Url_gn2suaigfhhkewccgutguryxxqm34vvg\5.0.20243.10853\user.config
                                                                                                  Filesize

                                                                                                  966B

                                                                                                  MD5

                                                                                                  95b99df87725fba4f86e08c1101a71d8

                                                                                                  SHA1

                                                                                                  d9a8cff222a4aa702efc00044f073fde7c89e03d

                                                                                                  SHA256

                                                                                                  e2621eed6614ac6ae83014ffd0c719649e3b0220ad3d386382e6da1497ea976d

                                                                                                  SHA512

                                                                                                  fd762a2fd058232e52f1972b77de1a545fb7dd403f8d6cd1640003dcfd89ad3081e46d0791c71cbe9032650d87a97b61529ef434997e09df2d4c3c4facef6b91

                                                                                                • C:\Users\Admin\AppData\Local\Temp\datA1C4.tmp
                                                                                                  Filesize

                                                                                                  87KB

                                                                                                  MD5

                                                                                                  6568ccaa17064ebeca64e197da017ab5

                                                                                                  SHA1

                                                                                                  f01e19276bd5a127eab009ed470a331603512358

                                                                                                  SHA256

                                                                                                  8c39555ba5f42faab2eb79d33933c7f45ff5c84142ab27a717c99c4cbb22e504

                                                                                                  SHA512

                                                                                                  531229324ada394b2eecb96c330946c77644a17b310bb78a4eb59924bf920664c8f025eef7e71d9e0d9d03fe8b9f2e59b8c7df96d84f47a89e5a8829f5a9fc52

                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsh6FFD.tmp\System.dll
                                                                                                  Filesize

                                                                                                  12KB

                                                                                                  MD5

                                                                                                  192639861e3dc2dc5c08bb8f8c7260d5

                                                                                                  SHA1

                                                                                                  58d30e460609e22fa0098bc27d928b689ef9af78

                                                                                                  SHA256

                                                                                                  23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

                                                                                                  SHA512

                                                                                                  6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

                                                                                                • C:\Users\Admin\AppData\Local\Temp\nsj6790.tmp\FiddlerSetup.exe
                                                                                                  Filesize

                                                                                                  4.4MB

                                                                                                  MD5

                                                                                                  9cfc955fb5d23835a83883134aca8db9

                                                                                                  SHA1

                                                                                                  3aaf8cec695c3d4457e4cec2f573c42c1bb597b1

                                                                                                  SHA256

                                                                                                  229085282b304f9e76d1282419255201941948a7961472e00f28f09dd0a20ca2

                                                                                                  SHA512

                                                                                                  f57591cbb90338fa374c80967992498c33f32efac441469f79627f12b01c2d28da690da8e73fa9c2f602c054fae60ac92e1bdf0860540b6f36eda752129dd56d

                                                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                  Filesize

                                                                                                  2B

                                                                                                  MD5

                                                                                                  f3b25701fe362ec84616a93a45ce9998

                                                                                                  SHA1

                                                                                                  d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                                                                                  SHA256

                                                                                                  b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                                                                                  SHA512

                                                                                                  98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

                                                                                                • C:\Users\Admin\Documents\Fiddler2\Scripts\BrowserPAC.js
                                                                                                  Filesize

                                                                                                  281B

                                                                                                  MD5

                                                                                                  98fdeef2a46dc15e8003f4011e3d0672

                                                                                                  SHA1

                                                                                                  0bdf43d67f01b1fe37f28ea7d1d74ebcdac5d0ef

                                                                                                  SHA256

                                                                                                  4a8cd7eaa74ae85c16255c6c4ce0829f6db44815e07cf9af88cbd2ffdd84d4f0

                                                                                                  SHA512

                                                                                                  cf554c86b1731e3a4738d994e6a7097e96ee54c041c0fac196a551121b7450aeb26d0b12918332e8fe4d7d8943ff5868ddfa2827c026a976bba4202b21b78e27

                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 499030.crdownload
                                                                                                  Filesize

                                                                                                  4.4MB

                                                                                                  MD5

                                                                                                  68c831dc8ee4a88592e26cb79a08d410

                                                                                                  SHA1

                                                                                                  67ffba83eac8f1b7414d7048d681240ddc747c63

                                                                                                  SHA256

                                                                                                  174c811a5c0da930f53f29d68fcce985e88994e4bef869a04b57f399bef25bbc

                                                                                                  SHA512

                                                                                                  af3de69884cdc9b361a8a8764ddfa2cc2c67ad7e5319f1dceb7496d8f8639a85b042bffddf9516d796f7b21ee453d66dc80b139bcc7213de43b41f92d8acf2d7

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.JScript\3b5383dd37da6f390d4d4ad42fcb5b32\Microsoft.JScript.ni.dll
                                                                                                  Filesize

                                                                                                  2.7MB

                                                                                                  MD5

                                                                                                  89bedf9727f90a9f8e15826df509d7b9

                                                                                                  SHA1

                                                                                                  f0c590abc08815c38aa522afee4438d69a78c490

                                                                                                  SHA256

                                                                                                  224851ed49ed39bd526910bd252a6f53cc32c0067d80066a30f84329500ba929

                                                                                                  SHA512

                                                                                                  4d300c96062d5853e644675059afb4687246a610d5c86cfe1aa7380e4d69da255e743009339d59b4d00e79991cd8251330a99064447cde28f08821c3dbe448b9

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\22b31f1b9eca85580b198424dd16a98a\System.Data.SqlXml.ni.dll
                                                                                                  Filesize

                                                                                                  3.0MB

                                                                                                  MD5

                                                                                                  b0bd1b2c367441f420d9cc270cf7fab6

                                                                                                  SHA1

                                                                                                  bdd65767f9c8047125a86b66b5678d8d72a76911

                                                                                                  SHA256

                                                                                                  447bfc33e8f3bc3d661200891933fed1bb28c402d1063e6838f55096ec9833aa

                                                                                                  SHA512

                                                                                                  551becf8035964921fca26458e46cd32fadf1703e66724df5cc868447bb0b0c181f87eba1c3df1bece2a9a127aea78bcc2f00ad38ecd05d438119cd1a9ce8324

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.SqlXml\22b31f1b9eca85580b198424dd16a98a\System.Data.SqlXml.ni.dll.aux
                                                                                                  Filesize

                                                                                                  708B

                                                                                                  MD5

                                                                                                  688ac15ac387cbac93d705be85b08492

                                                                                                  SHA1

                                                                                                  a4fabce08bbe0fee991a8a1a8e8e62230f360ff2

                                                                                                  SHA256

                                                                                                  ce64b26c005cfc1bcf6ac0153f1dbcae07f25934eab3363ff05a72a754992470

                                                                                                  SHA512

                                                                                                  a756ea603d86a66b67163e3aa5d2325174a2748caf6b0eaa9f0600d42c297daa35aa5bfaf4962a1dedbae9437308d19571818cbd3e1542d7a7a26a4d20796074

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Deployment\18271de25c06b49b2aaa391461de2df6\System.Deployment.ni.dll
                                                                                                  Filesize

                                                                                                  3.0MB

                                                                                                  MD5

                                                                                                  3385fdacfda1fc77da651550a705936d

                                                                                                  SHA1

                                                                                                  207023bf3b3ff2c93e9368ba018d32bb11e47a8a

                                                                                                  SHA256

                                                                                                  44a217d721c0fb7de3f52123ace1eeaf62f48f40f55bd816bb32c422d0939eec

                                                                                                  SHA512

                                                                                                  bb8f38dc08b1983a5b5b1b6dac069364cec4f3a9a88fcf277cfdefac376a8c6207078938f064aacef1032f9a15cf9d21174aef4b94a89513fd65a2cfaaab5174

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ba90284a07d8bc0ce7e6273afa79210f\System.Numerics.ni.dll
                                                                                                  Filesize

                                                                                                  314KB

                                                                                                  MD5

                                                                                                  50b28be2b84f9dd1258a346525f8c2e5

                                                                                                  SHA1

                                                                                                  203abebaa5c22c9f6ac099d020711669e6655ed8

                                                                                                  SHA256

                                                                                                  6c51e5a928f227bb64a7eb9e48089bca5e9bbef0d0329b971ebbf918335ee1ac

                                                                                                  SHA512

                                                                                                  d5336827cdb202ab51583c32a45960ae43c56499dbe149ec0edb907f8f33e12800c7aa187a52a3c93e3f2ebcb677bed4e7e829e1df3fee05fe3fdc21948f571d

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\ba90284a07d8bc0ce7e6273afa79210f\System.Numerics.ni.dll.aux
                                                                                                  Filesize

                                                                                                  300B

                                                                                                  MD5

                                                                                                  5052a26ae1334e99f9c993f0ac477f5b

                                                                                                  SHA1

                                                                                                  941e82d2397f79faf7707569927bb3dbea9ea34c

                                                                                                  SHA256

                                                                                                  ec432d36bb95dcdb1876836b09ba1829c03a83c9b53afbb195c6fa0d7d91375f

                                                                                                  SHA512

                                                                                                  eb5dce71049b099c5764fe449f529b5813aab3d86150331ae384c08973f0487f9a25e1f11498203baa0a093dc2961f6bb0f5d03a86ff9c39f050524c9d32ede2

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runt9064068c#\f85535a7092741215f67fdedf2846499\System.Runtime.Serialization.Formatters.Soap.ni.dll
                                                                                                  Filesize

                                                                                                  345KB

                                                                                                  MD5

                                                                                                  35738b026183e92c1f7a6344cfa189fd

                                                                                                  SHA1

                                                                                                  ccc1510ef4a88a010087321b8af89f0c0c29b6d8

                                                                                                  SHA256

                                                                                                  4075d88d2ba1cff2a8ab9be66176045628d24cae370428e0128f8af3a77639fb

                                                                                                  SHA512

                                                                                                  ab7100c26f60ae30a84ba3de31ca96c530e86e052ffc997fd7fd3144e2049fc0d188a3d075a123b6f728dc882beee3d6a35a086d19d7dad4d385e101382fc436

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\7355af105ad86679d6c9070a9b4dc0c3\System.Security.ni.dll
                                                                                                  Filesize

                                                                                                  986KB

                                                                                                  MD5

                                                                                                  e4b53e736786edcfbfc70f87c5ef4aad

                                                                                                  SHA1

                                                                                                  62cdd43c2d1f8ae9b28c484344e3fb7135a4e4d5

                                                                                                  SHA256

                                                                                                  9ac6d5445caaacae6813243c787e8d67c974988acd1a4a5f564503fd36e91e46

                                                                                                  SHA512

                                                                                                  42a3b1cc0b805674f48a8d7891ab5ecae33d5a2205059317ca5441e7de52f26eabb32e79a3040d7aa0e0333b19f80d93d25e1faa1dfe5cfb0ea39efba5767fde

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Security\7355af105ad86679d6c9070a9b4dc0c3\System.Security.ni.dll.aux
                                                                                                  Filesize

                                                                                                  912B

                                                                                                  MD5

                                                                                                  255a843ca54e88fd16d2befcc1bafb7a

                                                                                                  SHA1

                                                                                                  aee7882de50a5cea1e4c2c2ddfaa4476f20a9be9

                                                                                                  SHA256

                                                                                                  8cd849585fe99e63f28b49f1dae2d1b47a406268dcc5a161e58331a6a3cba3ed

                                                                                                  SHA512

                                                                                                  666866c0d25d61dc04341cf95eb61969698cfafce232097e60cb0537ea2a35635e1e4986036e413fb51927187183aa2e64ecac7fbc26bac46998c0bd84f69e45

                                                                                                • C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web\44d302d3062a00a6bd5a39f743bdb4ef\System.Web.ni.dll
                                                                                                  Filesize

                                                                                                  16.2MB

                                                                                                  MD5

                                                                                                  b5840712456c7cb4de53695522e2a41c

                                                                                                  SHA1

                                                                                                  c8fa753ff825f929d5e78d6f6059fc6806951a69

                                                                                                  SHA256

                                                                                                  3cd39a70525ab32c60ed04b3791d692106afc322f399561cc7bc5b5a8e8d2a64

                                                                                                  SHA512

                                                                                                  02220870c1c06a15352f7cc75deea2645a58d93ec40f3a465cc0373d9aa98746f8739eb9120ddf8b5a3acafc6db617d3c77c7825eb7a11abab81e1fa466dcd1e

                                                                                                • C:\Windows\assembly\temp\JLQBN1VPF0\Microsoft.JScript.ni.dll.aux
                                                                                                  Filesize

                                                                                                  580B

                                                                                                  MD5

                                                                                                  15d9528aaa8f3ef914a4ae5662f138eb

                                                                                                  SHA1

                                                                                                  944e083df6082e372e81a5dfa7979f4d5e519ed3

                                                                                                  SHA256

                                                                                                  5bcc2ba91c42bb47333af2d30a23d9009475e8710e06f82492e377aa6fe29d4e

                                                                                                  SHA512

                                                                                                  fc22d60f9dc0feadae1a6ee296129abab2d6dd963df35416d6b9d36d00d22f4b2e7dfc2f111cec5d28c8625fec75b68f68ed4ab3fffb86a1c94b8f322a65049c

                                                                                                • \??\pipe\LOCAL\crashpad_1856_VWPXWZHASQGFQCXO
                                                                                                  MD5

                                                                                                  d41d8cd98f00b204e9800998ecf8427e

                                                                                                  SHA1

                                                                                                  da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                  SHA256

                                                                                                  e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                  SHA512

                                                                                                  cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                • memory/1388-830-0x000001D81C430000-0x000001D81C46A000-memory.dmp
                                                                                                  Filesize

                                                                                                  232KB

                                                                                                • memory/1388-834-0x000001D81C5D0000-0x000001D81C5F0000-memory.dmp
                                                                                                  Filesize

                                                                                                  128KB

                                                                                                • memory/1388-837-0x000001D81C5F0000-0x000001D81C60E000-memory.dmp
                                                                                                  Filesize

                                                                                                  120KB

                                                                                                • memory/1388-847-0x000001D803BE0000-0x000001D803BF0000-memory.dmp
                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/1388-843-0x000001D81CE30000-0x000001D81CE42000-memory.dmp
                                                                                                  Filesize

                                                                                                  72KB

                                                                                                • memory/1388-842-0x000001D81CE70000-0x000001D81CEAC000-memory.dmp
                                                                                                  Filesize

                                                                                                  240KB

                                                                                                • memory/1388-840-0x000001D81CDB0000-0x000001D81CE2E000-memory.dmp
                                                                                                  Filesize

                                                                                                  504KB

                                                                                                • memory/1388-727-0x000001D81C640000-0x000001D81C9CA000-memory.dmp
                                                                                                  Filesize

                                                                                                  3.5MB

                                                                                                • memory/1388-841-0x000001D81CB20000-0x000001D81CB40000-memory.dmp
                                                                                                  Filesize

                                                                                                  128KB

                                                                                                • memory/1388-833-0x000001D804170000-0x000001D804182000-memory.dmp
                                                                                                  Filesize

                                                                                                  72KB

                                                                                                • memory/1388-838-0x000001D81C610000-0x000001D81C62A000-memory.dmp
                                                                                                  Filesize

                                                                                                  104KB

                                                                                                • memory/1388-730-0x000001D81C470000-0x000001D81C52A000-memory.dmp
                                                                                                  Filesize

                                                                                                  744KB

                                                                                                • memory/1388-733-0x000001D81C3B0000-0x000001D81C42A000-memory.dmp
                                                                                                  Filesize

                                                                                                  488KB

                                                                                                • memory/1388-731-0x000001D81CF00000-0x000001D81D428000-memory.dmp
                                                                                                  Filesize

                                                                                                  5.2MB

                                                                                                • memory/1388-736-0x000001D803BC0000-0x000001D803BCC000-memory.dmp
                                                                                                  Filesize

                                                                                                  48KB

                                                                                                • memory/1388-836-0x000001D81CAD0000-0x000001D81CB14000-memory.dmp
                                                                                                  Filesize

                                                                                                  272KB

                                                                                                • memory/1388-835-0x000001D81CA90000-0x000001D81CAC2000-memory.dmp
                                                                                                  Filesize

                                                                                                  200KB

                                                                                                • memory/1388-737-0x000001D81C530000-0x000001D81C57A000-memory.dmp
                                                                                                  Filesize

                                                                                                  296KB

                                                                                                • memory/1388-787-0x000001D81C9D0000-0x000001D81CA82000-memory.dmp
                                                                                                  Filesize

                                                                                                  712KB

                                                                                                • memory/1388-823-0x000001D803BD0000-0x000001D803BDC000-memory.dmp
                                                                                                  Filesize

                                                                                                  48KB

                                                                                                • memory/1388-825-0x000001D81C580000-0x000001D81C5D0000-memory.dmp
                                                                                                  Filesize

                                                                                                  320KB

                                                                                                • memory/1388-826-0x000001D81CC20000-0x000001D81CDA6000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.5MB

                                                                                                • memory/1388-827-0x000001D8040E0000-0x000001D804102000-memory.dmp
                                                                                                  Filesize

                                                                                                  136KB

                                                                                                • memory/1388-828-0x000001D81CB50000-0x000001D81CC02000-memory.dmp
                                                                                                  Filesize

                                                                                                  712KB

                                                                                                • memory/1388-829-0x000001D804110000-0x000001D804132000-memory.dmp
                                                                                                  Filesize

                                                                                                  136KB

                                                                                                • memory/1388-831-0x000001D804150000-0x000001D80416C000-memory.dmp
                                                                                                  Filesize

                                                                                                  112KB

                                                                                                • memory/1388-832-0x000001D81D900000-0x000001D81DDCC000-memory.dmp
                                                                                                  Filesize

                                                                                                  4.8MB

                                                                                                • memory/1388-839-0x000001D81D430000-0x000001D81D552000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.1MB

                                                                                                • memory/2284-940-0x0000064449A20000-0x0000064449B18000-memory.dmp
                                                                                                  Filesize

                                                                                                  992KB

                                                                                                • memory/3124-920-0x00000644451A0000-0x00000644454A4000-memory.dmp
                                                                                                  Filesize

                                                                                                  3.0MB

                                                                                                • memory/4052-729-0x00000000001F0000-0x00000000001F8000-memory.dmp
                                                                                                  Filesize

                                                                                                  32KB

                                                                                                • memory/4472-1427-0x000001BA60E30000-0x000001BA60E3A000-memory.dmp
                                                                                                  Filesize

                                                                                                  40KB

                                                                                                • memory/4472-1424-0x000001BA60980000-0x000001BA60990000-memory.dmp
                                                                                                  Filesize

                                                                                                  64KB

                                                                                                • memory/4472-1459-0x000001C262B60000-0x000001C263306000-memory.dmp
                                                                                                  Filesize

                                                                                                  7.6MB

                                                                                                • memory/4472-1432-0x000001BA61840000-0x000001BA61DE4000-memory.dmp
                                                                                                  Filesize

                                                                                                  5.6MB

                                                                                                • memory/4472-1429-0x000001BA60E70000-0x000001BA60E7C000-memory.dmp
                                                                                                  Filesize

                                                                                                  48KB

                                                                                                • memory/4472-1430-0x000001BA60F00000-0x000001BA60F26000-memory.dmp
                                                                                                  Filesize

                                                                                                  152KB

                                                                                                • memory/4472-1431-0x000001BA60ED0000-0x000001BA60EDE000-memory.dmp
                                                                                                  Filesize

                                                                                                  56KB

                                                                                                • memory/4472-1420-0x000001BA42540000-0x000001BA428CA000-memory.dmp
                                                                                                  Filesize

                                                                                                  3.5MB

                                                                                                • memory/4472-1428-0x000001BA60E40000-0x000001BA60E48000-memory.dmp
                                                                                                  Filesize

                                                                                                  32KB

                                                                                                • memory/4472-1426-0x000001BA60E50000-0x000001BA60E6A000-memory.dmp
                                                                                                  Filesize

                                                                                                  104KB

                                                                                                • memory/4472-1425-0x000001BA610B0000-0x000001BA6128A000-memory.dmp
                                                                                                  Filesize

                                                                                                  1.9MB

                                                                                                • memory/4472-1433-0x000001BA5FF40000-0x000001BA5FF48000-memory.dmp
                                                                                                  Filesize

                                                                                                  32KB

                                                                                                • memory/4472-1423-0x000001BA60990000-0x000001BA609A2000-memory.dmp
                                                                                                  Filesize

                                                                                                  72KB

                                                                                                • memory/4472-1422-0x000001BA60E80000-0x000001BA60EC2000-memory.dmp
                                                                                                  Filesize

                                                                                                  264KB

                                                                                                • memory/4472-1421-0x000001BA608B0000-0x000001BA608BC000-memory.dmp
                                                                                                  Filesize

                                                                                                  48KB

                                                                                                • memory/5244-955-0x0000064443EC0000-0x0000064443F11000-memory.dmp
                                                                                                  Filesize

                                                                                                  324KB

                                                                                                • memory/5424-987-0x0000064445320000-0x000006444561E000-memory.dmp
                                                                                                  Filesize

                                                                                                  3.0MB

                                                                                                • memory/5696-1022-0x0000064449980000-0x00000644499D8000-memory.dmp
                                                                                                  Filesize

                                                                                                  352KB

                                                                                                • memory/5868-1198-0x0000064488000000-0x000006448802B000-memory.dmp
                                                                                                  Filesize

                                                                                                  172KB

                                                                                                • memory/5868-1037-0x000006443CC40000-0x000006443CEF8000-memory.dmp
                                                                                                  Filesize

                                                                                                  2.7MB

                                                                                                • memory/5984-1150-0x00000163719E0000-0x0000016372A09000-memory.dmp
                                                                                                  Filesize

                                                                                                  16.2MB

                                                                                                • memory/5984-1126-0x000001636BD30000-0x000001636BD56000-memory.dmp
                                                                                                  Filesize

                                                                                                  152KB

                                                                                                • memory/6008-1193-0x0000023F2ADA0000-0x0000023F2ADB8000-memory.dmp
                                                                                                  Filesize

                                                                                                  96KB