5f6a8f0e85704eb30340a872eec136623e57ab014b4dd165c68dd8cd76143923

Resubmissions

28/06/2024, 02:19

240628-cr3n9swcqg 8

21/06/2024, 17:11

20/06/2024, 14:32

13/06/2024, 21:29

13/06/2024, 21:24

13/06/2024, 21:01

Analysis

max time kernel
390s
max time network
391s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
20/06/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VineMEMZ-Original.exe
Size

39.6MB
MD5

b949ba30eb82cc79eeb7c2d64f483bcb
SHA1

8361089264726bb6cff752b3c137fde6d01f4d80
SHA256

5f6a8f0e85704eb30340a872eec136623e57ab014b4dd165c68dd8cd76143923
SHA512

e2acd4fe7627e55be3e019540269033f65d4954831a732d7a4bd50607260cd2a238832f604fa344f04be9f70e8757a9f2d797de37b440159a16bf3a6359a759b
SSDEEP

786432:1fhwEXgLYTou24XbHzjkgV5bQAH/AbkP1hn0qPQPrhBPC7wYqljbdPIa:dqgb84DPn5vhbIPdZaWljbdPIa

Score

8^/10

bootkit discovery persistence ransomware spyware stealer

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	tv_enua.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	MSAGENT.EXE

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 14 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "rekt.exe"	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "rekt.exe"	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe	MEMZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "rekt.exe"	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	MEMZ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe	MEMZ.exe

Deletes itself 1 IoCs

pid	Process
5460	Installer.exe

Executes dropped EXE 10 IoCs

pid	Process
4764	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
1848	MEMZ.exe
3472	MEMZ.exe
4872	tree.exe
5460	Installer.exe
6716	MSAGENT.EXE
4076	tv_enua.exe
2216	AgentSvr.exe

Loads dropped DLL 14 IoCs

pid	Process
5460	Installer.exe
5460	Installer.exe
6716	MSAGENT.EXE
4076	tv_enua.exe
7684	regsvr32.exe
7984	regsvr32.exe
7984	regsvr32.exe
8028	regsvr32.exe
8156	regsvr32.exe
8172	regsvr32.exe
5908	regsvr32.exe
1392	regsvr32.exe
3756	regsvr32.exe
612	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\DesktopXmasTree = "C:\\Users\\Admin\\AppData\\Roaming\\Data\\tree.exe"	tree.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	tv_enua.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 8 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	Installer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	Installer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	Installer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Installer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	Installer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Installer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	Installer.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	Installer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SETC6C7.tmp	tv_enua.exe
File created	C:\Windows\SysWOW64\SETC6C7.tmp	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\msvcp50.dll	tv_enua.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Data\\Pussy.png"	MEMZ.exe

Drops file in Windows directory 55 IoCs

description	ioc	Process
File created	C:\Windows\msagent\SETC6AA.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SETC6AC.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\mslwvtts.dll	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\tv_enua.dll	tv_enua.exe
File opened for modification	C:\Windows\INF\SETC6B7.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentDp2.dll	MSAGENT.EXE
File opened for modification	C:\Windows\fonts\SETC6B6.tmp	tv_enua.exe
File opened for modification	C:\Windows\INF\tv_enua.inf	tv_enua.exe
File created	C:\Windows\msagent\SETC694.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC697.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\intl\SETC6AE.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\tv\SETC6B3.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\tv\tvenuax.dll	tv_enua.exe
File opened for modification	C:\Windows\msagent\intl\SETC6AE.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC6AC.tmp	MSAGENT.EXE
File created	C:\Windows\help\SETC6AD.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\help\SETC6B5.tmp	tv_enua.exe
File created	C:\Windows\msagent\SETC697.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentPsh.dll	MSAGENT.EXE
File created	C:\Windows\MsAgent\chars\Bonzi.acs	Installer.exe
File opened for modification	C:\Windows\msagent\AgentSvr.exe	MSAGENT.EXE
File opened for modification	C:\Windows\INF\SETC6AB.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentCtl.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC698.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SETC698.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\SETC6B3.tmp	tv_enua.exe
File created	C:\Windows\INF\SETC6B7.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentMPx.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentSR.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC6A9.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC6AA.tmp	MSAGENT.EXE
File created	C:\Windows\INF\SETC6AB.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\agtinst.inf	MSAGENT.EXE
File opened for modification	C:\Windows\help\SETC6AD.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\tv\SETC6B4.tmp	tv_enua.exe
File created	C:\Windows\msagent\SETC6A9.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\intl\Agt0409.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC6AF.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgtCtl15.tlb	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\help\SETC6B5.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\SETC693.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC694.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SETC6AF.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\fonts\andmoipa.ttf	tv_enua.exe
File created	C:\Windows\msagent\SETC693.tmp	MSAGENT.EXE
File created	C:\Windows\fonts\SETC6B6.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentDPv.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC695.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SETC695.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SETC696.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\help\Agt0409.hlp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\SETC6B4.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\help\tv_enua.hlp	tv_enua.exe
File created	C:\Windows\msagent\SETC696.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentAnm.dll	MSAGENT.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D7A6D440-8872-11D1-9EC6-00C04FD7081F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D7A6D440-8872-11D1-9EC6-00C04FD7081F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C8F-7B81-11D0-AC5F-00C04FD97575}\TypeLib\Version = "2.0"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE1-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtlCommands"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BF0-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtlAudioObjectEx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C87-7B81-11D0-AC5F-00C04FD97575}	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95A893C3-543A-11D0-AC45-00C04FD97575}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0913412-3B44-11D1-ACBA-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1DAB85C3-803A-11D0-AC63-00C04FD97575}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\InprocServer32\ = "C:\\Windows\\msagent\\AgentCtl.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C91-7B81-11D0-AC5F-00C04FD97575}\ = "IAgent"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C89-7B81-11D0-AC5F-00C04FD97575}\TypeLib	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Control.2	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}\1.5\0\win32\ = "C:\\Windows\\msagent\\AgtCtl15.tlb"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08C75162-3C9C-11D1-91FE-00C04FD701A5}\TypeLib\Version = "2.0"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B77181C-D3EF-11D1-8500-00C04FA34A14}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BF0-7DE6-11D0-91FE-00C04FD701A5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE3-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtlCommand"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1DAB85C3-803A-11D0-AC63-00C04FD97575}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8563FF20-8ECC-11D1-B9B4-00C04FD97575}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D6589123-FC70-11D0-AC94-00C04FD97575}	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08C75162-3C9C-11D1-91FE-00C04FD701A5}\ = "IAgentNotifySinkEx"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BD9-7DE6-11D0-91FE-00C04FD701A5}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C89-7B81-11D0-AC5F-00C04FD97575}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48D12BA0-5B77-11D1-9EC1-00C04FD7081F}	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C8F-7B81-11D0-AC5F-00C04FD97575}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BD3-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4BAC124B-78C8-11D1-B9A8-00C04FD97575}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7B93C73-7B81-11D0-AC5F-00C04FD97575}\2.0	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE8-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{822DB1C0-8879-11D1-9EC6-00C04FD7081F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D0ECB23-9968-11D0-AC6E-00C04FD97575}\TypeLib	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B8F2846E-CE36-11D0-AC83-00C04FD97575}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C8D-7B81-11D0-AC5F-00C04FD97575}\TypeLib	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C85-7B81-11D0-AC5F-00C04FD97575}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BF0-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{143A62C8-C33B-11D1-84FE-00C04FA34A14}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D45FD31B-5C6E-11D1-9EC1-00C04FD7081F}\ToolboxBitmap32\ = "C:\\Windows\\msagent\\AgentCtl.dll, 105"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00D18159-8466-11D0-AC63-00C04FD97575}	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D0ECB23-9968-11D0-AC6E-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DE8EF600-2F82-11D1-ACAC-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C91-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7B93C91-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6BA90C01-3910-11D1-ACB3-00C04FD97575}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE3-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE8-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtlCharacters"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BD9-7DE6-11D0-91FE-00C04FD701A5}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8563FF20-8ECC-11D1-B9B4-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}\1.5\HELPDIR\ = "C:\\Windows\\msagent\\"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BD9-7DE6-11D0-91FE-00C04FD701A5}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BA90C00-3910-11D1-ACB3-00C04FD97575}	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6BA90C00-3910-11D1-ACB3-00C04FD97575}\TypeLib	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Control\CurVer\ = "Agent.Control.2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE3-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtlCommand"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{08C75162-3C9C-11D1-91FE-00C04FD701A5}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}\1.5\0	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A7B93C83-7B81-11D0-AC5F-00C04FD97575}\ = "IAgentCommand"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Server\CurVer	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE8-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BE1-7DE6-11D0-91FE-00C04FD701A5}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1848	MEMZ.exe
1848	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4024	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4608	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4608	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
4024	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4024	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4608	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe
4024	MEMZ.exe
1848	MEMZ.exe
1848	MEMZ.exe
4024	MEMZ.exe
4608	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3472	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 62 IoCs

pid	Process
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1312	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1312	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3472	MEMZ.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
3472	MEMZ.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe
680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 4764	1104	VineMEMZ-Original.exe	77
PID 1104 wrote to memory of 4764	1104	VineMEMZ-Original.exe	77
PID 1104 wrote to memory of 4764	1104	VineMEMZ-Original.exe	77
PID 4764 wrote to memory of 4608	4764	MEMZ.exe	78
PID 4764 wrote to memory of 4608	4764	MEMZ.exe	78
PID 4764 wrote to memory of 4608	4764	MEMZ.exe	78
PID 4764 wrote to memory of 4024	4764	MEMZ.exe	79
PID 4764 wrote to memory of 4024	4764	MEMZ.exe	79
PID 4764 wrote to memory of 4024	4764	MEMZ.exe	79
PID 4764 wrote to memory of 1848	4764	MEMZ.exe	80
PID 4764 wrote to memory of 1848	4764	MEMZ.exe	80
PID 4764 wrote to memory of 1848	4764	MEMZ.exe	80
PID 4764 wrote to memory of 3472	4764	MEMZ.exe	81
PID 4764 wrote to memory of 3472	4764	MEMZ.exe	81
PID 4764 wrote to memory of 3472	4764	MEMZ.exe	81
PID 3472 wrote to memory of 2664	3472	MEMZ.exe	82
PID 3472 wrote to memory of 2664	3472	MEMZ.exe	82
PID 3472 wrote to memory of 2664	3472	MEMZ.exe	82
PID 3472 wrote to memory of 680	3472	MEMZ.exe	84
PID 3472 wrote to memory of 680	3472	MEMZ.exe	84
PID 680 wrote to memory of 5088	680	msedge.exe	85
PID 680 wrote to memory of 5088	680	msedge.exe	85
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 1256	680	msedge.exe	86
PID 680 wrote to memory of 2820	680	msedge.exe	87
PID 680 wrote to memory of 2820	680	msedge.exe	87

C:\Users\Admin\AppData\Local\Temp\VineMEMZ-Original.exe
"C:\Users\Admin\AppData\Local\Temp\VineMEMZ-Original.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4608
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4024
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1848
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    /main
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Sets desktop wallpaper using registry
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://search.wow.com/search?q=limp+bizkit+mp3+download
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:5088
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2056 /prefetch:2
        5⤵
        
        PID:1256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
        5⤵
        
        PID:2820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:8
        5⤵
        
        PID:3832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
        5⤵
        
        PID:1460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
        5⤵
        
        PID:2152
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
        5⤵
        
        PID:4268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
        5⤵
        
        PID:2452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3984 /prefetch:8
        5⤵
        
        PID:3856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
        5⤵
        
        PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
        5⤵
        
        PID:3664
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
        5⤵
        
        PID:4728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
        5⤵
        
        PID:4176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
        5⤵
        
        PID:2512
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:1588
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
        5⤵
        
        PID:1068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
        5⤵
        
        PID:340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
        5⤵
        
        PID:2216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5920 /prefetch:8
        5⤵
        
        PID:780
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3616 /prefetch:8
        5⤵
        
        PID:1816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
        5⤵
        
        PID:4276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        
        PID:1216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
        5⤵
        
        PID:2024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
        5⤵
        
        PID:2244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:1
        5⤵
        
        PID:1720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
        5⤵
        
        PID:2828
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
        5⤵
        
        PID:248
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
        5⤵
        
        PID:4604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7340 /prefetch:1
        5⤵
        
        PID:2632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
        5⤵
        
        PID:700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
        5⤵
        
        PID:3024
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7812 /prefetch:1
        5⤵
        
        PID:5204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7088 /prefetch:1
        5⤵
        
        PID:5652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:1
        5⤵
        
        PID:5748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:1
        5⤵
        
        PID:6080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
        5⤵
        
        PID:4040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
        5⤵
        
        PID:5136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8156 /prefetch:1
        5⤵
        
        PID:3916
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7684 /prefetch:2
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:1
        5⤵
        
        PID:2720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8472 /prefetch:1
        5⤵
        
        PID:5308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
        5⤵
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8648 /prefetch:1
        5⤵
        
        PID:5236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8452 /prefetch:1
        5⤵
        
        PID:5056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8852 /prefetch:1
        5⤵
        
        PID:408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8668 /prefetch:1
        5⤵
        
        PID:5444
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8704 /prefetch:1
        5⤵
        
        PID:2360
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
        5⤵
        
        PID:3108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9188 /prefetch:1
        5⤵
        
        PID:5372
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8544 /prefetch:1
        5⤵
        
        PID:1328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8196 /prefetch:1
        5⤵
        
        PID:2244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9032 /prefetch:1
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9620 /prefetch:1
        5⤵
        
        PID:5404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9540 /prefetch:1
        5⤵
        
        PID:6392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9360 /prefetch:1
        5⤵
        
        PID:6488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9704 /prefetch:1
        5⤵
        
        PID:4592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9392 /prefetch:1
        5⤵
        
        PID:6296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9940 /prefetch:1
        5⤵
        
        PID:6584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9860 /prefetch:1
        5⤵
        
        PID:6672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8972 /prefetch:1
        5⤵
        
        PID:4708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10280 /prefetch:1
        5⤵
        
        PID:3424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
        5⤵
        
        PID:7080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10072 /prefetch:1
        5⤵
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6772 /prefetch:1
        5⤵
        
        PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10460 /prefetch:1
        5⤵
        
        PID:6912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9188 /prefetch:1
        5⤵
        
        PID:5072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10872 /prefetch:1
        5⤵
        
        PID:6812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10064 /prefetch:1
        5⤵
        
        PID:4836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10232 /prefetch:1
        5⤵
        
        PID:5800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10592 /prefetch:1
        5⤵
        
        PID:6492
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,2533047642745563641,14005972479893790229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10720 /prefetch:1
        5⤵
        
        PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://search.wow.com/search?q=snow+halation+midi
      4⤵
      PID:1324
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=mp3+midi+converter
      4⤵
      PID:4896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=expand+dong
      4⤵
      PID:3820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ask.com/web?q=cortana+is+the+new+bonzi
      4⤵
      PID:984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:1108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=bad+ass+mafia+toolbar
      4⤵
      PID:1924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays
      4⤵
      PID:6132
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=pussy+destroyer
      4⤵
      PID:5600
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=cool+toolbars
      4⤵
      PID:5996
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:6016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=smash+mouth+all+star+midi
      4⤵
      PID:5812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:5824
  - - C:\Users\Admin\AppData\Roaming\Data\tree.exe
      "C:\Users\Admin\AppData\Roaming\Data\tree.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://search.wow.com/search?q=bonzi+buddy+download+free
      4⤵
      PID:1120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://search.wow.com/search?q=grand+dad+rom+download
      4⤵
      PID:2900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x7c,0x80,0x84,0x78,0xec,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.youtube.com/results?search_query=tootorals
      4⤵
      PID:5868
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=cat+desktop
      4⤵
      PID:200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=fuck+bees
      4⤵
      PID:4036
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x108,0x10c,0x110,0xe4,0x80,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=succ
      4⤵
      PID:2020
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=animated+christmas+tree+for+desktop
      4⤵
      PID:772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ask.com/web?q=preventon+antivirus+download
      4⤵
      PID:6320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://search.wow.com/search?q=how+to+get+cursormania+in+2016
      4⤵
      PID:7104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:7116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
      4⤵
      PID:6236
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:6248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=myfelix+download
      4⤵
      PID:6556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:6564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ask.com/web?q=skrillex+scay+onster+an+nice+sprites+midi
      4⤵
      PID:6984
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:6968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://ask.com/web?q=is+bonzi+buddy+a+virus
      4⤵
      PID:6204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:6316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=smileystoolbar+download
      4⤵
      PID:6176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.bing.com/search?q=free+midi+download
      4⤵
      PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://search.yahoo.com/search;?p=john+cena+midi+legit+not+converted
      4⤵
      PID:6516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe1c3b3cb8,0x7ffe1c3b3cc8,0x7ffe1c3b3cd8
        5⤵
        
        PID:6616
  - - C:\Users\Admin\AppData\Roaming\Data\Installer.exe
      "C:\Users\Admin\AppData\Roaming\Data\Installer.exe"
      4⤵
      Deletes itself
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Drops file in Windows directory
      PID:5460
    - - C:\Windows\SysWOW64\CScript.exe
        
        "C:\Windows\system32\CScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bonzi\run.vbs" //e:vbscript //B //NOLOGO
        5⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Runtimes\MSAGENT.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\Runtimes\MSAGENT.EXE" /Q
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:6716
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:7684
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
        7⤵
        Loads dropped DLL
        
        PID:8156
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:8172
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
        7⤵
        Loads dropped DLL
        
        PID:5908
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:1392
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
        7⤵
        Loads dropped DLL
        
        PID:3756
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:612
        
        C:\Windows\msagent\AgentSvr.exe
        
        "C:\Windows\msagent\AgentSvr.exe" /regserver
        7⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\grpconv.exe
        
        grpconv.exe -o
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Runtimes\tv_enua.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Runtimes\tv_enua.exe" /Q
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        
        PID:4076
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
        7⤵
        Loads dropped DLL
        
        PID:7984
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
        7⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\grpconv.exe
        
        grpconv.exe -o
        7⤵
        
        PID:8052

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004E0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c1c7e2f451eb3836d23007799bc21d5f

SHA1
11a25f6055210aa7f99d77346b0d4f1dc123ce79

SHA256
429a870d582c77c8a661c8cc3f4afa424ed5faf64ce722f51a6a74f66b21c800

SHA512
2ca40bbbe76488dff4b10cca78a81ecf2e97d75cd65f301da4414d93e08e33f231171d455b0dbf012b2d4735428e835bf3631f678f0ab203383e315da2d23a34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6876cbd342d4d6b236f44f52c50f780f

SHA1
a215cf6a499bfb67a3266d211844ec4c82128d83

SHA256
ca5a6320d94ee74db11e55893a42a52c56c8f067cba35594d507b593d993451e

SHA512
dff3675753b6b733ffa2da73d28a250a52ab29620935960673d77fe2f90d37a273c8c6afdf87db959bdb49f31b69b41f7aa4febac5bbdd43a9706a4dd9705039

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
36KB

MD5
4f6875803e0a9a11f922be9475faca68

SHA1
b12a9805a4f1a76155714c1fd1cee1428afe9580

SHA256
0638fbbd994d7bccbe9a0d05cb3b031d3f1291ed4c70d4f1b08ea687b8b30aac

SHA512
a0492243a8891d704e8734b4f9d002fa82fa2b106ab09bb233f6e9542faf0beafb117d015559784285141d7e05975032edb77158f21a961c957cc91b773844a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
16KB

MD5
4da08e95702be2c98662c6e62a19994a

SHA1
b665be7a9177147ef9b72870fdfee58d4daedb80

SHA256
69fed175cc1393b9c0fb7a21b7b80d1160d2b6d02502d02cd97e9a5c2dbcd803

SHA512
1ece99b45362786fcb8e7aae6cd1273013a1049cf2657e568d9c2d5fb36f446fb18bb4b42cde12f07d86bc934c36798ae6b87e460bb32d890cd9b5a9dbcf5752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
74KB

MD5
63d1008932f8b3d8ccd800dc3e1a6fd9

SHA1
a9a7033f5960cb0786e4aa3205be13a63f2923aa

SHA256
b1b773c1f65b07222f506f3e204bf6eb7aa3f263dd273c31683c9405f0710dc1

SHA512
f36d00b0f6d06f26815fc8475470bea1383eb1872558db0900bf91e680bfead05ec9844270bac917993016057b31fe599cbe1f15a09d856709918c7b76fcac21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
5d0e354e98734f75eee79829eb7b9039

SHA1
86ffc126d8b7473568a4bb04d49021959a892b3a

SHA256
1cf8ae1c13406a2b4fc81dae6e30f6ea6a8a72566222d2ffe9e85b7e3676b97e

SHA512
4475f576a2cdaac1ebdec9e0a94f3098e2bc84b9a2a1da004c67e73597dd61acfbb88c94d0d39a655732c77565b7cc06880c78a97307cb3aac5abf16dd14ec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
69KB

MD5
76c36bd1ed44a95060d82ad323bf12e0

SHA1
3d85f59ab9796a32a3f313960b1668af2d9530de

SHA256
5d0e5d5fdb4d16cf9341f981b6e4a030f35d4766ad945c27381f8d3afb624542

SHA512
9f0555fb531734b786364701e17cb7f57ce94a688d4616fb85bf32cad45a253a9c479a301e05a4f8630cfea141dd52726a31b8e90198c19c16f33fb150a04a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
42KB

MD5
748f143f9412c4b4f40b2fbe2f6922ec

SHA1
0fb9c1ea3fec9acb2fe0fde54524668f70643231

SHA256
4dfcdf7bb12d6a7c91d7f3367e5611b30a90d661e3c5c04bbdcc2c60005706ec

SHA512
8696a1dec04563a939a5fa9d7a67026c32272d27a7758f05eeb95cd39a0fd0d129b69d5984400954b230c09335d84fe4a1b6e53477e16144b6648cd01ae7514b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
64KB

MD5
2923c306256864061a11e426841fc44a

SHA1
d9bb657845d502acd69a15a66f9e667ce9b68351

SHA256
5bc3f12e012e1a39ac69afba923768b758089461ccea0b8391f682d91c0ed2fa

SHA512
f2614f699ac296ee1f81e32955c97d2c13177714dbd424e7f5f7de0d8869dd799d13c64929386ac9c942325456d26c4876a09341d17d7c9af4f80695d259cfea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
19KB

MD5
635efe262aec3acfb8be08b7baf97a3d

SHA1
232b8fe0965aea5c65605b78c3ba286cefb2f43f

SHA256
8a4492d1d9ca694d384d89fa61cf1df2b04583c64762783313029ae405cbfa06

SHA512
d4b21b43b67697f1c391147691d8229d429082c389411167386f5c94e3a798f26c2457adf6d06caec446106e0f0aa16d895bfc4e8a1ff9e9c21a51173a923e3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
88KB

MD5
77e89b1c954303a8aa65ae10e18c1b51

SHA1
e2b15a0d930dcc11f0b38c95b1e68d1ca8334d73

SHA256
069a7cc0309c5d6fc99259d5d5a8e41926996bbae11dc8631a7303a0c2d8c953

SHA512
5780d3532af970f3942eecf731a43f04b0d2bdb9c0f1a262dbd1c3980bcc82fe6d2126236ad33c48ea5434d376de2214d84a9a2ccec46a0671886fe0aa5e5597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
1.2MB

MD5
e5622114d3b8e67d1a75e35f8c9e0414

SHA1
c02c68a3df90ff2c81fb46989bb2236f8a1d275a

SHA256
f8935be61874372cd0cfbd7536c87f6caaf3cf6de95bd148f28d19102d3a2e81

SHA512
ccc2722db5ed5fc0111f52b802327fb1ad20bb4123ead20248041b116a913b6e900e24ef326e352f776cca1dba9322e85c98feefe39b0da19478f0041091907a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
32KB

MD5
e529668d3aa5f8f348e27e6ef2b04212

SHA1
bb9875cf7a3db027e78fa28e18c718b3554eff60

SHA256
b42f812971f896d4d415df864066588e7f0a2b24d2e5c8078b333d9e7829d563

SHA512
cde1008c536ba2cd3e9b8e5470eb2d40c39af3f41b2acc7947810fdb7b640190630865839f830e889eed458a684c1c788fa3ec478ee3aec41eb88fc2ecb8837d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
74KB

MD5
c88f69b53606b96dff18c7924bf8bde3

SHA1
29fa7b32032ecb1564cb6627a9ec3148cea894b5

SHA256
1f7c691bd43a49b47ed23e255c411638953439fa83e5133356aab6e59fe0fb29

SHA512
0cc60147c4b0912a9105706e0112e12172679f43896a0ba66085224802bfc6d1b31d2fcfc744b41fd64e37f75183403dd20e0fe43066a60a452c59fd55b385e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
204KB

MD5
081c4aa5292d279891a28a6520fdc047

SHA1
c3dbb6c15f3555487c7b327f4f62235ddb568b84

SHA256
12cc87773068d1cd7105463287447561740be1cf4caefd563d0664da1f5f995f

SHA512
9a78ec4c2709c9f1b7e12fd9105552b1b5a2b033507de0c876d9a55d31678e6b81cec20e01cf0a9e536b013cdb862816601a79ce0a2bb92cb860d267501c0b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
102KB

MD5
c1a58e756c52f846a085e06c60958fd1

SHA1
b3f8a2a7f64ee36541978b815db533ac15ee3297

SHA256
1f7a16b6d31773a13e9f996455e3556291d8b45907633bb640e23920da2f0ef1

SHA512
56057877b4124d98e8159d4f5a2d54388c4714431134ec16734653a69389ff08b993001a31e07f79cf25076118894dea96189f4536c8992b8830dc2e69a31178

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
42KB

MD5
eb856afc582068f68bc3dbb589b19c70

SHA1
5e718b9c674105c140e72200cd901d6471097aea

SHA256
30592900de834802e07b665ebc13a6a495956d248c8dc23aeb316dd877e5a7ec

SHA512
60f55078e15e80ea37d389620b2ef7df5cc7fc461d24f59383a1910140e7fd9e5b2551816641fbb7b16e262b41173c72e1e33a119af6d9feb28ddaa49e771a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
81KB

MD5
4f2c68020bfc37a97bfb3fb570a3d614

SHA1
b9731986d617fd4bbff342a253844ed896b2ebe1

SHA256
000242b50762afb981813070d02bf202e0043fd33bd3ad7fb3b17b30970e3175

SHA512
1e9377239312d7dc82cc1ece14fd785171764cb54b1e98ab904ee72a69934670cf0d173a2c5f529b2609050385b49b3aba7cdbb1df275478624d6c6a4fcad06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
71KB

MD5
e824a2c6822086db6ddf5d10c788d0e8

SHA1
0e868f1f1f5df76a4e0ebc03c900dca233fa96e0

SHA256
ee0da27cfc145ac66236ecc427bab7be4bbd7d5fa5b456f7f82bdf380868fbe4

SHA512
3f2cc6b3ed20705d03e0849e65465bca8aba5adbd0cc5e8bf7372e0aad731757103f29df43c460d0c7cbfcee58e494c3ade57871b288533302cc136094027def

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
29KB

MD5
ffc507ab662c24424f3fcb9e8d2eecf9

SHA1
f447984c038d8ece67915c0492e8610894dbc255

SHA256
0468c9bba7e5bb67ac35bc4f4609a257e6fc542e4faddcb494e285e60e9bf170

SHA512
6cecb73607062e2f7280b2cd0f33c014b1fc5190c34120452bd297001b0ed585dc35a451fda300de6864098896a76006a6577ffcc98fd8c0b0d4ed7f961ebece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
66KB

MD5
7349ef7e728129b7d89757a4e122b497

SHA1
15eb4460f4a1eb6f289f922f22c0eedd1c8a7d5d

SHA256
21911c52d304a3020f4ec1c077e0031900481c6a6d8e21eead6c4cd49ec57a74

SHA512
00bd9ea04d9b8daf22d4d3d059f9ca4eeb314fe39c03473bbfcb3630cbe82bf197e405dd70716b1c001036a653d3cc2ebdcf4b3de0045ba5f8d849df22b0db3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
121KB

MD5
34243f49b6ea2885fba9f5fa0ba7bb50

SHA1
542b80c24b5cfe1ed1662b3a5f3a8e3b5e86da13

SHA256
d0d69818762727acfcee3b19548df74ead948a90e28550d8af476ca64337b89b

SHA512
5446316e3d56fd9d82a874a0a62b8beff1ad189cdd01b4936520f735cfeb6a0c9d59e756cd3d857ed50a70142073b17a48d2a171bcfd53ff42ee54871743eab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
108KB

MD5
9406b89dec207a27c239b8109fd4d4ae

SHA1
ecb51f231a2fd844c40a3db3585bb7884e8852f2

SHA256
23505106ffff8ecf2035e48901fc87383ccbb414257ab635551a5f3612584af6

SHA512
3f1778ea36c5eb95a8d4b09c86148dcd1825873e442c6262159dbba74c995dedd6c094551c9c1cbeb93abbeacd74f61b6246a1e07d5fc3232b80f366beb7bf7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
87KB

MD5
9a7bfc75b864a7a4ffbc8e34eaa13471

SHA1
9ff80fbf8bab8f736a78cbddabed5d16a6b51b77

SHA256
046c7d00bea7a427e2d46b0595f12f3f64a0113bf8d7959b4739871e54f2dda0

SHA512
62f4422d95644ca23c85843158d9436a16c8d0c67347b1f8e62d2cbe87bce3f15367b587c642265fa6be74bea920bcb625848f3a51405fef215be02b98a957d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
17KB

MD5
1e4735c660b416b6cb48dd090ee3a3f9

SHA1
6b6adb675851683fede27b5a878ce5c16df47f41

SHA256
6c57fd5f2ce4bd4deb7675632c3d34fb53410ab2ced994a870a05277be2af531

SHA512
838de6f4bf6b4fe50394434895c2f4b69925d0804fc2b9b0a170991e66f23f67c871495ebab7b0b4fde31944e14a9846ab1873c68388a7c67183e5c9f4ec42f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000057

Filesize
18KB

MD5
c465bff276dd43865df51a487bfddeaf

SHA1
e664ebd03b6d6df093c757ca70786bfcc5318aed

SHA256
f798357b7d2769f3f294c3581d1cc540468bd46be22d976152c991162b249e62

SHA512
2298df8651e6a5414631302530baaa6f596878465ef159cd46aad138040861893418fde7b8d4e26e7cdabb81b19855817861c0ec3eb1a0bda80810ab83ca07b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0344fd820bb6753b_0

Filesize
1KB

MD5
3d012083e5b2ffba240c74c86bfa9aa5

SHA1
5e20eaf14a97cf1f8bbb72c5622828c74588e9cc

SHA256
23df122957bd493df5294d62cd4b29fae760f1217274d5efe7b1ea2ee5dfaa14

SHA512
f11856c74cc3c98b7e796b125f72cfb7282812a3ecf9c679835e7e4e1dc4c8f8eb3d6ccba3e000d7d987987779fbaf0c16c54cb7e611c4f84da5134efef89259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0de8c10d9c612138_0

Filesize
7KB

MD5
12f1c292be19a15ffaf9825a3deaa22e

SHA1
5b14983eb60a25867f9ee8a17efad3ced04642cc

SHA256
56b5d491909cb3c847faf392badb5a9b30180e0c006623e3c0b710a671f491ab

SHA512
ed4686d4c1f97930f9a2bfbe436efc880832073c3a59d61fbbc8d2080b353eba2f52238d8a0a0a8fe2fb0e4fafe5ff6e112b9f56f873793cc0f29d8806f4e01b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1335940a5a13f354_0

Filesize
9KB

MD5
9b7d5cac9ee4bf1b28d58607287459ef

SHA1
ec07c56e530db4cb310d73a8ca4d429ed9b0636f

SHA256
ef63d039078f25caa121734f999da1df0c5cea28679f58ba5bf7a95c04dc758d

SHA512
19d45f2805d28a7a2e23eb69b65609e29b944a7de87642398d290df6a7930b91c690c93f10e4ffd5ae6a5b4226cd6734a6615b0a4abb1a6383f5ab8210ba057d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1b342244409a7f5b_0

Filesize
1KB

MD5
a6d5978172963a16a1a22087bb6017ae

SHA1
9d4ee91fc32200f94eeda832dfaa6600b27db6ea

SHA256
07bc28c1af8383708fc4d56a399374dc6e35add3e7b7b0e7cb4c43998ee89f72

SHA512
13c89fc61732639274e07c4f6a10959250fb83e29d644dc7e6e2bd112618ff5a88108bf1fea907c762a9b60cf540db64e82a5e92e35d48c4fba66cecfdf844a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\209320cddeeadcf8_0

Filesize
1KB

MD5
12341489b480990ddb12e431b3e7b79d

SHA1
d27b269810fda615562a0a6709bb9636bb804bf8

SHA256
84c9c3d1ba4dff4ffa590d02a2bdeb1d373f4634697e53e0c8e4239d78337041

SHA512
a8e6a70d9db0ec8a4bfa5c6d3a7ef62bcd53463d53b30ed9f23e76efc0c7a96092bd4849a111fb8c46ab81330e39d251fc12a5ab5883e90c756c09d96f722c65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2311af0fca936641_0

Filesize
26KB

MD5
61ecf26910da5f8630e34f8918c8b89c

SHA1
7391315c63bc5d9a7f3ddf4952d11a306bc136c9

SHA256
4b856c472aaed0aea2063c246d861262cd519c519c7df4ea92964d97233e9227

SHA512
1b1f87e6ba7b4bd43a685a0229f85c79702a3e5f2154d34c4a3b15993ad89568cb58c3a955ed633d165c11147f2882498638af11c587d766ef6cd8460d6e1c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\231d80f54d2ec417_0

Filesize
2KB

MD5
e78ed8e0e13049101a2f86ed6cd90927

SHA1
db6b85c02c8e42cdd0d1f9c6753be3963a01975e

SHA256
6682db6a7b78698299084434b0fd9d7f8bdc68e2c6f0a76e698b15c3fa634513

SHA512
6bae4c35ba2ab6ee7637698ebcd1711632701c2d4d95113eb73cf8673dcd3fac59b071368f821a5033218d60b5b978be87d391fe31ebf3536f2f36410b2c030a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\23bb41b1bf0814a5_0

Filesize
5KB

MD5
9b802556329bbacfc547765d5da3afe0

SHA1
6a3b81522cc23012aef417ae11b5509f2bdb7c4d

SHA256
54f65f63b5c4cad5de2e2c086598db787328cfea346b77ae2502d303870d4bd5

SHA512
1769c45767ee2c03694b9d0de10f81c59fea75fc7f8261d61a5b1419c9e3a842d36ddb603a22356f293e1c2a7e3336f5fa9dffdd279da49e982884df045bb951

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25de1eb133c2ae6e_0

Filesize
11KB

MD5
20f628f9bc44e58a434480ba3d643c39

SHA1
f767fd16ce9c5e4bf5936565c1930786300d8ef4

SHA256
2f5494f9d558def40aa83abf7ed39a7434d45036cfa65740ed1c1666477cba77

SHA512
3a81cc192192163ad7c07ae894bc12306fadf068d1ec056f32957dd426c8c031118ec55f1225c4cc8cb407655e6e7e51598e99f495a354c7f55b6b9a6b57e580

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\26069886e990cc46_0

Filesize
3KB

MD5
f58f503d00c0076d543195f10babf3f8

SHA1
5beb3ec12af01c14084e79b2db5a5d1261e7a88d

SHA256
8f49d91d27e99240ba2054f6096869f4a060de516e030e7ac3b4d335db69c681

SHA512
25663dd0ba3f9ac19fbe98d3320413ac5fcf0b4938c8b5ded126bda59b5476334843997f02c80e1fc3ab2d496d7fbc73bd1369b23eae6a008d0f311283f5df35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3552e3a94b35b185_0

Filesize
2KB

MD5
a39d540d7b3fbcf4dcf8acf6943bf498

SHA1
509d57ceee084f60819f8d581135c4bf90181bb7

SHA256
cc7f04e4381e6bbc7bfd34de5b91f1553c870c98a289bd6fdde4876056c43299

SHA512
0c8bf46bd97f76f61ccede608b662056b6f236b1bcedbf63aca8d3dc469e0076f8a4fb16fff386bc57c2992403c98246b2259ad24a923281c8cfb194edda2263

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\395cd751464365fb_0

Filesize
3KB

MD5
b45efede67248f3723f12a4ac2675a62

SHA1
d7aed22789190592472cd3f9e580c5f5dffe2ac5

SHA256
6bb356b955dddcd0d7f3266f3182c6993e164e8ccca2bb54654358b4f0f3e53a

SHA512
216f5f109f17c93b3fad0f27febda7a1eff1ad9eba206cd7ebbbb7d2a6d667ea260645ed70d57b0bb799ac9a92bb05b97f56d9bd2170e7eed07f6f950941e502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3b3e0ce13da94924_0

Filesize
1KB

MD5
c9d5a91719554bf64ae34549f5f1a25b

SHA1
f6eacc7ea92fa83255ad73e4f14fed08ab6d8e8b

SHA256
b1164968bce1a56ed9dcbe469fd8d6510bc29a40574a5d7f2dc5b7e0a534ee1b

SHA512
1c23ca1cac7fe2020ecbead811d2ad81b0b03747f65afdeb10efda67f54b3d2451d1cf121c0d9bf0c8587d8316b41f51d3cc42a5323b9292249b7bf9e9d0f5c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fec95e34b9c456b_0

Filesize
2KB

MD5
3300665cc013865022cb027e7106798b

SHA1
c4c3340b26a927d6225dbd27a9361cdc3b308526

SHA256
e45f12ff2aafd427a9bccac43c92d9581a0bae6d76a5478797491c01d963930e

SHA512
ff3b0b7f47743c3f894537af208bdf9e100bf302a5e3dc1467d4c700276f85240ac330f8e22bfa92b4da62d417f72ed327d404829739a236ca2ff7028b4f9ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\407e4f62b57c62d5_0

Filesize
2KB

MD5
4d4d13d17913c45093fbc17a749e80c4

SHA1
52229673cc634b5330b128fb99855ff007d2afd3

SHA256
cc348570f10654f63f313c16865fa97ee74a846153b37a3ad21c0804912924d0

SHA512
1655569c40e10d4ee5d8f60eb10902c19c907d60070ecfb64bda610e7e321cf12bc3b129b01f57734e0a187f72fe3a2e0575c9b3b3da7f21090819810a7ba543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\434908b990fc87b2_0

Filesize
28KB

MD5
5deefc880b7a3027dc70ca4e5e3f312c

SHA1
5e3803bc2e1ef9c017b381432ebe7d7865c85bb0

SHA256
e6520175d0f2bd701b2eaff8677dedbb88cd4577ca367b8d874023418657035d

SHA512
b254d86fe523f4492bf05c317d17ec2311436cb4529633718b2eb2d0dffcb183c1bb4973e6551d622cc292f75458df248decad28d504c14f965d6c272164410d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\437445634e270822_0

Filesize
262B

MD5
8ee1336788f165eb3e836d15ee8ff7a6

SHA1
42c042e8c5237896820fc4d58fa176990dc4fdd3

SHA256
e43c0aaff2681f55a605c7baa865b1cf324ddc4bed68d16effded02ae28540df

SHA512
c1291ede7c805ea0148c159e8a59a174807269b4d00653deb8a15ca0783f6558efaeb5a9f3d66b6102833cdd38973b4198cc24b869d3ee08430761838be48b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\44d49f9dff020a86_0

Filesize
6KB

MD5
c9852ef853e5f2b68348c099cf891528

SHA1
3a8a44d79118af1575d56b861fba16cddb6176e5

SHA256
bff06064592a657ac147765bc83ee3df4ce25535ca129dccca12d90d652d6dda

SHA512
5886eec31b23fede2a2f7077b0d7701532150040a361513c4d50c61ea9de41438ad69e3533c8e58346b64d341e248008fc68f7cb47bc24a6827d7cb827c088e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\451170c3a768578d_0

Filesize
2KB

MD5
2c28ca4ffde12e4ca6276bb6d06ab5ce

SHA1
0a94bbab936390240f0d63504b03677163a3ff46

SHA256
cdf8f38b24cc6cde7a436e9c223e7d2e870da4ef1eaede06ffa5123dcaabe5cc

SHA512
6714e0d82ea9ae90d2b5b21bfc1eaf2d03cb3f33ed3a42858ae35fcb05b394b5a9db62eb5c035ae28ae0d1f6a64185c24c058023e2a38bbf1723f340368c90b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47f3e0be7720a1ee_0

Filesize
3KB

MD5
c40e00cd67c7460f89cbc07d607946d7

SHA1
b452c628cc73ae97a6f5c64b63e8006219e4c8aa

SHA256
01cee09b71381de6ad50f5266d75e3779b2e4c9721c5a64883b329973b2ddec3

SHA512
4036305eb506e753444208f393b555d7fe5586982a7e4425fb37768c7aca25736b6a87b206ecf5f277abd68837e95653ca48255ed1642ec6ad46538c125002a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a522b4ead2ab1a1_0

Filesize
4.8MB

MD5
41382740395eee4b88bf157f859cf0f4

SHA1
aa1a0054d929e7cc08e0adcfd28fe9ba0ce448fc

SHA256
4ef89c1b36ef3a5c807e9bd0066fd55932ead16799d5264de16beda196d9e1f3

SHA512
d18a5dd667193faad9a5461b311e29bb1a51b583b1b9239110a6370e3ad56366c5c1ea13b9e071a45daac11eeaaf01098eeee61b757ec046b0a83d6f7c21052f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5b1c5eea508beb5c_0

Filesize
1KB

MD5
cb1aef546754e391c09f66cf9f42c9b7

SHA1
00794ef251814c9a8336c0c00a8d39df06d1ca0c

SHA256
9daf80b00b49f0bab43a04249222d20a56fe4088bfc6bd16c978aa612661dff5

SHA512
1fd5f707cc2174836686220e182240819d9685330c9b5155f016632859eb018b25a8a63ada167ab8985d62b7851acce16cc0fc003a919161cdd8790a3377ee28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f3149bc5e88249e_0

Filesize
262B

MD5
2654f66ea8be3e2ead8896be7885c966

SHA1
0bb4d2aae0be47909a090e945d28c2bfe035a337

SHA256
f6b3b120946c17cf92b4ea094327c1b542107a7b46c93bb616cfe34e471d73a0

SHA512
44e90f0d2c636a4b73c08b99cb6f360bb93c6c26c8d17bc88313029877b03e3360bc0ebb5f0b6b03a6fae065a62d82a4348b65c0636cda15fc25822466e36e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a76d303add92bb4_0

Filesize
3KB

MD5
e2f94108f91363d7cee16f56b2c067a4

SHA1
e1dc7bd6581373cf1ed628e303eb7e0a56415884

SHA256
cfda2340054fcaaa661712ebbe6fd984280f0a4a329cfd8393e72480afbd56b1

SHA512
0d3a43c944cb914f2462de5325aa60233b021eabb28e555472118bc2c4f56d7d2b775cd700d132da87e8d534667a4b70e8b2d3c76681812af4eb5165c4389cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\742c8df5535f7052_0

Filesize
262B

MD5
0a0bdcd03888edaef2e98520bfec7828

SHA1
88cf044fd366758d56bd8b23bec997c48502d103

SHA256
a517935176cc4610432ec4e13d45055be51f7a039576ae052f22927b4f6e4580

SHA512
61fef9007e9b6c8bda2d16f204f2917d393fe6a514a858825ef11f552d85b202a2ef6e27f9aa609fd71a094c2dfeb57221e7923133b647d3a663b2034e187464

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74f33820d1338b1a_0

Filesize
3KB

MD5
5e0d1a142b1a1ca6aeaf2d60cc7a8df3

SHA1
a8094b2c3e81afeb54f4e792124314f380afbd06

SHA256
b4ea18103a95abcb15654c8ac48da084dd3223fc5f981705dca80634d6d3e672

SHA512
1b6071d20ad4e8d8093ee08081186428b575671990117b1524e204b48e7227c53b4dcdde7ee86c476e2dc592c1f547acc51c8fc40a60786be3c4ee409457830c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\774cae2e6950450e_0

Filesize
262B

MD5
161047feeba760fd7406816d8c931420

SHA1
d6bdccfdd81c46980e876861496d71c5625a620a

SHA256
78ffe868f60c187e29dcc3870ffbc41d66439b432ab483a9ce7e1e92c882522c

SHA512
0d6da59c665476d15cdf7d3df263ae28df2c3858f38565db171c7a007ccde15e99affd2395008f3760cf014c64b17a4b676a1342130da08047ec87783a573cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7941d51c01a559a0_0

Filesize
110KB

MD5
f75acb91b728e1e6ef281a947ad29453

SHA1
b4a0716ccc6772b37bc1d2c5d3a864303cbcbf72

SHA256
e77aa397e5fc4683a51ecf92fc36910a11c4b855d7c6e403343b87efd2c1be7b

SHA512
5c2f96e9f6e6b06d0230a61b8fe54cdbaceeb57c336f958262917a7ed2612a566fac6b8494591babdccd05bf5147ab7f641be4af01fbf4b349d9dcb9de3e0cd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\82bbd5cd0501075a_0

Filesize
14KB

MD5
6e91b8baa63d762c8393b40b936f5bd3

SHA1
35acfcb31e55c43dbdec919be6c6879237527d13

SHA256
437f224dafa6e02bf84cdc88936762adbc49228807bcc684e17206e79f2a43df

SHA512
450c4594c1b1bb16828af345605cdf35052aac2b1e0a6a9cf10c9fe0f39e15cc385438b4b49de8c62fc39356238b5c2cb2b4ce7354e9d1a39887f776e81d07ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8bbe961e1f9256b4_0

Filesize
7KB

MD5
ff7311014aa8b32c64f99824a00842f2

SHA1
f69d2bace3aeb086cfcf8b6a3334596b4df842e5

SHA256
8454aee68ad92d9e5fd8dbbc6ff7466e35250caf26e7196f9d7300681140fa21

SHA512
453b5f04e07f3dab5127ce12dad8a2479f5640e9e87d61858ee3e27b3749d1edf9dc1cf9b154bf07fa86152b4f172bea2e479a94739fc35d3fc918a47cf85392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8bea4ab3650bee52_0

Filesize
1KB

MD5
9087bb9682e590162a0d83fd376a2332

SHA1
2583799497385ad5853696ba5d7c523c9bf6ebd3

SHA256
186b37f5b3d807c0dc90936efd953a3770a791ea25b7146d4e1469539c87d7a9

SHA512
fbcd8b2501f0cbd3e60292c3b9e1aebd7a65f966052a0f5657d09e5479a00ad6577c2b82e13ccc72e946f43c2a1eaf28ba3ee141508d59749c87111fb00c5743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d00ee6fdc5db6f6_0

Filesize
6KB

MD5
29cfd792994d152ab70aaa9d4de217d8

SHA1
039949159a223a4ac322bfe48f22917edb0f5fe2

SHA256
d6ae564dffc3aee0f6f2c818105f77ca738e1e87149e7a35e8e4d363b5925c2e

SHA512
ce3f33b06883378eb00e388a1e544035d1cd5ae26de3a2a9f8acb7a57b8b89d8488d42edfb1f2aefd7be5608c834a47429731c1d10fb111a5957ac863cd480f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\91e4ac03c4f64f79_0

Filesize
2KB

MD5
72c38f03d01159cc4a1df3c10aa9bac7

SHA1
28449294254feee67f56bc55283b44899b5748af

SHA256
cb47580bc153d8b16b88e2c6722f097a19f2f1da076c403c11ca8e2a776b0724

SHA512
5e8e8ba87226b939210f5164e5ce0e7a2bf9c8e9281247944a7580cb0ead7c31adc3830b3ba54d208477c4eedd135ba73a1e4a26ace831b42c7bd173163c4b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\92ae88ee0ea916d3_0

Filesize
288B

MD5
40cebe16088b83516a704b706fbf5733

SHA1
801a033bb7210b3f850b5f8e09ecf919d7fd6f37

SHA256
cd3c2d41200493808d351d1238fadb14711ef9ad2d4fb2af6bc00e828e18fffc

SHA512
fc8026bab1b00f9228f0eb5f821c1810721c3674dc3e847aaf1f761bfa542bbe5641131678f7d8ff26e6445ad5560c0bed4eae2d5c0261ad0937603732b78d23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\939a05e3918f8454_0

Filesize
2KB

MD5
c0aae3a9ff9240da15498f90a27502d8

SHA1
18c73b0da81a5ca49b9cf605001341904f5d6392

SHA256
d60829590e99e4dd6a35bfcf464dfc7695c570accce209e6463e6784fadd4d35

SHA512
e2b09d699667686edb529f0903cc9a9c600b65afeae823404ee92898faaf722cc1b6dd89df16116a030e3f86c883d667afd279cee4aedd2e72bb1dc84ad4d12c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\95e4d4088a582378_0

Filesize
6KB

MD5
c63df56d24453a1004fd1accd31935b0

SHA1
c015ff383e95700b60ad2703c8f76eae48653c4b

SHA256
202c68a246bc868dbb2bf252345388ed425f60829fb71c6a2db9ea0932060f3c

SHA512
1093139dca9f392e5d67e6a24f8cbcb7c5d3363ed9f166c86600a26beff97671e4df545c7870bd78c31f24188f08b3a5fa701e9ed72906e4b35017ef8e51ad7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9d4cf7add09cc801_0

Filesize
303KB

MD5
fd71b17d291abdf0285cd9c50c24e846

SHA1
9b273dd1d06391555afde711d41524dd1796be64

SHA256
ffcfa2ca261764c8fff0da08abafc3b278ff78b20201fae3de08854e478f2311

SHA512
bcced042021e04496ada2953cd8e89969ab823502a42ea89fd9a64de49b2e014baf9971fcadbd1ee1f5f87057bc768247d6c4ed2adb12919ca4aef6f34596a70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a5e388174f596eb0_0

Filesize
1KB

MD5
fed7be9900e5b9deb02f0dee7e9b6234

SHA1
df76769916f7fe857be34012639fd72760ba1981

SHA256
cf2cbb771765659626c3be6bbb1a9133e65dfcac220f88f09acc563fa62b6eaa

SHA512
a419c231a66c8139396c8f5b89bb3e1d031f2f26a5dd0b09a05ec945172fc7f9703db0aae373d0cac9c2d50caf6e76b7cc73e88158f5667376e87e158b59305f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a5f8927dc4605598_0

Filesize
413KB

MD5
5f4823956b416a5002125147fb990a72

SHA1
9d229906ff65e01cb05e8207c983ba3c0e6e9bba

SHA256
989a5133688ecca9b31769c6ea162b540fb0b97e759d3629a5e8f29e7f8d89de

SHA512
2a044a95a0ec95ae7766c0f3a14717f931e1249f423e3cb1b76523bfaa2de551faba750a938e763fd963265e8a2e551fce0c44340ccafc15fd0496f871950f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa0ba30e9dc345ae_0

Filesize
48KB

MD5
31f65ff657ef0bb94e18568cf9355a0e

SHA1
66874fb77451ab713c3f34c1d13d957019df5555

SHA256
b18ce41c2653219fd21b1e2ac5dbdaed01a200413aaa44a48c810d396209af94

SHA512
dcd95d91da2e1117079db8e381c64ee520495bab18d8119d7eae0e617b20faddb17695da2eb71cc06691edc1268d848bedf9fcfcceea606c1b45b09c450df199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aab63d9783133eb1_0

Filesize
9KB

MD5
1fc51cc3d00d9776a21f451b945358f9

SHA1
535d97c0ddab1d3a3ba84d06d1094b2254bda7f7

SHA256
03789f55a07fcecd9519caaf1c0c23222f9f43313c83e564218bf4fea85b31ab

SHA512
744af230a7f29da8e98137b0207e0327d3fd9010814a88e1955dcf3c967d4f6f19293cc0b5aff09a6cc0f456696180f5ad3899029edd21737e2f1c11028d01bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aacf7971e2e1c3e6_0

Filesize
2KB

MD5
963548f0afbdb35e70e93a9a67dcfd95

SHA1
8fc6b0adab0dbef4d7e38ec11f8dc1bbe0a78177

SHA256
38a02e38434003f36ef04ec80bb9e41d620e6af10352c4e92f0bbe8d6b3f17ea

SHA512
8415d3a48fac9f3cf55ebce1bdc85925fe701efda9743658b42f894f6a28c002cee164df9d024728d6b5593dda2efde5f87be9de621f9d89e23caba8e47ec65f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b4b2df2abb4576ac_0

Filesize
22KB

MD5
cddbd608fa4ccdfb08eaae1ce5c8bde2

SHA1
4f55bd9edd6b594483da7821f4e615de7b8818a5

SHA256
71bc6f0bf9053eae222a6d5a5a971bb1443949befdfb121789d2dcbb858f8803

SHA512
18a29fa1a8274e26e360a946a61f55b95429c7dbf101faacfd189cc14433dfefd991eaa106eb5cda4cf18f7f844e938fba54f8922079fd78ea2987c721672264

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c15c9890f82c8687_0

Filesize
262B

MD5
c75e26a938cb84c507870bf2f61a1ee5

SHA1
c12e51ad5e435289a21b1338ab6f01c953cfbb13

SHA256
13162a396ac7186808284e967e10ea6b1980ecea30c617aa0e6e2de24c6e61c0

SHA512
61ef47fbbe921358689b5014ae17b77b1a922efc992f1b661a87565d5b8bc43e87e6662bb2afc74a195e8fded7b05b677ebd0e4e674da99ffcda006b61383f33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c2d2b9ddaa1facb6_0

Filesize
262B

MD5
bf2f740bc315f27550a8e26d30bf8a5a

SHA1
ca710ae7bb5d21833fcfe7c680be68855719cdbd

SHA256
8ddf6cc0b9bbe68a9abd06cb70cc4125af0a1a889e81eae8cd828c67d6a240b3

SHA512
14d8f1303c6b047e86668ab3291464363e589e0f9388d13517ee049f6f5d3304499984d7b3f130e3f3a555bcb5650c991a7815e2717490fb9696cf024ae0fde8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c61a1084b3dde919_0

Filesize
249B

MD5
0654c983e2b61060ccdda67ef02151e7

SHA1
d44cb60db0e3e1e5876d14da687dff61b5dd0928

SHA256
a180925a40f07210b7a0bac2bd346922740d49378336293de5479ab5488453a4

SHA512
2e372fca518a4a5eaeda61aee6c1ab5f4d73e47d01406bf69f41b4bdbf84226c2d5e4be48bb4484965b6c21765d68cb127260ba3dfdec68642a7befa03a707af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c75908f5f096d979_0

Filesize
3KB

MD5
8e67591517a622389e502e4780f7aeeb

SHA1
457590f76e99c4d80d8ce1c3efe69589d5d015df

SHA256
109eebd2c321fb9be1860be76f62e1bbdcba58b0ebc219290cd4649a22447707

SHA512
10fe2867e2a7ac6509ae52c0c9c30c0d3fb43d26275a4fbaab83bbb2adc1612dc04a9b0ceec313156c72b13d823ac3132fd9383f0ac342882f6f0db27d65f297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ce1059c478c2e6f2_0

Filesize
2KB

MD5
9ceac1c268503bbd7468acb91e51d1ed

SHA1
1bc80283b17a151cb849e62884f5655482fdd5ef

SHA256
851797ba0583c67ab0eb15440b6e44256090a6ae227beea7f76343baba40c77c

SHA512
271c33c8e3102f6aaceaae9626883a90147ef4f9edc1dba99251e1c022caf968d332491a0233b6feeffe3a214f8f36a86e777255e431fcce290373af7f717855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d0bcc513e0682a40_0

Filesize
1KB

MD5
07831d36885f0dabe83884b296c70681

SHA1
3b6dba05982204fecd40f3d38e24fb65cc1112b6

SHA256
73f8bf093a1a0b2be854c871b3af6ad098b636a71e60962c6c298e78b896254b

SHA512
ecbcad1085307f74636606914167fffd6c16f8879ab7ac2095fa442b8eb5d0bb8eaef93dca10a4ee1f3e2936f79ab7d90009b6dd06704bf139b3ae2f17f0ede0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d252f20371953868_0

Filesize
5KB

MD5
e4721d5d87d9fd12f1e51ff8f634833b

SHA1
bc76614e033803b23d38b5565604adf564a1ef0e

SHA256
432223d588e167b012d28bec3c25f0b27448919fe407a9b59ec4b8af38dda58c

SHA512
28646d27af741cf7333d609d243ed0eba38ddd6e04d689e648a0634bb67b29d87ff7c5b7669af4b77c43a6557c5e60601938733eac69da460dd1794591f1d396

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d34e8d364ca71d6e_0

Filesize
1KB

MD5
9f23b9ff7d5d290c209b451edf50f88c

SHA1
ce9cf09950a26ee870c852cda26c66caa48f9a34

SHA256
67327e73e38c7380861fc32ba8ef86a19a2106ae6e413318c8eb19ffb460de1e

SHA512
9534a3ff9d76a8afcfa6616850e7df4569649a6d491fce216dd0487da83578fdde44c2a24703810541ab09c6ae6ef146b6bba188f6536637d03f3f4bc5db5716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d51c92ac3d834ea3_0

Filesize
175KB

MD5
d3f3066354f32b0083f2b64b49e603c0

SHA1
7d488a3193ce492a3c6a4b677e05128c383223c6

SHA256
1718952bab973d448a5258bedf4d7d1fd76e6142a60842f8aa999a7fa5b67ddb

SHA512
b2d3deb07e6fb75cc050c68a8f2afd36a77a51c16da71d0ba708449b5ef304fa2c23c1df64add85fac69911dfb2669dc164cfb5472d8041950a0d7fdcbe19817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d6d1f574e1ba344a_0

Filesize
19KB

MD5
83b29d035a7a290c7ab8fcb7b977b606

SHA1
26092e792bf1b9d1b3f5484c3e30b13327f307c1

SHA256
4ec558fe93e940801c98969383b09e624f4c6fecd7896dc2d0340f906ebe4112

SHA512
aee05de7a8f2c2a0da48380a831938e81917c4308fbf507505f7ea729fcb26aced767e15c2449ee2cdae13cdc3c8dbda01d8ca26c1ee0cd8c22071ad7b92bc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d98d07c79527c560_0

Filesize
28KB

MD5
1b0f85eb37f9c48611f3ccab184f9063

SHA1
0138d4c42b8b51431b791739315c957af5d76ac4

SHA256
665514da4f446a1ad98c11d743ac48753efd8c8b5e0c594c6898d9b3188082bb

SHA512
842ae9a7d064564cc2992f82844c92d0ac4afe0556395b2a5516cbc9a3ad6553c972b74c7e18a2cb86b6267cf8388c3ff41e29180288f5b383edeb4160fde75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e8cea48702440e81_0

Filesize
2KB

MD5
738bb5e36c5ba98101c55a88ce553806

SHA1
f5915972d4ff9c62b64ced8908fa78090ab93244

SHA256
a2550a47ededda2af3afa17ec56468e373f41b5165eb7fe854650cdfd91441cd

SHA512
8a9bc28e1bd3844202ade3b6595f09571bc488cbc9f441d1f4fa35bea1d787a9f8534ce8a0bb330f100c7e46789bf6913f587679417382dcb2d660f922be1647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ee884f0b913b6f04_0

Filesize
7KB

MD5
64642b80f28720ca231137f2fcf25c2e

SHA1
6066f7b5198fa558edc14cbad6e330b8f7a1f12f

SHA256
c501e16f4be2efd97de8c7326b5fc0ff12b38d8c4cf80862e69d8e644d4cdbde

SHA512
4200d853e8eb87a9bcc5958d86e852fbab1596020762d0c6a780db464f6932efc5c3952ed8097795b3d5bb6a23ddb436b403a9dc647b0577f0b654c5136ba0cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ef6ec442ba19a2cc_0

Filesize
5KB

MD5
d8f5566f051cbf6571080cbde58c5051

SHA1
bf0e4487e79bb04ce5588e55989c5cbe08c24508

SHA256
1cb9d4e4e96b024a2aeda60e8dadae83838f883ea5070bb2ef118cb931a5eb2c

SHA512
0bdf120e610e1444904d2b08e0c1bafc6465fb2258ded7834f152a04c8f296c56b34981ee4e230085776da93e2a5e78d12d283bbb270b1cb4fe1a3df733881c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2d10c35ae143851_0

Filesize
2KB

MD5
62337aeb23cd88d5ae5e7519308ddde4

SHA1
5f26e4ed8dd48ccdf5c3353cec43876263a0c452

SHA256
257c4bcda696b3f3a22283bc002a125b36f6f206fe4e6cb9be959f9f4cfc3a6f

SHA512
c34f39c1871375828337e252633a0c9e0a09f94f2fa13e6149ad3614dd148f903022a85729e2e3b53b2c0f2f7e1d58c5da90b2936cfb11953d22bc7fef16b6d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f381bcd3d5b51fab_0

Filesize
291KB

MD5
ca863e7133e940ef294a59be83e8e60a

SHA1
a6aaa2217481e5ca1cbb6aa4f056799bf1e8ac92

SHA256
c60ac3c2b752895b55ab8460ebb52cadd973f4ce48a643c0529488d8aca3d8ec

SHA512
ad3019ffaaf5bb50e03baa5e5fb46e62c642f7894b45f1d8c420e629522bcd4bf4fb425c4c4f1a3691df8e7b0712fb5ceaa0141f5a47e5b07cd1ea471ff6c00f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f785345a5fb1898d_0

Filesize
436KB

MD5
37ac57bed96daae0fc951cf84c9b39d2

SHA1
9cffe73836f91d123ccdf9110fe9f5909aa0c100

SHA256
ce569d06a3b5e6dc8d738467dd1e57258f9c00d350e744c771c8d01a9ab751d1

SHA512
53fcb5e22e8395ac464cb8c5a73e5059bfceef8f631ad059f83a4da27b59af6d7a1dcbef99383db467a2a2e7258adc34f5945e79e50177962e82cdad2e0152ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f8f986bd60127d11_0

Filesize
4KB

MD5
af5dcc73dd62d369410659eb971f63f4

SHA1
1ba631506f1b4a3382de1de4d43b77d072021b51

SHA256
178cf60326072e5ff9ccdc9ac88f3ff750db13180bfe6cdb92d8b56d9eeac58d

SHA512
d1af98bb5ed1c780f20f66ab3c40b2a4d67a4818a22afd158cd5915345c96970ba6155d4b3cc3c8e8083d7ac092d542a5f5d2641a2fcc2e8b8053459de1d0bc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fc7e8ac995d2a414_0

Filesize
87KB

MD5
703710b5a4c133489ac4eae7f957c988

SHA1
9be5d88e2213c3e0586fa5542e30149be75460dd

SHA256
bea6d7e1c9d3b5365f9a35352b9511092dab285b05dacb8ae594e1b2a8dcd7af

SHA512
f84336551cb2593db94de749a34c30f0f01dee8ae806dab00b3a0b97f7e09c4ccd3a08efde015f5c6e5ba41a4bd50c9c74484ed0f4a1f3bf059007490d689753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ffdbe15aad5f0a0e_0

Filesize
4KB

MD5
0304e64293fc0198aeaa35c0a6f695d0

SHA1
addfc32594a8bd370959c7159199ff90d69622d7

SHA256
87645547b2433876e88396afedd99c68dbb388ec8af1499977f4c2d95fc8f5e1

SHA512
4cadbada22958d75c851c3b6c38a442ccc77f186bc684e69719469eac60a4d982e45dad93c12f10100975e889087a891ba00286a35244cd6c839c5b2b31c16f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
a1a125ef0a61996e9a43c03b8df13959

SHA1
0e53938bb45fb1c0e1b287dbd9532b1310f1e131

SHA256
54cd2d0fd70fcc18d6eb0da9b9a705cd69256a2ec6115b1db487126648b2462a

SHA512
970d26454890dcfeb9fc4fd4b5b8421a1251725d508eb9f3c15e01f367c79f02744bcb8831a84cdb5995e622a03cdd3d6a20144c72b341c78866cd6afc782ba0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.ask.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
6995067f17b27f0e0120fff071a554cd

SHA1
af188a6426f30fa499397485aa2547c9f0e15eb0

SHA256
abb2cf4d34636241025c747919206081006aa945df37dfd95cd4a60d88c44843

SHA512
a821df2c1331a482f00a3d9b1ec4015a458b57031e9d70ba4f47e3b00ae281e7f4995883e10a71c3c73c28c79eace4e86a0cfa29172d12873a2cc0cf4dbbcee9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
40a5ef1f78299df81eb3ae2be3c800e0

SHA1
b59265e1cdb0651ead669e56197d9b772a1311ae

SHA256
7d5920cdc37f7442b08c96bfe203f51bdc820faea6a95f1a4bed3e526cbb5a2e

SHA512
0bb2498e50003e6defa6615a1638b068fffcc885ffd156ce83b8a20b8aced770cacb5e8867db617f9f1e128462c0275c90dd1cdeb230132a1192b9c3f483714f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
007811bb9a0c49eefcf7802f7fa8a972

SHA1
a096079987a731e0552f3a6a2eaf406d05bb4c30

SHA256
7ccef3854b1626d1db564b332fff5698d07e40347f82112c3c6b05e7f6f2d5af

SHA512
5771221ab1236b8a8ec202aab84a10105aa6a8c177bf306a1195d3e6b8f0ee241363addca26a908029ed6b8ad22184a0cf177fd485ca36c4987b7561270fa339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
149ab05882a84a33641454c98b0dce0d

SHA1
32e4129de69900eb85ae2328d4456638777b617f

SHA256
b4ef79ed1fa6a31f9f0eb877f44c22aaa3f519dcc20141c2f1d22f689fab5da1

SHA512
583aaaa55bd33f32f0abc6ac78dd367318eadf2d50dc79f19bef46155075217ebe470656b3befb04c6234547b284821b15b2664ee48a439cb4388ebc561319a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5f4643132c872e3bcd4d789977b32241

SHA1
44c9698d7572dc82885adaea2a08047a4cbf9d3a

SHA256
b0b16af61170477e1685d92b79b800e57de003c97496143d8709fc9d1b8c0a31

SHA512
6afa4f800477cf9a8d418c1e886e57d3a2fd5ff5b320367083d7af0ee189d828d216e46289a3ed5d0e7071d33701183f827ece42a44d691efbb3ae63a95970cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
656e1cd2fbc6bf849b9ff0811afd2c0a

SHA1
8c3d8dd1f44109e162fe9a8bb6a0fe677ba6620f

SHA256
8d1a978321f7e83bfbd900a3e56eb1655faf23c1a65d4e926da10ac0a34373b8

SHA512
a774fb9d9427e40c78954c765c8f61beceab93433d20420f48e0aecd6cc72096fe25694b23a4e8e6a5832e94d011e3c4622cf5c0b268731ffc488b6c3864a775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
9842306b483bd062acf52b6d7f42b9a3

SHA1
73444d50b45a31bfd23f5d71120128c9954080f8

SHA256
4fbd47d13092826263c778fd86da07d387798598b9784fea64ab89778628366f

SHA512
491c5c8f0b3b0090420d29b9af2844084a0acd1fc1d31cb4fce25894c0e311dd32be30f8dc99440e20e8f0ab3a3ebdd5c1ee8fbce5e64a7594811e720ed7d28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
8ba23cd213bba016a17df5278714bd0c

SHA1
25d6829bdf72ca7f8259267f34b77fe498b38c9f

SHA256
9dc77be2a41d58b8eea0473455026a2cdb5b4d61ae5d01c60b9d14509a88cdc6

SHA512
79bf1b452125c3101480091c79549d831f60b88755ce053c604aee0efe44f8d8196deebd3e04114935ab167513b75ecc5c08bba00334466474e64eb8b9a24743

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
054cb0b44f1c3a443c7defa1c8086fc9

SHA1
8a9de27d22419749f6f5eba5fec456b548ff69a4

SHA256
681c1cfd4a017cd81372feae1600853b9044927cc6a4d6dcdda9267c5f275fba

SHA512
c71aed63f2d5cabe75b09eee624bcea6605f4d70d94b8c72802d502e9f94e761c021f0a7322a2759f32f355791ebbf747eafa1b79379a852fb55b0dff9462881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
996b701d98a3bf3f97e0aeff15def7d3

SHA1
c0b1b2a3ceda78fb2f103fbbf7728c453851f01c

SHA256
e65c145fddc9d53aebcbf6bdfb6d21e1b8f3bdfe7c02a86f5dd61f688d60a781

SHA512
2e2a45815a16e9d1b7b1c404522a0fa3d0a8475ea251e22264f5da9816da42808ed1651cd49f383f03dbc93465fa53f3b3efe7c4240fe7213e447929b7236d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c277cb2e19fe7cdd9a664fc07f79cc73

SHA1
75b5c102c9d008dc222d92723ac117feed2bec95

SHA256
8269c8efeecb9efc4124a79604813836a317ccb67fdb83814e64407a0cb6ec93

SHA512
5efa1867a85d3253da19b2709404557f7c61fce94a0c18416a0166bfe43cf83e76ba78be26bdccea0e0d952b444f258df8fbabc377a96ba2689c2bc871e7c7b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2f9afff3fbc8d4751743b834b0156c13

SHA1
6d1b66e48ba8db86a82e779c0e580ae9e453df23

SHA256
e283cdfba39fd8d91aad52c7b93b804d453c198137d852089757ede0e0d008a1

SHA512
0ea9762fc2f66d38ac9ed3ec2ce0458e3f78bac2f8a332835c57cb316e76bc6880a58181e3efa15df87eabe9e5db916a3bfd4766ca14803caa40d3b02a33ddf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
b4755becc445a131d2b3fa527b2fa8f7

SHA1
1bc247ff1f94ad2c1945b16a2dbe69bd264a7429

SHA256
106dbf6e71f3ab33b3777a39918f3cac8482197b59d82a96eb98eb5f2eff8012

SHA512
97a8fa7e942a63f8c87f52e6d81952983907495de9203c67c4ad52d22688787069689e10d8cb1d5e63c92212cd0cbbd57cb6ff077fd99b378b09ea02e68b72b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c7fb410023764000fa6cb992a44a9d24

SHA1
1907fd27c3ca5ccf43ca5efce5ec1f3296ceeeff

SHA256
fd958c456affbeee0933e0c3f83e08fe46f73f5417c983f4f65272b74658650a

SHA512
7e91a82a78fe8eea86c15de10e615d5ba64a6cdc811065d9ef874f130d9491352d92c837ad55ae86e28718c23192688e0af73b33a6aa090da2abce0a3aa02d64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
79a3717c31bfb0cd936c9563bc2da052

SHA1
eacca142c02e3e6b0e519f342b85ea8679994089

SHA256
dd0b7d792ec8d5c09b0f8f767ebe224bba9aa6cfddfe6ffba444c0661a11fbbb

SHA512
8d837e9a91e0f4a558e558f5317f5764233a2521bcae0c933bf187a0267be75c2b99dd203538df88079991b0275cfefd8dcfc7cc52ab6a59b09d33b551245c0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
84bc185e5c29f211cdd8e78d717e8e94

SHA1
f4a0bdce698620a7c1e2fd66ad99d3daecb65ee2

SHA256
4ee3c9ff67d6cd9ef473be2781911fbbdf38213e1f6e5f75ce3d3e81de0be38a

SHA512
d4800148e2a757a880e99c2f9455617a5d16270357e8931715f64a20b894c5a25e6262d74502cff2728a9b096ae2e0462f2916971f214760550ca21a9b483076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
70e8db83d583562b2c04dbcdebdbea1a

SHA1
d76a010deb9472b5105c9c71153ad59ca237f44f

SHA256
90707892aa30fa5a0460f6b27d551e7f3289418a5b6c7706eb5f5144db5e99a8

SHA512
4c9855e3e020c34988edc72a19716d922f56e36cdcd9333c8dd54f9f63ff2ac190c6b9d34d47ff551a46f77f48ebe853ba9ff122296f66c14804b95bdb6bdd6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d6cc525e0b98a7b418525dac0a9cd738

SHA1
666e1fe91453b8da4bd0b00cb379bd7f37135a2f

SHA256
12f93b24e0b9b675a1cd11fa590666d2454541eeeb32e621e554a16555e4c081

SHA512
7391bef5fa0216493524694fd55e454029280e6050a7df5df222c075b76cfcd60eb868de3e9209b15db98a6d18587e5f956bd4e90257b9d7d31aeae08ec5f982

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7c8e969a49159a92de837fda39b9f82a

SHA1
0050d9b08b82facafe026495747b187e19ab17ce

SHA256
7d9afe66dd8302da62254c9e7c87b6e8110a07dae662668a3ff04890083dcc47

SHA512
72e6d9cdbde0d6084a2c6ba0f29f8b01cedd445086b40cf6526e4146accee74db1fd5e545849cc2d03fe2c85bf1c05e3748ffad864cc990782b9ba093dc7773f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
ed48ca94898375c122a65b2334a14e25

SHA1
bf47bc655d44d3397c34576c842c00c2d5926296

SHA256
ed87be50602433eabf9a7501fdb549d3a1fef50a92880390b7eef9a081f80058

SHA512
375029f344303ecedf03e9c14364010a1cacc348d69861147fc926d698cb121cc21c2af33f553d811ec933400a7e925928cd9abe7d24ac205dd1c633e60e70c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d10b44e45096558f814145d9a539cf30

SHA1
55fcea68cea432a7344dc4e6c1c23a59fd6e2417

SHA256
f439eeca9d776324cc9f5cc350242a146ecf2d10fbf5ea74fec0601fb4266782

SHA512
c36ec1059a1b677e97c5845eee63eba6e7bd1d9bc6dffc5d1ec6d90f3c409f0cc75049fdecae40a3e7f9205d2b7a22c393947185791d178a624f59c198290921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a31598aa8cedc0f0fd28cd1ece4ad7d8

SHA1
694a37a4e1b4e56a30ee5c55b6444284d1611b1a

SHA256
8b8db54d01ae40341fd3ffca08bbfb98003c8643393c336f4aa093009d135bb4

SHA512
f993d465ba0eb0518615827468ce2e3e8f74f932d0fdfeda355bfb66244ce416da6bde06006f76e484e8c738d42bd9cf8de385004bc733767f0d59d37896cb1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5020c06b1b51ab242db24e897fdd19fd

SHA1
464ea18237ef81c46bf7820eedd650b15cd2b00a

SHA256
638386d5dd1b7733d2503b73cfdebfcc3e656c85c60a1dcfa3cc5aff8dcd50fb

SHA512
a6607359f915209ad657ecbe9ebeb1fad074f10bde4b949442d39aebb95b6b211df942125fd0d5b0aebc2704eef059dce16e14b2822511b0c43b21af9abd3a5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fc275bd1a4547d9c398213251806d183

SHA1
4512966568cd853491cc3e6a433e16a133d0e14b

SHA256
3df1ba56ef78eb4377ef81cb53a35e00457fc8c8d5585c514d61eeb460e1ef37

SHA512
cc8497af5915fb56b67b1ed19fe495ba8862b10de7a23d7be36182c79b53dad11b654bbee4e2b8373e43ff8f1cff7012bcefacfdaf0d0f477c0e756be0d748a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\07653936-3432-4ebb-945b-c796a513b5d7\index-dir\the-real-index

Filesize
2KB

MD5
c329e72e5d5824ad4c5372cc3ea518d2

SHA1
99ecaf5649b9ea173968631d30de60411aa1601f

SHA256
8af1f1f44d377cc16d3d9a431bb9565cf38322b0a23a0446345c6e0d627f17c3

SHA512
d1c6556b6008287208f7aa9876ca8fbc42085e822796ff870ecf15f028377e935f6303ab521c123c35ea32c09e715b119cc001ba32e6cca6b07aac5be3ca3ba9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\07653936-3432-4ebb-945b-c796a513b5d7\index-dir\the-real-index~RFe5acc1b.TMP

Filesize
48B

MD5
9cdab174400ed6e6e83eebef44e37ec4

SHA1
e08b3b9b8c1e4497416db6514223f2c54488aad8

SHA256
852391eb61822ce155a2017aa508a060213f07b8fa6fe2d922983f10e9f849fc

SHA512
d0e4262dcc7a64df46ed9484e5c6b972480fc55f53c2b915c14f5daf9b8aa1bd54fcaeed34374b0b9813758b2e2a0e534bd17a73943c8a76fe25044f869ef639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5cffacf3-7361-4cb8-87d0-a89c6b995831\index-dir\the-real-index

Filesize
576B

MD5
c1e4b2720f328b75e8f1ed9d8a7103ab

SHA1
21abe8bf3e2c94e1c42c812466e9f39533b584ea

SHA256
7b38963f2bae3106ef6e7c7b3b1c14cf5d674da885d700f7be1469dfe9bf4d2d

SHA512
7bb9637bc590db4f7a8ee4df9563b7ba1d3c6df83e917083b39ab1e11e61ad2b7cd936a45a4dfc36617f8b1fbfd824d81bfc8aa215c78391f76134434beb3538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\5cffacf3-7361-4cb8-87d0-a89c6b995831\index-dir\the-real-index~RFe5accf6.TMP

Filesize
48B

MD5
99440529034bb5eb430c3a21ff4850cc

SHA1
265e6a5671b8cf7ef57c923e7a54cc56449c8551

SHA256
d07cc9ba9127fb8fdb49c26de390ff8acf2f73fa23886eeac51ac56af88c7b4d

SHA512
9622f488ebba849878c3f255c17c17cbe43cd1b0a30986e11dc12ccda7ba1c4295ccac0b567e1f6667fbf462f34376ed987f5a5ccb1da393f6c48e3c63350f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
ab7c4aa9807cb47753685c4b75b49a9b

SHA1
5c3ad4e77a624733da5ccf29bc59aca3fdade387

SHA256
5be2dd1450da737d04beeaf950ca9be94959fc1be095f55356397b6f4194acf8

SHA512
12aedd68db9997fb6a3a8d86bf9bad24cae0ae88d161dee8368518e2f4da5cac1a364075dc5b5c814fdff494b7b0f490b39bc718f9202412341f4a35a0e94881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
155B

MD5
147a9bfff7a687827ad53bd94fda99db

SHA1
f0e82f4865f1428d1d5a2349eb5005220f7a0183

SHA256
07ce6b4e6c0084f41ec6041de38f5b2afb52ea788c6a07894fed1aafeb7a9938

SHA512
9061778c28adbb7b6c7ea2e55fdf60cbe8b6300e4f91f1b0416f4566df8e72a672b26d46ec998dad1e9d8a9a59640f351a2b2a686a02cc569b287a6b3bcfff79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
f29309854db70109ba5f80c945048e36

SHA1
6ec54899b27574d5cbb340f388fe12aac4068254

SHA256
e8e95e9ba0011bc0ee4b22e7da81755a089759bff40fc781525e02603c357a37

SHA512
53c80560dced171d6d2185fbac2e34a459d627c882b9d5eca484bef62ba348519151ef78ab7be1335e97386e0365331572f70837ea88b75f1193efdf3248de73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
70890190d3ae21251e11538dc723b590

SHA1
17675258cefcb8a780df15d193fac254a4278519

SHA256
7ae0d063ca230441dd835d068517695e7c5a67f6ef5415144cb30d397dcda6dd

SHA512
a990d7a377333ba17a220c45c1d20a4347e65a84d5e8dcbe94b9535a6014edfa0f1d6521da7c3618e2f638ca476f4e9280c8148f16178246db199056e19bb2ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a6f74.TMP

Filesize
89B

MD5
0221a65af463e567dd72a54b87a9ecc1

SHA1
6fd85ab9586ccb5aef9ff0c5836fd69c2d2d8f1c

SHA256
58a04fd9d8d6a28b4e99b5b6359bfd7f5efdd2ebd9acd6a5ed0be56cb20c094d

SHA512
71490a32364a501a8f975d8802c0aa786789477da1782a460db669b34d14c8108148607ec5f68195b7a0bb8556434a9b352a60c15a1cbb3025ba2a5ac5d7636b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\4cb013792b196a35_0

Filesize
23KB

MD5
398a79b67a9002c0ebd9054700407482

SHA1
e1279544e4b2612d1c856f5199540284c32bc396

SHA256
864d1186c1677a430efcea19da111e4e48cb5ce254f2b37015dcd7ab92875af8

SHA512
971fff0865a7f51cf724decc8e931538165f4bb691015784b691fe7bf95f0b20f8edd877a02f4e4b323d87a18bad958cc280570659d1c8b8425a4dde189bf3a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
144B

MD5
4be93d8cccc4129789b33959010803fe

SHA1
a5983154d5f44194147e52274be8dc82f8ef3022

SHA256
05fd8f77af247f1c436ab19c50fb1245530bec129ac6cfe638e4b62603478138

SHA512
4aa8bb0804299ec5b86b66a71581b440a0e5cb2c8ce3181a8b3d587c9b4720eb9c66f2687d44a0d2bd5cf705ab9367efb3bba98cbe1a2c3d51dcd0417b52491b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
e6c493f2ae4396a970e2181823f4c34f

SHA1
84d9cdeb4428155b79ebbe6981e8e53c96b0c891

SHA256
e03050e14401033974f5cdc73edeb019f6fc72f362998387f6537585e688f8e0

SHA512
7da9ada1179bae777f2d456d0593c3475fadf98ef796a3235eac5efa719b1ae0c1414a5ab16374ad7a43198f1d20e823649acf5cd456096df216a5b095261821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595d0a.TMP

Filesize
48B

MD5
ef8f6bc65ec6c84c37928ce76563c37d

SHA1
14410d4a808d41b53b031e09e7fb5e958ac86559

SHA256
154ddc2d660a5a77703264b35b9b4533834ea09e78eb57537d815e1db4774424

SHA512
29284c792ef07162b16f2831564d3f8773f7f587c477cab9f98e04832fc0176f9aa40c821417e077254a1cd30def849aaa36815c5d7a2ef98aef6de042dafa29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
4f0d19ce490d19a438770eb00ef48bd6

SHA1
9a3cb9823658847c3010228a1679481d02222969

SHA256
07c0aad345e4e7ffa16bf98c418686b393d9968774e370b5724ad9e1098714b1

SHA512
18cbc2a6c41905f0da879ac863ff4eb98dd760c6b78e98cea810664c2288ecad23b7b6a1f1651dab4764830bf028adb4f6b8a13f3398f4d2c44a405b8022ef4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e7c27933bab8d18e307bd6278fb307d6

SHA1
79505d841cb22a82bc1fa39a807104cf1e31e7b0

SHA256
eae8219fa7cf7603b8e96cb3d0068a5f40454345278c63d8308d07697d191e97

SHA512
b88b34b62930d8a96423b6b6616f7e9b7b9e892493a4a33a6cb221215e6e831d55604cb9aa4fff14382fe372bc8f9f244c70d66fde6fd738844b3ca06db0e32f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
0503f0446090f08fc1a0990537e75029

SHA1
3443125b0ae59a36d222576c676cfdb1b2a15eee

SHA256
af8fff69e95714ae32cac8ef136c631099a44cda5d3ba755dbe003696c29c03a

SHA512
1caa1af0cacd6049eabc29f9ab81bb075c460c5a88931744b35f1ed7dea0074e87aebf638bbb030233072af38c84220f14c379ab1c3ef832f2fe8100c4e38b58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
f9cb1b823b17824f0b17365c4d0aa5cb

SHA1
fec2d3fcb65ded066e4d54963da5d82fc58fb20a

SHA256
c42a4d9e2554b84ae39219a129da5ee2d676324331962a7c6973dbd2c06db47d

SHA512
adca8d863ec954aa9b20aa82600d31ae74878bfc93f5ad6e4f3f160a38097993cf9f5a5f47b7297dc8e4a65b718764debacd5de1fe612082925788ad2fb82fef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a4876d626b975c215123fbc327f7381e

SHA1
7e1479602a463e1879cbc1aceb586cbc8eb099e4

SHA256
2ca4e162fa34b4a7ab1b5eea869659bc1a4039417d05f88d060aac9b1605904c

SHA512
2104fb9707f8f6b12956d77f6f7e57da20a354f8054ae6bf1782345608fa1a0572e3f20f3ec87a92ef335f9c473f373ef48d9352e220b0becf867b9deae7937e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
c2202322f01d46469af93ddb3b8861e8

SHA1
645df5a5052f4bf309ae8b71d8927255453d9ed3

SHA256
84d54807b2d1ee03c4e9fd47a9276ab4840d35fd34925d28f7dc1a0d373215a6

SHA512
88b3c83a8a5b0846ac189aa5570032e39152ad66f76c36f8f9220126df5463660e0e2b5c8855b47978dda772baf9b57626437ccaefae6cc2934c079a3726c05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
c62de6ca8474f9574f8d2128063114db

SHA1
76d2c005ba726aed63ab3966a76c2a27eebec3ea

SHA256
7398c45b8d2ddf84243df04fdb5c6b6702a56fa8a0ffd7fe22ad3cba903e1647

SHA512
8f3e97a256d3fe6c4cdbf0948279c2b2cb5ebd12ed6dc407809b59b28a530b02e54cde29f2f6bd660a7350a5c6ed1df7e38c4ae35c8f383324b769a09bfd7479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
835f7677057c2cdc14a5ff7425f3c496

SHA1
f2f0cfc03bde3c5a1599cbd79fb7595869bedb92

SHA256
8931a9e137a2d6a4e5cbc8f2ab5740664246e0feb175072ec9294eb266676577

SHA512
83e0f4c688349ed11cdb041d52975e33d9c52339feb097a1960c8f2c015c54ba4501f471d80525a3b1658ead8b1c050ce8229124d77ccf67e1b177df32c8e797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
4475a42dbc4311eb50b99b1d341145bc

SHA1
aedbd9cc22db3fc2f5668f31c1a99b7a64cde30f

SHA256
106d7e47f219b0782c00893b11a7e4c6cb9527e34c69565b7fe69bf7f0e2646d

SHA512
9343e693b18eff2356b4ea91b294dd7b23ccec10e8b7a701c9a2924127e9316b553b78ee2be2747a07dcaa28e76d1f6d64369c4a8c98f31a4478f15baebb65ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a6615eef9791e684f72c00140d1a2ac2

SHA1
e9710c8cd74075eed7b4ed57ec6cfd4ec0f8a19d

SHA256
741a730bef737b7c6f949b1c2bc1053f2e81ccaae1ddfc8bee62e5394d6d629b

SHA512
bcaba842a9d85fab6cc800e8095a9c9a788b44da3c492f1ac4d99aecaacb1e3340da8739f64721c4c1b4caca090a0d3dc2437800899bfdf422c7e389f4e650e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6e4a068d9cc69134586a94e2cb9b6dab

SHA1
f89379e3df6926b99276af2446d4e2fa23886331

SHA256
51b9d7bb12d9c9f371f8252ad9d586c027333f5f69ec1bfbe83cd4441e2a8912

SHA512
40e1d98aae634d6269333cb2e4afdc6fc766efc12b3eeec06d8cd12cfbfb97e98fb866ec85cab9a2554d2ff309723c6f0c1bade45e4a9701bc9501dd2fd31fb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
d62d80bbda7dd9cb5bc54bbc16ec9c09

SHA1
933e818fee9cf67779e7ff0e3b1abcf25b7e2688

SHA256
65b6d3e5b42e3cce8f5a0c8897fa9b722c38d8e69695944b0eaebd1745871bb8

SHA512
0cb0baa1400642072287b249eda8ae917c217295bb708ba34db38edbd7db6b2627ebbd4c283fa3ca0ac98d8e6f95475855ff0ee47c0d49065272fd050ef10588

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
21770bd0db0dadc8f2498bff75689c1a

SHA1
46b99cfd33409eaf4b5af6286cd7221d2e0c5dfb

SHA256
a9a94bf0ba8013af30a155cee9a1bcb0f13f8a56a5bfd801fa7f32ca5917c364

SHA512
97861921e3eecf26953a5f74efb799ed70567c8047758fa0135c2d62b1277eb67256e9d9101559cb047635ec7fa04db884325a8bd38edb39e6e6839f38f31fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a922bced5844c02eab557bb56437b050

SHA1
55f0d05dd02fba4163bc4a4fa29088d1f0001d1d

SHA256
333385fc637d1a5c550ec7e2e1661e54268579400740c859779cec06ed4bfb76

SHA512
8c7a2d46ee3ac352e8f4fdf32a94fe9812c1f9b8fd99d4b409960a973ba515f3c42e0d3f3abd840bbe821fe2692721c13bb0638964e24d81b17ed24bf88b0145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bfd7aeffd190b77855421cfe1cb5f59d

SHA1
e0d583755159a0a2c98ccb53124b071ce13da06d

SHA256
d1aea7156570834ac82bbd71a42df1468a91b4d3fe55a65cf369666b69da0280

SHA512
d43a548facd63b8c4106d7033739151fb35839326770db783b6102b249661a0c8adbdb9e8372dfb6295d73fe862554538b355df8c26418424308a568ce9508d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
19088db2ed6e742dcb00723243f1fce0

SHA1
7b49e90f79affde7a9217b39ca206177ba1169c3

SHA256
fd48b2ce68dc23a312878129633f38d3e7d5e1c3321a0625d25d3d7fcc561dd8

SHA512
df1be8c1c0d1adef871f3a67b28e01981aeec1cd39b85d49001141dc407c60181b39addf50f4828bc00e5c5222f25204895c7bd6f9a2b27768a89bdff0a11dc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5892b6.TMP

Filesize
1KB

MD5
a54bc41da8d999bfc1ec30418fdac786

SHA1
aa9c6af591697889a11390214ff09301b75c1134

SHA256
671f3fd6235c3b3ed57ca58b7050951af8828e68bc451608dc36430f5a21d942

SHA512
95a6cbc6c4e34a6464c6ffc1f211c5031dc94354d85138c7d24bdbd6fa5e6fcb2e3eb8b1f5cee5d6c72b26e2b0b0562d6210f901596b0fa6c6b7605803757707

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
23138166f142d9e1e56d2d75086347c8

SHA1
83cf1f81c9a4a1707ada4ef0adbee58d038d2a5c

SHA256
a94d4adf4b3ac3095670f4b1b743b969abf1361de3ef9746e697c6e43c3094e3

SHA512
e2eb460be294f4759d9691cee4fa588af52de6fb435e36b023ac600a20c9f00198a8869d1c1efc79df1eae52ee35c6dad45189a7f6827ed9741294c6d559b1d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb0ddd6c3474c1bac82de89b263c6495

SHA1
e0aee864a135564dff5caf49b7bf0d99dee1ab5e

SHA256
0041a14cd11e427321b1e151e3f822c4bee151bad44f3c318444b09bbef499f8

SHA512
b07e6466c06ab90c97b9de5bf6087773d1bc92e9e78858b71714ab570273866844e2c3e61973ec2237139b5b7805a4633e430d5fbb8f429e7131a97de21c71dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
af5e7663ba283a5ac27f82fd132b6dce

SHA1
338b27d283f74ceba7ea2690dc47fdac8dd65d69

SHA256
cee618efd69973ce2d534f24a79f68cc3b2077cacaaf921630c50c9ed85b8006

SHA512
4a192b6b51b1cc4f6be746744043f7a30ea3257979c6098af8c738503e9ebf31118033085f7241efe52839939e8b5fbed8efbcf57e0b0c489235f7b4179cfd0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fb8536e38cee4edc133a37c231f83838

SHA1
e650c8163550ea454fbb424b1211aa5e0c4ae231

SHA256
126f1efcf85627bcf23b3a709d408df1c4b205ae35e23d08f2784167d76edc35

SHA512
b85dce060e6898660bf067d7c8243a4f25b0e1ac05c627a104d53127ad30f87097c7e70fc983ad94f94f00bbe0b3e9e59eb6a7fed0c184900ed6876c028a3c47

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

Filesize
73KB

MD5
81e5c8596a7e4e98117f5c5143293020

SHA1
45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

SHA256
7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

SHA512
05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL

Filesize
40KB

MD5
48c00a7493b28139cbf197ccc8d1f9ed

SHA1
a25243b06d4bb83f66b7cd738e79fccf9a02b33b

SHA256
905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7

SHA512
c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTCTL.DLL

Filesize
160KB

MD5
237e13b95ab37d0141cf0bc585b8db94

SHA1
102c6164c21de1f3e0b7d487dd5dc4c5249e0994

SHA256
d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

SHA512
9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL

Filesize
60KB

MD5
a334bbf5f5a19b3bdb5b7f1703363981

SHA1
6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

SHA256
c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

SHA512
1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL

Filesize
64KB

MD5
7c5aefb11e797129c9e90f279fbdf71b

SHA1
cb9d9cbfbebb5aed6810a4e424a295c27520576e

SHA256
394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

SHA512
df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL

Filesize
60KB

MD5
4fbbaac42cf2ecb83543f262973d07c0

SHA1
ab1b302d7cce10443dfc14a2eba528a0431e1718

SHA256
6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

SHA512
4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL

Filesize
36KB

MD5
b4ac608ebf5a8fdefa2d635e83b7c0e8

SHA1
d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

SHA256
8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

SHA512
2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL

Filesize
60KB

MD5
9fafb9d0591f2be4c2a846f63d82d301

SHA1
1df97aa4f3722b6695eac457e207a76a6b7457be

SHA256
e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

SHA512
ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE

Filesize
268KB

MD5
5c91bf20fe3594b81052d131db798575

SHA1
eab3a7a678528b5b2c60d65b61e475f1b2f45baa

SHA256
e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

SHA512
face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL

Filesize
28KB

MD5
0cbf0f4c9e54d12d34cd1a772ba799e1

SHA1
40e55eb54394d17d2d11ca0089b84e97c19634a7

SHA256
6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1

SHA512
bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP

Filesize
8KB

MD5
466d35e6a22924dd846a043bc7dd94b8

SHA1
35e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10

SHA256
e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801

SHA512
23b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF

Filesize
2KB

MD5
e4a499b9e1fe33991dbcfb4e926c8821

SHA1
951d4750b05ea6a63951a7667566467d01cb2d42

SHA256
49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d

SHA512
a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB

Filesize
28KB

MD5
f1656b80eaae5e5201dcbfbcd3523691

SHA1
6f93d71c210eb59416e31f12e4cc6a0da48de85b

SHA256
3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2

SHA512
e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF

Filesize
7KB

MD5
b127d9187c6dbb1b948053c7c9a6811f

SHA1
b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9

SHA256
bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00

SHA512
88e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL

Filesize
52KB

MD5
316999655fef30c52c3854751c663996

SHA1
a7862202c3b075bdeb91c5e04fe5ff71907dae59

SHA256
ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

SHA512
5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Msvcirt.dll

Filesize
76KB

MD5
e7cd26405293ee866fefdd715fc8b5e5

SHA1
6326412d0ea86add8355c76f09dfc5e7942f9c11

SHA256
647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255

SHA512
1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\Msvcp50.dll

Filesize
552KB

MD5
497fd4a8f5c4fcdaaac1f761a92a366a

SHA1
81617006e93f8a171b2c47581c1d67fac463dc93

SHA256
91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

SHA512
73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\W95INF16.DLL

Filesize
2KB

MD5
7210d5407a2d2f52e851604666403024

SHA1
242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9

SHA256
337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af

SHA512
1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\W95INF32.DLL

Filesize
4KB

MD5
4be7661c89897eaa9b28dae290c3922f

SHA1
4c9d25195093fea7c139167f0c5a40e13f3000f2

SHA256
e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5

SHA512
2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\andmoipa.ttf

Filesize
29KB

MD5
c3e8aeabd1b692a9a6c5246f8dcaa7c9

SHA1
4567ea5044a3cef9cb803210a70866d83535ed31

SHA256
38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e

SHA512
f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.dll

Filesize
1.2MB

MD5
ed98e67fa8cc190aad0757cd620e6b77

SHA1
0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

SHA256
e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

SHA512
ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.hlp

Filesize
11KB

MD5
80d09149ca264c93e7d810aac6411d1d

SHA1
96e8ddc1d257097991f9cc9aaf38c77add3d6118

SHA256
382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42

SHA512
8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tv_enua.inf

Filesize
2KB

MD5
0a250bb34cfa851e3dd1804251c93f25

SHA1
c10e47a593c37dbb7226f65ad490ff65d9c73a34

SHA256
85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae

SHA512
8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\tvenuax.dll

Filesize
40KB

MD5
1587bf2e99abeeae856f33bf98d3512e

SHA1
aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

SHA256
c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

SHA512
43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC184.tmp\UAC.dll

Filesize
14KB

MD5
adb29e6b186daa765dc750128649b63d

SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9

SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08

SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsnC184.tmp\nsExec.dll

Filesize
6KB

MD5
132e6153717a7f9710dcea4536f364cd

SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

Download Submit
C:\Users\Admin\AppData\Roaming\Data\1.bin

Filesize
7.4MB

MD5
0b3c41fee3a69110fb58554519cd4639

SHA1
9537cb0405973ae630c3d926cda6a2825b9288c8

SHA256
587b3d5078538290e49d2a8fd1740a8fc7960a0faaea4d5cae0959d99ed14fef

SHA512
ad2eb4a04db685649d70bdc521cf59f570d5407d284f5bb419efc60b94802d91a755417ba4bc44bceec78b155295b084fc6edff31d4760c08058cc04ebdb0008

Download Submit
C:\Users\Admin\AppData\Roaming\Data\10.bin

Filesize
452KB

MD5
a2f47c218e2507db3b22eb7e6d780001

SHA1
218a59915bfede4b5cbf2427200566709aa05bd5

SHA256
5b60fc854544978a715bcbca8f5a3abd28bcd0bd8b50fb953318640f7a266d37

SHA512
ae7152c080773d3910eeb05a47cfb551875e65dc5d88734114d03a6526348164caf179f2fc3b743850ed90b4fb80542e8b36ca31b3ef8168302500fbc0a701ff

Download Submit
C:\Users\Admin\AppData\Roaming\Data\14.bin

Filesize
479KB

MD5
e80a37c42ca0d2bc7f004afc4b822d6a

SHA1
f17361409ecb19135e3b4292199fb69bd4b012c8

SHA256
71ec6f96779240d530ddf16fecb1df97661b9e1ba8201135459729c8d4d2bac5

SHA512
b3ff7e71af33dc3368a198de8aaa4cbad8daf7ae90b3d398fe9f2cde490bacca07e6bcce08f6afec5943b634a2ed0ef9b121b89a68992d22bf3f831b6f33efed

Download Submit
C:\Users\Admin\AppData\Roaming\Data\15.bin

Filesize
528KB

MD5
3948ca5e92fb2d019a8f16765f7a5e40

SHA1
5290a66876ab0f62ba34b6b524a0e7771e31ee3c

SHA256
ca362bcaf0e62fca16febafc2d15cbb1ea92e2ad6cc22fa5337316ab8bf2bc27

SHA512
ad56d867e1040bfb5b2998a2d62ffc508989a5fc501f22ab775bc9f715f1cc2d4ccb0a899f8b2a82e7597bf715ad70b6826875e72e23273ef306f5bdca47df03

Download Submit
C:\Users\Admin\AppData\Roaming\Data\2.bin

Filesize
353KB

MD5
8766dce04feb646bf62206d64d6eb0ba

SHA1
91c5d588028c6c949e9cbcec950bcfaa35a791e4

SHA256
f87e1ab69bef059744ee9244f37b0f21ef7d7b06fc5245094cfa22637ef6ae9d

SHA512
0bc8fc880bb94ad55a732f2be207d88a6bb0ae8d97f91819e889d04420a71ae5d91af21861bad351c5fd7f4e944c1899b17df326bf19d310cc31a95fd38ee6a3

Download Submit
C:\Users\Admin\AppData\Roaming\Data\7.bin

Filesize
372KB

MD5
22df6fab4552241b0a7d650a15a336d1

SHA1
1e2b12c9ce52e5b433413d28d96be0974f6f7390

SHA256
d47f4fbfe7d145a737cf2e9a6c519e38510957a2ae663d4295e00ce0f6e651a2

SHA512
505a53580f7f76df021a466fdaec6ad8230ba04acc7115286d1a801d51a686fce08a23aaddaf0e134e94ce822191892987db8541edbefaa6928a2927c5508292

Download Submit
C:\Users\Admin\AppData\Roaming\Data\8.bin

Filesize
408KB

MD5
5ada580c290b53327fc8db29d5cd66c5

SHA1
a504aff6a9fa93bf4ccb69df17b5238804c659f9

SHA256
5dcf1f4b285a6dd70ec7acd77eeb5752a3d381a8a697eafd394fcde615f3ba63

SHA512
36da1958e7b4fad5367b257d9343c4eab59d50b01c610514d48eae2d0eeabf7efd06dd8fc63551a0a7e11df91aa3ceb063003cdd9c30c6755431ba218524fd49

Download Submit
C:\Users\Admin\AppData\Roaming\Data\9.bin

Filesize
13KB

MD5
f0e3d4ad2f1d09acf314a9e7a92777ff

SHA1
958224c3c98945c38f4e12ad6d1c64c4b91e189f

SHA256
b897644e314b31e0dd5159d061b9e77a512178f29a9f36076ec105e286212bb4

SHA512
28ccc056d2f5bde039cc3502a584cce3baa5cf9700fda8775344935438a6951989b3a24903693ac5e5292ff250cc27f338b783b29191948bed7ff4cc8038c8ac

Download Submit
C:\Users\Admin\AppData\Roaming\MEMZ.exe

Filesize
21KB

MD5
5761ae6b5665092c45fc8e9292627f88

SHA1
a7f18d7cf5438ee7dcb4e644163f495d3fa9c0ef

SHA256
7acabca3631db2a73a5e20abd050097e44390ead1d74717aed936601904b73c2

SHA512
1d743b407663e00a296c2ae45cb5a05a0866657afafbc9e8220e4c1839cbab2c09bf2a3510ec8016f902ccb7254edddf2a3412e7f5a4cafcabbeb5724a67b46e

Download Submit
C:\Users\Admin\AppData\Roaming\data\12.bin

Filesize
5.4MB

MD5
9e0ab3181d32ac9950dbe1026b197207

SHA1
d8b53f3a93d5e2df9507b6256f2e414712347256

SHA256
a3091d14161d268924a4d6195f820c64b1811d6afbd6948dde29e267ecb56cae

SHA512
424f8f0a6e945fcd831ca0d0f73f898dad0214f38cc477cb3be8b161836e349cd5d629444033e134e2fd6b8c85cae088f177aea4e26d7192a4f60a5739584c2e

Download Submit
C:\note.txt

Filesize
133B

MD5
910efec550edf98bf4f4e7ab50ca8f98

SHA1
4571d44dc60e892fb22ccd0bc2c79c3553560742

SHA256
7349f657a8d247fc778b7dd68e88bc8aba73bf2c399dc17deb2c9114c038430b

SHA512
320de5e34c129dd4a742ff352cfe0be2fac5874b593631529e53d5fe513709ac01f5d1d3dfae659f36a2a33aae51534ec838f5d3748cd6d1230a0f3d29341442

Download Submit
memory/3472-48-0x0000000003BC0000-0x0000000003BD0000-memory.dmp

Filesize
64KB

Download
memory/3472-52-0x0000000003BC0000-0x0000000003BD0000-memory.dmp

Filesize
64KB

Download
memory/3472-49-0x0000000003BC0000-0x0000000003BD0000-memory.dmp

Filesize
64KB

Download
memory/3472-50-0x0000000003BC0000-0x0000000003BD0000-memory.dmp

Filesize
64KB

Download
memory/3472-51-0x0000000003BC0000-0x0000000003BD0000-memory.dmp

Filesize
64KB

Download