agenttesla | hxxps://www[.]google[.]com/search?client=opera-gx&q=xworm&sourceid=opera&ie=UTF-8&oe=UTF-8

Analysis

max time kernel
405s
max time network
409s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
09/07/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.google.com/search?client=opera-gx&q=xworm&sourceid=opera&ie=UTF-8&oe=UTF-8

Score

10^/10

agenttesla agilenet keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

resource	yara_rule
behavioral3/memory/6680-2493-0x000002345B100000-0x000002345B2F4000-memory.dmp	family_agenttesla

Executes dropped EXE 3 IoCs

pid	Process
2460	dotNetFx45_Full_setup.exe
1224	Setup.exe
6680	crack.exe

Loads dropped DLL 6 IoCs

pid	Process
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
6680	crack.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral3/memory/6680-2485-0x000002345B3A0000-0x000002345BFD8000-memory.dmp	agile_net

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	crack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	crack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	crack.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3637748876-3197268895-3385380113-1000\{152CFC2F-2A4B-467B-B67F-D0BA4752D040}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3637748876-3197268895-3385380113-1000_Classes\Local Settings	msedge.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\dotNetFx45_Full_setup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\XWorm.V5.2.rar:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 705242.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 821692.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2300	msedge.exe
2300	msedge.exe
3636	msedge.exe
3636	msedge.exe
388	identity_helper.exe
388	identity_helper.exe
3480	msedge.exe
3480	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
4924	msedge.exe
4924	msedge.exe
2004	msedge.exe
2004	msedge.exe
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
1224	Setup.exe
1260	msedge.exe
1260	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeRestorePrivilege	5888	7zG.exe
Token: 35	5888	7zG.exe
Token: SeSecurityPrivilege	5888	7zG.exe
Token: SeSecurityPrivilege	5888	7zG.exe
Token: SeDebugPrivilege	6680	crack.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2460	dotNetFx45_Full_setup.exe
3424	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 3016	3636	msedge.exe	78
PID 3636 wrote to memory of 3016	3636	msedge.exe	78
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 3540	3636	msedge.exe	79
PID 3636 wrote to memory of 2300	3636	msedge.exe	80
PID 3636 wrote to memory of 2300	3636	msedge.exe	80
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81
PID 3636 wrote to memory of 3280	3636	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/search?client=opera-gx&q=xworm&sourceid=opera&ie=UTF-8&oe=UTF-8
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff8c3d3cb8,0x7fff8c3d3cc8,0x7fff8c3d3cd8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5548 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- C:\Users\Admin\Downloads\dotNetFx45_Full_setup.exe
  "C:\Users\Admin\Downloads\dotNetFx45_Full_setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2460
- - C:\112a3a4c0eb381e2347f\Setup.exe
    C:\112a3a4c0eb381e2347f\\Setup.exe /x86 /x64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7840 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7796 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8384 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8648 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8788 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8476 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9432 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8024 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9424 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8928 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9012 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9328 /prefetch:1
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9200 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8892 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9584 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9232 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8740 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8436 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:1
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8432 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7536 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8440 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8700 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8800 /prefetch:1
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10312 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10448 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10772 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=11208 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8996 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9308 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:7152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8676 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9072 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9152 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8256 /prefetch:1
  2⤵
  PID:6244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,14588750068386476713,2019852546261154995,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:5268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3436

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004EC
1⤵
PID:5064

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3424

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm.V5.2\" -ad -an -ai#7zMap7879:82:7zEvent17653
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Users\Admin\Downloads\XWorm.V5.2\XWorm V5.2\crack.exe
"C:\Users\Admin\Downloads\XWorm.V5.2\XWorm V5.2\crack.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:6680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:7072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff8c3d3cb8,0x7fff8c3d3cc8,0x7fff8c3d3cd8
    3⤵
    PID:7088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:6728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff8c3d3cb8,0x7fff8c3d3cc8,0x7fff8c3d3cd8
    3⤵
    PID:6764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/XCoderTools
  2⤵
  PID:7084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x128,0x12c,0x130,0x98,0x134,0x7fff8c3d3cb8,0x7fff8c3d3cc8,0x7fff8c3d3cd8
    3⤵
    PID:7144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\112a3a4c0eb381e2347f\1025\LocalizedData.xml

Filesize
49KB

MD5
d84db0827e0f455f607ef501108557d0

SHA1
d275924654f617ddaf01b032cf0bf26374fc6cd5

SHA256
a8d9fd3c7ebb7fee5adb3cafe6190131cebfcbeff7f0046a428c243f78eac559

SHA512
1b08115a4ea03217ce7a4d365899bd311a60490b7271db209d1e5979a612d95c853be33d895570e0fb0414ab16eb8fd822fe4e3396019a9edd0d0c7ff9e57232

Download Submit
C:\112a3a4c0eb381e2347f\1028\LocalizedData.xml

Filesize
41KB

MD5
ff41100cc12e45a327d670652f0d6b87

SHA1
cb53d671cb66d28b6eb7247a1a0c70a114d07e6b

SHA256
ef3de7ab3d80a4d2865b9e191d2311112b4870103d383ae21882f251bbde7f0a

SHA512
f8a2f8db5957a43aa82bd7d193b2ff2a151bba6a9d0ad2d39e120909a0f8939123b389ebb4244a417f9e4d8e46629c49ac193c320231cb614253612af45281a8

Download Submit
C:\112a3a4c0eb381e2347f\1029\LocalizedData.xml

Filesize
53KB

MD5
51130f3479df72fe12b05a7aba1891d3

SHA1
fbaf9c0269d532a3ce00d725cd40772bc0ad8f09

SHA256
8845d0f0fadfdf51b540d389bbb0a8a9655cf65055e55dcd54fa655576dd70a1

SHA512
b641e22b81babbde85a6f324851d35f47bd769fc0cff74911010ae620cf682f9c7bc4d946d2f80a46a9851f3cc912625991c8a3876f1d958ea4d49d8791d1815

Download Submit
C:\112a3a4c0eb381e2347f\1030\LocalizedData.xml

Filesize
52KB

MD5
53aa67d27c43a35c6f61552ee9865f55

SHA1
504035de2fe6432d54bc69f0d126516f363e1905

SHA256
5d08b297b867179d8d2ec861dbf7e1dfdb283573430a55644e134ee39083157a

SHA512
7a284076f6f204e5be41eab3c3abb1983fbbc21669130cc7e6961a7b858f30caf83fbcb2ef44cfe712341ab664347df29d58b650f004608b015e61e4f5d4f47b

Download Submit
C:\112a3a4c0eb381e2347f\1031\LocalizedData.xml

Filesize
55KB

MD5
f8e3a846d4aca062413094f1d953075e

SHA1
09f2aa5b5ef693051862965c7c1063d31623f433

SHA256
5a929328125673d922e7f969769b003f5cb6942daa92818a384d50ac755174c2

SHA512
95fead89ac87c700615deef0b5c75aa818172cb387fb5e7178d0a96adb4a60abe86c3793f1174ad27b3a12fe29a371682a032d83d2c63f50a223e37a9d5fc7c6

Download Submit
C:\112a3a4c0eb381e2347f\1032\LocalizedData.xml

Filesize
56KB

MD5
8ecac4ca4cc3405929b06872e3f78e99

SHA1
805250d3aa16183dc2801558172633f718a839c4

SHA256
b9e9740a1f29eeaf213e1e0e01f189b6be1d8d44a2ab6df746eebe9cb772f588

SHA512
6f681c35a38a822f4747d6d2bcacefc49a07c9ca28a6b8eed38b8d760327419b5b469698bed37366c2480a4f118d4d36c6ae0f3c645f185e39a90ff26e749062

Download Submit
C:\112a3a4c0eb381e2347f\1033\LocalizedData.xml

Filesize
51KB

MD5
24fde6338ea1a937945c3feb0b7b2281

SHA1
6b8b437cd3692207e891e205c246f64e3d81fdd5

SHA256
63d37577f760339ed4e40dc699308b25217ce678ce0be50c5f9ce540bb08e0a7

SHA512
9a51c7057de4f2ec607bb9820999c676c01c9baf49524011bb5669225d80154119757e8eb92d1952832a6cb20ea0e7da192b4b9ddf813fa4c2780200b3d7ba67

Download Submit
C:\112a3a4c0eb381e2347f\1035\LocalizedData.xml

Filesize
52KB

MD5
de5ccb392face873eae6abc827d2d3a7

SHA1
50eab784e31d1462a6e760f39751e7e238ba46a2

SHA256
6638228cb95fc08eebc9026a2978d5c68852255571941a3828d9948251ca087d

SHA512
b615a69b49404d97ce0459412fbd53415dfbc1792ed95c1f1bd30f963790f3f219e028f559706e8b197ce0223a2c2d9f2e1cac7e3b50372ebef0d050100c6d10

Download Submit
C:\112a3a4c0eb381e2347f\1036\LocalizedData.xml

Filesize
55KB

MD5
75bf2db655ca2442ae41495e158149c9

SHA1
514a48371362dfa2033ba99ecab80727f7e4b0ee

SHA256
1938c4ffedfbb7fea0636238abb7f8a8db53db62537437ff1ec0e12dca2abfab

SHA512
1b697d0621f47bb66d45ae85183a02ec78dd2b6458ef2b0897d5bbbd2892e15eaf90384bc351800b5d00cb0c3682db234fac2a75214d8ade4748fc100b1c85b2

Download Submit
C:\112a3a4c0eb381e2347f\1037\LocalizedData.xml

Filesize
48KB

MD5
94f3480d829cee3470d2ba1046f2f613

SHA1
9a8ffc781afb5f087b39abe82c11e20d3e08b4f3

SHA256
eceb759e0f06e5d4f30bc8a982f099c6c268cff4a1459222da794d639c74f97f

SHA512
436d52da9c6c853616cf088c83b55032e491d6d76eeca0bf0cb40b7a84383a1fcffcb8ac0793cdea6af04d02acf5c1654d6b9461506ee704d95a9469581e8eaf

Download Submit
C:\112a3a4c0eb381e2347f\1038\LocalizedData.xml

Filesize
54KB

MD5
818e35b3eb2e23785decef4e58d74433

SHA1
41b43d0b3f81a3a294aa941279a96f0764761547

SHA256
3d8b2c8079cf8117340a8fc363dceb9be102d6eb1a72881b0c43e1e4b934303e

SHA512
98ae09da1be0ebe609d0e11d868258ab322cdc631e3105296c8ce243d821b415f3c487cbb4cd366bb4bdb7f0f9447a25836e53320b424a9ff817cac728ff4ae2

Download Submit
C:\112a3a4c0eb381e2347f\1040\LocalizedData.xml

Filesize
53KB

MD5
5e805353cb010fc22f51c1f15b8bcaa1

SHA1
9360f229aee4fed6897d4f9f239072aa22d6da9e

SHA256
02b83ebd2689e22668a5ee55a213091fdc090dfee42c0be9386f530d48af8950

SHA512
275d7c7c952a352417fe896c5be07f5a4c50ff51569cb04ab615cda6a880a8e83f651c87f226a1eb79d8286f777488bfaac2636a1a2057cf5db83037b3e1214f

Download Submit
C:\112a3a4c0eb381e2347f\1041\LocalizedData.xml

Filesize
45KB

MD5
5ab13768b6c897eff96e35f91b834d25

SHA1
54f04c73a57a409e4c1fe317a825ee2ed4ddcd10

SHA256
87b5ce86b0134ea82215dcf04ffbf7f5c8a570f814f82b4c7ba6106195924c6b

SHA512
ee98f34723a1593ef12589ea9657f8d9a3c9dc8a3fb5eed6f8bb026c6656a3ca6fec8243745ed7fbf406019b6e2b42762c1ee74d26c0f70cc9da272291fe680f

Download Submit
C:\112a3a4c0eb381e2347f\1042\LocalizedData.xml

Filesize
44KB

MD5
ad25367f86144f29946df3b3866e7dbe

SHA1
cc8470dbe0bfe9394742d639d9caeec961a27928

SHA256
90d0885f929059358fe76e61b560b3d188abbe7c041babefc82038f6faebb7eb

SHA512
66a343d1405e377bf2d303b0ec896814a46248c05dfe61a2c3167ed1c915964f7f57b335bd7fae324461e65e5ee6bc2384eff28f71c4325eb3c4f89611659afb

Download Submit
C:\112a3a4c0eb381e2347f\1043\LocalizedData.xml

Filesize
53KB

MD5
898d2a1a5fac4d1a028aa11e0ed9f9b4

SHA1
343795fbc1bbf1b0982dc9e70501721433fba892

SHA256
73130da9b103f1812ca69cfffdf5750e74b0228cd40e0325a7f14e799aaf21a3

SHA512
fac3fd81d803c1029df6a3cd93060c950b0ba399fe074d438c4867d55468e7de9aa77bbd7b51fe866f6849684408c853d70956e94de39d4f61019825028a25e4

Download Submit
C:\112a3a4c0eb381e2347f\1044\LocalizedData.xml

Filesize
53KB

MD5
a459afdbe20f5d4c904d3e3700ee9191

SHA1
22570b1de34c11796390057537269145a2c63438

SHA256
0ac4bcf5cee39ad42070e34393303ffe3ef27e71c8d9522f3dc01e12f93dda03

SHA512
b01536c774121ba9fe25014bb802b45449ba46529af8ad59f3ff93e339e7443238b268716ac051d24ac9eba093e5d66fd5c5faa2ca17bf744ec31e50627159ce

Download Submit
C:\112a3a4c0eb381e2347f\1045\LocalizedData.xml

Filesize
53KB

MD5
95c6472f2c8329ec1c10f7df3a31c154

SHA1
624d46235912dc169913ba77caa7889219e2c394

SHA256
197722527d1ad65a10a29ecec04f029abc549eb5d05bc07a68107ad6dd4bd35b

SHA512
28149ab0c041dc35f717435f3c2218700090fc38723219c1cd40ec7f777c68d99dd08b6a42014ead8fb1e309637b6c33aa5dec0518dc1b72273c7a6fd7ef06c0

Download Submit
C:\112a3a4c0eb381e2347f\1046\LocalizedData.xml

Filesize
52KB

MD5
c13b50e2a7f6e7e9343500771cf2d247

SHA1
0b679d20dda94224a5ddd80863a2a32de1cc6f1e

SHA256
3f9bf4eee9ece4a0181ea344344230d73d711aba2fa9248834e3b7547a3062cf

SHA512
32daea597a34f60ca5b73648d66663e4723c0d588af4ce08f76240aabbecd3a35abfbfd5e22abd8eac8ca64a9f2b3edadb8d1c24bc31f53ce5cd902dba3fc5da

Download Submit
C:\112a3a4c0eb381e2347f\1049\LocalizedData.xml

Filesize
53KB

MD5
1c8ad8f7aacde7ac59bfd9730cfcae80

SHA1
815c79113429b37d34c7ddff46ceccfe58b4cddc

SHA256
4faa58922f623685f05386ce518c0243e3f310db5ac64c58e5b4e91a3e4477b7

SHA512
27d5871f862756945c66397d539c79bf6032ec0d6a06255ad6b57ad1df3c1e8c87dc55dcc3febfb4bd1ce4eb24f3268fab30b1df3fd1c035d66410337db73785

Download Submit
C:\112a3a4c0eb381e2347f\1053\LocalizedData.xml

Filesize
52KB

MD5
984229d90d2e75f49cd9de5df014e484

SHA1
fc32854972f189305a38c11a62ef457cd94026c6

SHA256
c884f515f337e977d4cf1a19ff693c753813ede2e52a9dbe8f6ef25184ccae8d

SHA512
23101cc1b6c17f10a8d53c59c4e9bf6d24d03d781fa1a36fcb89315f2257ea4a1bd652bdbc81845479a88f00f1db52b35a0bba311a9885c7503689f9c25e49c2

Download Submit
C:\112a3a4c0eb381e2347f\1055\LocalizedData.xml

Filesize
52KB

MD5
ddb64b6c4fc498c27d291edaaf65a536

SHA1
e312eef1e9a485c5c6fe4578bbe1dd0cadbb1e3e

SHA256
027180d93ceb875227a1d76a018b870cd1d09e143ffa1632b31c322b92dd6a35

SHA512
ddb55169000052fb27caeeb349939925c7df1535c5c697da7cc2be3224c2c8ebe64328d865d1dfdbad4c1e0588853c5309e31de747f71b7f3bc9b6a9eb4335c1

Download Submit
C:\112a3a4c0eb381e2347f\2052\LocalizedData.xml

Filesize
41KB

MD5
759eb338d738ca6c531b9d5b06591b3b

SHA1
c9ed5ada615ccacd887a0d07ee25dfe1d7fbc00c

SHA256
a4c3bc545fc028935ad6ec4bd8ce51a300fab8a0b128cca89a8c14923d437b16

SHA512
82e6b969dedfdda477f6fb7fcb50a0acad0b26b9b4cca9f1adab5323c6c144da6c0bff34e39e0ef7b39f37ab5808f0064eace99867f7cd258e91aeb5aa5baef2

Download Submit
C:\112a3a4c0eb381e2347f\2070\LocalizedData.xml

Filesize
54KB

MD5
6930ce4e8e28f54a0db5d919b6babd0e

SHA1
0278bf717168c061709e60ca754c8dc6e32b92d1

SHA256
4bbb7f8a9743a5a21711156dc978dc8683b3edcd9ca32e4c6a38dbe6f5001e04

SHA512
904dc390c6cad81e60159683fadc5e8556585b32f1f9482accfedf3ee6b14cd8240e2225e3ce8a0338da93162cef601c4e9798327a1bc390e62b4eb2fc59cd4c

Download Submit
C:\112a3a4c0eb381e2347f\3082\LocalizedData.xml

Filesize
53KB

MD5
e58efac53fe2a16be9b99d0aa33baa3d

SHA1
7f2fecb6c4ebe9374a04f374d43465d968b3e33f

SHA256
64baa04b7ebb5ee833f43493497e99a6f2584bdc763a7c24700693cb89b35a0c

SHA512
b9b2e07e845e6bb509d4471cbe3c848836938e507308293f7c083c54cef61911a06110a5616c216ec72c39ce887b2e7f5961688809a2dad787d131ef2780d22e

Download Submit
C:\112a3a4c0eb381e2347f\DHTMLHeader.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\112a3a4c0eb381e2347f\ParameterInfo.xml

Filesize
731KB

MD5
4925613d29bc7350130c7076e4c92c1c

SHA1
2821351d3be08f982431ba789f034b9f028ca922

SHA256
9157a0afe34576dfea4ba64db5737867742b4e9346a1f2c149b98b6805d45e31

SHA512
3e69650e4101a14ef69f94fa54b02d8d305039165a0bffc519b3cf96f2dcbcf46845e4669d29ccc5ceb887b2f95fc4756265b19d5c17aa176d3d6dc53ed83f77

Download Submit
C:\112a3a4c0eb381e2347f\Setup.exe

Filesize
85KB

MD5
8b3ecf4d59a85dae0960d3175865a06d

SHA1
fc81227ec438adc3f23e03a229a263d26bcf9092

SHA256
2b088aefcc76d0baa0bff0843bf458db27bacc47a8e698c9948e53ffc471828b

SHA512
a58a056a3a5814a13153b4c594ed72796b4598f8e715771fc31e60c60a2e26250768b8f36b18675b91e7ecc777ef27c7554f7a0e92c2dfaba74531e669c38263

Download Submit
C:\112a3a4c0eb381e2347f\SetupEngine.dll

Filesize
868KB

MD5
43bc7b5dfd2e45751d6d2ca7274063e4

SHA1
a8955033d0e94d33114a1205fe7038c6ae2f54f1

SHA256
a11af883273ddbd24bfed4a240c43f41ce3d8c7962ec970da2d4c7e13b563d04

SHA512
3f3068e660fea932e91e4d141d8202466b72447107ff43f90dea9557fc188696617025531220bc113dc19fdd7adf313a47ac5f2a4ce94c65f9aeb2d7deda7f36

Download Submit
C:\112a3a4c0eb381e2347f\SplashScreen.bmp

Filesize
40KB

MD5
0966fcd5a4ab0ddf71f46c01eff3cdd5

SHA1
8f4554f079edad23bcd1096e6501a61cf1f8ec34

SHA256
31c13ecfc0eb27f34036fb65cc0e735cd444eec75376eea2642f926ac162dcb3

SHA512
a9e70a2fb5a9899acf086474d71d0e180e2234c40e68bcadb9bf4fe145774680cb55584b39fe53cc75de445c6bf5741fc9b15b18385cbbe20fc595fe0ff86fce

Download Submit
C:\112a3a4c0eb381e2347f\UiInfo.xml

Filesize
37KB

MD5
d8f565bd1492ef4a7c4bc26a641cd1ea

SHA1
d4c9c49b47be132944288855dc61dbf8539ec876

SHA256
6a0e20df2075c9a58b870233509321372e283ccccc6afaa886e12ba377546e64

SHA512
ecf57cc6f3f8c4b677246a451ad71835438d587fadc12d95ef1605eb9287b120068938576da95c10edc6d1d033b5968333a5f8b25ce97ecd347a42716cd2a102

Download Submit
C:\112a3a4c0eb381e2347f\sqmapi.dll

Filesize
191KB

MD5
d475bbd6fef8db2dde0da7ccfd2c9042

SHA1
80887bdb64335762a3b1d78f7365c4ee9cfaeab5

SHA256
8e9d77a216d8dd2be2b304e60edf85ce825309e67262fcff1891aede63909599

SHA512
f760e02d4d336ac384a0125291b9deac88c24f457271be686b6d817f01ea046d286c73deddbf0476dcc2ade3b3f5329563abd8f2f1e40aee817fee1e3766d008

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f1998107017edc46fed4599ad24cfe53

SHA1
47e92f0646f0de9241c59f88e0c10561a2236b5e

SHA256
cc6838475e4b8d425548ceb54a16d41fb91d528273396a8f0b216889d79e0caa

SHA512
ef7228c3da52bf2a88332b9d902832ed18176dfff7c295abfbaab4e82399dc21600b125c8dad615eb1580fab2f4192251a7f7c557842c9cac0209033a3113816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
21cf39beee4d807318a05a10dc3f1bf3

SHA1
01ef7fc09919eb33292a76934d3f2b5ba248f79c

SHA256
b766823dabbf6f78e2ee7c36d231d6708800126dc347ce3e83f4bf27bc6e2939

SHA512
0baf8b0964d390b9eb7fafd217037709ac4ab31abcdf63598244026c31284cd838f12d628dcffe35d5661ba15a5e4f3b82c7c2d9226ac88856a07b5b7b415291

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
69KB

MD5
7d5e1b1b9e9321b9e89504f2c2153b10

SHA1
37847cc4c1d46d16265e0e4659e6b5611d62b935

SHA256
adbd44258f3952a53d9c99303e034d87c5c4f66c5c431910b1823bb3dd0326af

SHA512
6f3dc2c523127a58def4364a56c3daa0b2d532891d06f6432ad89b740ee87eacacfcea6fa62a6785e6b9844d404baee4ea4a73606841769ab2dfc5f0efe40989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
41KB

MD5
970d0e20692b74e97203d5cf9358350f

SHA1
3e45b858a775b05d117b26a317ceef16d3320ad1

SHA256
2c2ba720b00b5ea91083f203eba58347373081ef53201695e5b2de96405945a3

SHA512
75cd3e41d4094aad759b315eb56eefa1f2b3a4111899ad0da733b12ceef8157ad44d507a01705f9b1ac77c53866355a08edef8663608ec2d7753425c203ba507

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
88KB

MD5
b38fbbd0b5c8e8b4452b33d6f85df7dc

SHA1
386ba241790252df01a6a028b3238de2f995a559

SHA256
b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

SHA512
546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
1.2MB

MD5
620dd00003f691e6bda9ff44e1fc313f

SHA1
aaf106bb2767308c1056dee17ab2e92b9374fb00

SHA256
eea7813cba41e7062794087d5d4c820d7b30b699af3ec37cb545665940725586

SHA512
3e245851bfa901632ea796ddd5c64b86eda217ec5cd0587406f5c28328b5cb98c5d8089d868e409e40560c279332ba85dd8ce1159ae98e8588e35ed61da2f006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
73KB

MD5
7322a4b055089c74d35641df8ed19efa

SHA1
b9130bf21364c84ac5ed20d58577f5213ec957a1

SHA256
c27e6cbe88590ba6a04271b99d56aa22212ccf811a5d17a544ee816530d5fd44

SHA512
bad26b076fa0888bf7680f416b39417abe0c76c6366b87e5a420f7bc5a881cc81f65b3ef4af4ba792aa6030bcf08bdc56b462775f38c4dbf48ff4d842c971bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
18KB

MD5
db723e3bb0f90d9aa63245954da574ea

SHA1
f242ef3c638c5ba737c2b67b3c710e5ce3e6e0ad

SHA256
a87feb560e0f03efe648c08fade6e4045222e54f614b4d56ad31ed78b80a9de0

SHA512
44e956280c3349f612bb558088fadf127a991d7760bc8c4fd6ff47d520e529eb42863f249d28b771ef84d069a8d24a5ac841bf30a31818051292cb1a2a4c10ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
134KB

MD5
6dfed9cf65ff51fcd0ae09e94ede2d00

SHA1
c4a30c1de2fa65906fec2a281095a425b0b8cb62

SHA256
a00c1b31fde14d7e84ffdb12e2d54a6ee252529a5f70e542f5cc2c7ba18f3942

SHA512
d6d5ee398b174301e09815ba5595d2feb456ddbecda641d80cdd8424593922ca6615471919951691a3fa9f260bfd19ba599569c3d829cec9cb8236be803b0ee7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
31KB

MD5
eb86f50046c8669fe4846ae3ce0a16c1

SHA1
b94cbaa3e239a6fa0fb5f0121158f68089512846

SHA256
574e62aec1b06bc37c1ad7a9ed20e16faed2c7ee6889316848f5c0cfce1f8a7f

SHA512
36396dc66cf3c4e2c5d1e6c7565532d37824fdddbc648994a820f229616300df93e5849ba0f27ec314a9c3404c6e976e5003401989181b2e3012950ad3b9ae03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000045

Filesize
104KB

MD5
7651b1187bb58ac4c7be625337b35e5b

SHA1
307d969ef4137a66fe2793737dc1c546587c7f43

SHA256
0632850d01a46bc2f8c223155a4bf6c398b33596bb711e098440623f118c3968

SHA512
a81d2f768af155bdc642941404e7ddf95a2cea33c9374acb5fe32f6f5266e337fbef32f904551f61fcc9f9ab5a1c6a5ad130ab85b38bc2258e2f82c0ca1e9c7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
97KB

MD5
4eed848ad9e187e0d02b10265719f5a4

SHA1
248571eac60a649199a5abcfcb64a8e3c1c6ba35

SHA256
c9040940f5b97d3ac642cb8306903a35ec8a3787e42dfa88cd9b2815c5fc6bfe

SHA512
2c94cb0b2ab7ea5d61d65ba48af267e84f0151ed545fd400e78cd389b19ad081a9d3819e3b20a0af7033b70fe5d6eccb4fc76763197ff7d6a529004dcacc80be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
19KB

MD5
d7daec500213df24ff2a38d2d6403d8f

SHA1
2dc66970fd5d1cad3e344776201f293e3d7fe444

SHA256
523a227acea51ba177acf0e2f49df005da5585a0c38bc9dde4474e3f0541818b

SHA512
a2bb73e418e5ed07e7e07744360aebe4775c957c0692aa75b0816a39db7b41c42b29703742ae6ae7e2209d808780d0689d1b56b4c58dbd1e25d9355ff2414d07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
17KB

MD5
67e30bbc30fa4e58ef6c33781b4e835c

SHA1
18125beb2b3f1a747f39ed999ff0edd5a52980ee

SHA256
1572e2beb45d2de9d63a7e7fe03c307d175b2b232bad2e763623dceb747729ba

SHA512
271d4a65d25b0a5d2ff2fe8f3925fc165d9b4345893abfd919061d78ffc5ffe8890ded35e41274ad8b860f06264b027cfea6030ec9411a4e03bc6d7cb4d4d228

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004b

Filesize
20KB

MD5
6dfdc7c4ed7923c26cfc14136f147868

SHA1
caecb8f2b2f2f6b71073c18d5dd71998d3a92150

SHA256
954144950b646a24955da48b080f5b5c17ae1ae22b429ba25c3f2fb5a7c86f51

SHA512
884dc3759ed1810fc4032b3f23b011f341bec170249738958cb90f4560880230a3a9aa44d6d8462940b70246873a339d4ee4ba50e87e46db60de26bda3a70006

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004d

Filesize
145KB

MD5
e2b4aa315d0be9074b6b45055eb378ce

SHA1
e2420eccdbbfb7915e04c890dd68b30a75676654

SHA256
86677fc218c5467c755187c08b7c77e0485022ef76c4fd0b257ac8fb9975e18e

SHA512
aec027aa61fbd4b2c013760de9ac3b76889ea7413b443bcac93786aafb4ac2d5eb5a6584238ea96a8496511cfd873a257fd0943f95a7dd8597f9eb83f96b834c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004e

Filesize
82KB

MD5
391fb86c656797654dfa644b4a9fa120

SHA1
58c97d4040fcb500564cc34b820b9421546f8565

SHA256
82f74299a0fb0f957513cf6325c322b7c24b1b4473f6e690998cd1b9954e19c9

SHA512
29fa42571ef3a18cf881658fed54e6a3e01278c78f1053bade886c096445c33f05c6537c84cea00e8e1fd32d47d0dc0c99a6455fbc22a31e6435bcf1839a8574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004f

Filesize
18KB

MD5
a3da8734316feacc06db664230b99c4f

SHA1
416c7ab962f617d90f9e25678348d8d7524d87c4

SHA256
6a190c64bdb8c477c46785071c38b93d09d00cafb802e47097fc9577ced0ef39

SHA512
dd6e1959d5e65b70ea0b278878d2a5dfaaa932a6e12783094bcb6e5a4b529cc021bacc0ab3c703b744e5386816130c20c9151f87dec66c568a8d21d32122cf88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

Filesize
76KB

MD5
0dfa248b05e152b0948a38c02031084e

SHA1
a24dd7dca7a847694f0b3a39e87665e743f5d284

SHA256
57c21e52c2e37c442b8b636aa80c518319b6a84f7c78ba20375858e1f9e265fe

SHA512
527c928053fe0c4c9bec8c13fc57830e2b26d0c0a0311ba6abf6df482f7c50cd272e9b86229245a691f685dbb39a578fad054ab965b15bcf417dfe563c1fd679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
131KB

MD5
24cb354c7687f73b265f0f2ac7500819

SHA1
64c6107f8110e35aa649959d86a6eb73cf444147

SHA256
098aef7530b8ffb60023bd8058bfb66cebc8cb8533816e04a508a640994e89db

SHA512
c75133c52451c26b20fe3ce1ea84b9a4ca863cd7383997dfdb1119992592a7423df9c0c9692a9a07186105920e011e9505c1354f5521c8f4e3c156bca900ac6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000052

Filesize
49KB

MD5
044bfd24babdad78a40046c760e9cedc

SHA1
69f93ac5a67fd7fc820a30f13aa321ede96e8b58

SHA256
8b781a16b05c15c907bb6e3bf3def11ff70ff5a56cadbc7afffe3b202aa0c70f

SHA512
ef718abd6c5163ebb401d61519fcb757275a492535851600c7bb9739367565d2f408fb25819eb61066daf1baead7e38db02e29ba5004e3e8ef119d07da39c31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000054

Filesize
82KB

MD5
c34b9f899852d5a694370fc346c0b6e0

SHA1
104f3e6b0017da88b36eaf3d6cd14ca409533861

SHA256
7ecb8920c1d81392c5324f68dae7b939d35a87fa496d402113d5c89ab6ce4431

SHA512
c8820439947332543954a91bdf47ea1f833533cddc453afd1db622c2859bf0c55a14b2aa133497a690a6f6be008411fc2693bdc34fdecfa2591e760b21aa03b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000055

Filesize
27KB

MD5
7820201f0db0c706a0ea5bb7ce018ef2

SHA1
6d116650afbb3b25bfd6226c7d5ee00dd1fe4515

SHA256
04f262a5cce0399379de17e5635f1e1acaf4371afe981edaaf792625a682c44a

SHA512
bfecb88d8852c413525e1e1bdb3eb69c97a10e4ff67ae3ca5eb97fff5a2ee369a1b80a0d314440a375d0f9e950e0e970a6de6afed09062d8523ca28ac878946f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000056

Filesize
37KB

MD5
bf2e360b4224644f108c87e1f6af3027

SHA1
5ddaf3d48e3710c0f3992e64fdfec007b2d753df

SHA256
38d8962bdd4554bd855229e2b4720a403c5cc459e670a814692d20c41ce530a9

SHA512
dff9bd6a62b81e151ff9ae0b37aadea57eb4de4e54acfb9214a5b197aa1c51cabfb766108977fd6054386c04b63373773bfc10356547853bb77794f6e01c6896

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000058

Filesize
85KB

MD5
23b7e32be301013445a1ff2b13fdca4b

SHA1
aad12fa764ecc01c02cf0d4dc76405271f3951bd

SHA256
7d7cb77a5f7edb9ecc4e79f8ec2a7f1145784e1e0a9d95b6d1c4859c20ad2b97

SHA512
a8ec3d0bbb3c7765709afd90029c682c99f15efd3060b517b316169a2f615387c40a4c29b1f3f38ac553d408abe05c0250e176f8b7350d8161c923ae62b5bfc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005a

Filesize
96KB

MD5
de68568e10835e074adbd28f06800a38

SHA1
566081d826da429fa1ad1745cf87ba77b8fe3482

SHA256
60fe12abb6a528a68f84fa0b305765890b00cdd82208c46e7deb5671b657eec1

SHA512
947018bb2862098891962f58f148e11328cc634c1162e8d7992af7827a4c21999ba98e1408726cffd4683a22d00eddac60254d8cfce6b2f0a63024eb60e2ad08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005b

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
24KB

MD5
c594a826934b9505d591d0f7a7df80b7

SHA1
c04b8637e686f71f3fc46a29a86346ba9b04ae18

SHA256
e664eef3d68ac6336a28be033165d4780e8a5ab28f0d90df1b148ef86babb610

SHA512
04a1dfdb8ee2f5fefa101d5e3ff36e87659fd774e96aa8c5941d3353ccc268a125822cf01533c74839e5f1c54725da9cc437d3d69b88e5bf3f99caccd4d75961

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

Filesize
63KB

MD5
1f63b30eb1f4d138e7bbe4cf01349aa4

SHA1
7c34b0c2fc6f949551b9fa58c99d035d6e6a6002

SHA256
36da78f31189b81a9edf717d77fbbe93faec80b01b7d14d43972cd3a3e71e1c3

SHA512
d5f91ec7fa94eb7f62f1721c058566e4eefb620777dd2d94ed908f8e2ef3b0437c44972fa193924363d0869854395f0e5de6bc694b33b7e5ab6f51b666e5b872

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000061

Filesize
19KB

MD5
9dbec782554ff613b549c2b667c67857

SHA1
d81fac1044c42656a7df3f46c43b33e3c9ae72c9

SHA256
8aa672a751be805b7accfa6c6be9281948137b970985057f1c8dc78ae264b1a0

SHA512
ba33a2f9bee5cb7d3f196563e58184bd0c4a52eb92e7b0afd359c4f1358bd2bb07845fd6ab28d41c4ae7c0d5e931afe95cb30f8a80daee4e97990aa9f609e193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000070

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000094

Filesize
28KB

MD5
f4017127d1ec466e5eaa9381fb542920

SHA1
431fec3f952f5e45c4ff64a992f7a5d91be34460

SHA256
21befff8e26723141b552ff1ab105e9a50d448527155100052d087377f22adbd

SHA512
a04a4c40f6fd422ae1cc3f63ef51c221cd5c08cd52352ccb4683abdf3a5e7654d028d227c7fa3736c3baac4d73377743a0fa03e63a5487d6ed8e64e44cde8c01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000095

Filesize
80KB

MD5
14e39be019da848a73da7658165674cb

SHA1
e016473c4189a8cc3dbff754a48b3e42d68af25a

SHA256
39595a1806156cfcadf3cc4e20c5c3f3eec721386a0551790a15f025ba9402bd

SHA512
828a383de549871aa80ec960a7e371ef47da96d01ebb9628d1484ceed9eb698aec5109b3de0b24ff8000610a2c2d633616c9fd28d380656fecbaa930cffed029

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8930627cc7a006e6_0

Filesize
32KB

MD5
9acbaf13877e813d35e1843d3e1f6834

SHA1
d9004e851412ab497d05b03f5b7c1f80345a5200

SHA256
0942c410ee211901505e191a94b34c49f3b29eaba1ab9bd6912d58574670a409

SHA512
7753960fd73a6c58cf86cf17cd6a556c64a72574d740b9f9cfa30ba52e756b876e3091d0a64dbdc333105648c50eec399a3b816ec484ec57295bd2b2a6cb492d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
7KB

MD5
96457f19878ef4680000efeda61e4b60

SHA1
d25472278e38164ab9e752d26236685a867e77a7

SHA256
4af185a841c6f7f1383c051a9c6da1446d5a8f8774e4d6e88a7e673d1f682912

SHA512
1a8edebc877990fdb488b75f72a9130b3a70e79683c1a60aa51213c51738d3a13c02da9dd06ff54ca6822ccfa882b900e400255596450a5485c2157984d26e84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
d3104cd9a9bc510691a736ff56c46c97

SHA1
55a8d04d38a32d8f5fffdf706d3cffcb9070b47e

SHA256
80de88d6d9518a40e71eef210e1c0d9f3a13047a66cbcfec5307ba60874e6b4f

SHA512
cba45d9a6228e41a42dcf263e94dc21a81790ba3dadf805a1aae86a1a45cf6e7c4d0fe55eeda9cec235d0814d418fdfbee461c3ab353a2c23cadd872822b0c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
ddfafa3b4070fbd9cf7247135a9b1125

SHA1
d9194558e508aae27246a614fb85b3d56496b3ca

SHA256
004eb1d4460a8fd79e5cf0da9a4c2798f504a9451cda1236ea00536e3d6020e3

SHA512
175be6341fbf58d529bd1f3e9dd5d823e383d242d05b25ca0146fac12e700910ec6843d536359b15fa7ad65b802cbe5905a52dc5db5ce2335d819ea8778a274b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
5a3c5e0891779f2da50d772fbfcdae71

SHA1
6bfedfc23d8519bbbc958d244e23fbceafd524f7

SHA256
63145f05a599c001e499c7695ceeefd969a604b015f45239706e7a3d215e50e1

SHA512
a272075a95cce7b97f581639bf9440dc30c155480e5eb5004478c24b72fffb02be0dc9c8429e5b1efa57d47253300af830ceeb3915f004e157c339248dffaddf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
e18c39b05a5a5fb94aa742531155f37b

SHA1
7049789baad4493c64f05e63b679e06f0b6b86d3

SHA256
60f7264ab9f5e95365201fdb23cd65a1b52e0bf7141dd11660ad962c0e7eb441

SHA512
1b1e7ed13387c673797ecbf9b1a07bbc78d0336675810048cb0307da20e6194fa871ab76286c8f4ef080be33015261830275d5b02b94b1f3225c51cfc6ca5b3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
9KB

MD5
06a2d7f5391054601a1047148dbe3d6e

SHA1
e968db2a72b85f58a7ea75e4a6ef1aa7e99a670b

SHA256
266b260697804b573be11cc1392d0b6242db93f435adbc34f81678126bcf7f46

SHA512
cba4ab4862089962d2c607037449c5ec59c7a8626a7b8910062783965c3aa2bf158fb2f2ce1eddc70051b0275c61a802e1fb34507fbeeefbd042af44aa2f8339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
3bad11d595fa197ca5e4f311c8018368

SHA1
74cc9045876ba2bfd1e246d00c4f0fce9a65ac5a

SHA256
e0dff81bd473747c0e5b8057e4fd7968685f6841bd7a7e1442d0e39fc19f6c22

SHA512
89e116b5172f9b8cfe466e0f715da97824e8c073dc3d2e84f861700d08dc0e55e392045f9d09cdbcd8b7978527627b31fbfd04493f7c4b4c36dcfe3e90831013

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5a73741f55bd2f64d492a425269ee09c

SHA1
f5f7a07071f2540e4c902e41493cf1a714b0aa16

SHA256
5e9d85e735908765c4b44a5cf275736047f8df359bad730e2bed6f8685b7664d

SHA512
5b98a73752cd2d8f2d3190799ab8480b22e1692034e155a8c6c9935976e68af626465d048003dec77b6a0e5081de3ba3b6a5be0dcd3852bac62d0ce3c9ba73ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
814B

MD5
012046a0830933087726961f1a6e9ca3

SHA1
097f2d9b947ec622a2b08d50dcb737bc9fd85f4a

SHA256
f3505fd030b81669909f9b230377ca68ef778cf3620536cb1899be9f71133c65

SHA512
8368a3a367f7864f17955fd9fbde6920187d58fb2bdede30074f55f07b2ac45c8d260588c66f9f3e162ed6db50b2df567a68dd04943762c138becef4d983892c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6703064944851fc56415e996645abe26

SHA1
2eb862fcedb254237e10960ff37cbfcfaf162b99

SHA256
d83059034012d7750dcbd9fcaac9fb265217c94fbca3ed899d8f4fa9f5855439

SHA512
93ecf515529694e5897663308a3dc4796f05e51a2be061a1bf6e73471bc63adf1ba1056e0dccca6b75021813487a38e68b6b9c949877022bd0f6003ead927fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df5cfaf8635fe10f425006293734f5de

SHA1
727d10c0124b2fbcbb4ba851fec6d6d89c690241

SHA256
b229df2f31ba8abb9dbbde2a2a8ad65776cc87d49813c4a835d49b9632ce8986

SHA512
8b7e905a2675d889ec03e9c66871ad448096928c9acc4d380535b712229ddc98b48e522ae17acc36a69974fba2644f7b08d6c20bda76369cf0fb023e2cb737a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
62adc0e99a865245fac383257f970076

SHA1
0b2a9228dd0150049106c5e64f8a134c16c443c7

SHA256
4f35d35a1312a46cfc1acff3ca62827974538b7fc901d6ed2be8ea255fb7ce6b

SHA512
9fe5608aa6891ebf87dfc468778c8f1e3a9880be822e6e4d91df17496ca731f5966cb2e7a9c9d38bb68661a1fe2e4644817d096e4540145ab5d56b0ac2b8309e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7db62409eb53bee93bdfd1bee1fd54b9

SHA1
84f2755298c6299c6905240dffb451ff2b2fcd8a

SHA256
2fe761b86583d5f1c4d6939fbbc5d56bf4376d6ddc975b290b207693e1fbff1b

SHA512
b2491d6300e0e6905fa30ab33bd43e083a1e1e963da1cf555bc27aa2c0d5001012b69e8cb14ed15cdeb0f7bd999064a209fed83f46dfb6c182f8cc6c44c92ed4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
378e65af7a52196dddd368ad0004d3e3

SHA1
54cdaee096c4d8816234a74b4b42dd7bbf6ba2d8

SHA256
33885d3d3445b63e603b04cec5eced80f1f756db809119cac66b0d30e44b7e64

SHA512
ec0b5b76cdad1f0fd6a0fdac0add701316d3762aa20c251864f5a1dbba9149c712327a158b28eaf57cc68016ffb8652af1d4eedb9b3e91c41cfce92a2675a122

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
cb715f9289d8942ee0da28333ba26db3

SHA1
6788f9e467dfb596b2549a8dbf343e19c2a6b9e5

SHA256
b29802e5a89c767c20feaf7d760cbb2f8e578deb2187afad0ed880b1ca2305aa

SHA512
237c2ebe5abe763796376766db6c5f5c31e5870389bd50fd4ea8927cd94d88a197552254342a4d57d713aab70f9f24171cd062edb67364b3135cb3898db0eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2c905af10169e3c1b420fa1816e0270c

SHA1
c569665c1aabe6ac3be4121dbb1771dd3d6a10d7

SHA256
b85f4b5e88611b860d56d70daef48782ae8fbc7fe9f1cb42c1d19c5b9672cf45

SHA512
7eea28017175c5b5b3d512c29bf73047097b39a4fd8b1be2459fe389a9817a3a07df342872f765469ddda2dd647b6c3c961b50dfcde74b908bd0700b0e46058a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e942812fbb244eb23f5d988c1cc26ae3

SHA1
5b2b379133a4a0eac4b890aae89b6391d2101a96

SHA256
2493d604ff05dac43b8ad7e30519bdca3ba9f759601797f067510002d4d826b6

SHA512
0601a4ab7e7e07e5cc431ed8ad8270ad3319f1565c23f395ce73910e22852873a889af2284a5a9a479e7da7420554a19a43ea4d852f75bca25a20e7215a65c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7a007d46358a0b41421988292a5b81e2

SHA1
7ef4b92d543390c81e23c728cb480bf74cb67f18

SHA256
1ffa6ffcafe11eeccfaf2eee733ead6f657eedb4cfda1a3c3167d1c5299306eb

SHA512
343f747e43b5cda4559f2dff98ed346cc62df50c4d959c3663003f7c5b4312907f7aa698f7f6e5f1ae8df036af774886fbeb62811fe3e591aa4a885fb4fc97a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9ea8384b6b43c5c48ce766e3460aae1b

SHA1
b84881ac5aebae6e45488a93a966db783ebb6307

SHA256
3829849c946863d73e5a76f36a9d34daa7ffa08c3cb8e90fe67e4775a7b93adc

SHA512
ce24943b9522176b82b26c47391148f2a3940b9221f447d9f1c8e70a098be64653418d9c3d9ac37fe339d58ed026307cafa1f0ffff2f26678c2ca16c27084705

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
94fe31092c280a0d883fa856fa2ee24a

SHA1
01cb598ac8326553ed9cad27beed7159c15d81a2

SHA256
0f777bc8c046c5f39fa5b5473e481ef70c266f73d8bff8e55f8d7373546bfd36

SHA512
efd76821fcda978921fb404d27d7a1d90fd9c39e55262eeffd3d5483250db04ce21b9f29379ff154aa34cc81b397587f99c390a3b57d3dff3d7a0f10270a29fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
206239efc4377c7fad2f5ffc746557dc

SHA1
e03f1f19271368843cfc8d93c9280baa0f7b6f20

SHA256
ca3bdac8fa96dbfdfde0b72281bf683d32689c7c7c8ac7a5c04970120ce7610b

SHA512
92a611772f2695f234001270b591d4e57767a793ac2f5aabdfa72cbe8b077bce68250eb1d8c9dffc5da005dccd726f7425dba6d45d556b70dccd06b70b66991a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
bf5ee69e0e36df62cfd5df2c62b62d2b

SHA1
13e6803ae76f3de67b00058f1e5c4305b7669b18

SHA256
069ea1e0ef3e98afd0f3a588751383c33370c84c327ebdbc031885cf30d89183

SHA512
039799ab70e9eb87d18d345a222cc0445fffb43520b4dbbd7c25424aef27a42136a9ca4193bb9b68edc11d7290012b8f3f8a888f14a7b8a8350a30300a3f473b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b1138451bca59d9c1b0470235fdeed59

SHA1
80a9c90be1f275d2f562ad533edcecaf29cf4ee4

SHA256
5f7ed1ca4a9b6728c4e518781a980d75cbedc2a0781d7644ea382f5abf82a0d9

SHA512
17dfdf09a9ac1ebd154423c9baf1373d98671d57b7b0584f75c1bf58dd718b09b7801ee06f31d77d9989ee1c674c382f0d19bc30f10f8374857fbba76fe0de11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
652fd906bf01e8adb83f9281608d208e

SHA1
7a2e2e57a9566c9a9cafe8dfa97907441db40f06

SHA256
8f75755c9945a8201ec5139e47401389d29765ebaf8b1b3095e7838670240cde

SHA512
e78c683d9a299c2d9b61e19006c02a3a6e6f76cca4acb05fcf98528a02bfe2dfe3da9368c6e609401fa5a7aac7e62cd982a11a11668b2d8bdff46fde9ab57468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
e151476b0c1f9f3d0ffda0c58de0b6e9

SHA1
401dbf666397b07fb5cdf8d29aa04fc0e22643e7

SHA256
387d773ee58b8e2c20d7c05ca9798fb87689efa7b15699308404b965b8d8a07e

SHA512
a65879a4191b9719aa274c767bfde7cbc94ec6230d0b9c90434d603c21fbc9a7fe0470440b570107b1c37607a389a27c936a6c0eb3f052ec36f9c3c8882ee2a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fbd24b43d75fc9ccc4dce28219fa849f

SHA1
9e011ce9a373ac93c9f37aeb6d45eb7a832d638e

SHA256
3e3e0258329e0841d4e4ad7bb1c828f5156b98bf8879c8feb2ae4ebefb9353d2

SHA512
b2e1b093d10b5a9e774cbcb73c727c1f3e526cb7b1f9f30c6e006b7f7e51a61aa93ed04a59d9bc5c7ce73b9129f2844f00893838b826344352200392518ef415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f6a42cf5d179db20c191007b140d2fac

SHA1
9a64d38f411c30256859cddd21d53c37ccf74c84

SHA256
5ddc213939b185c62ff9a705812318bf9f09446955b513609ea1c5c8fb228a85

SHA512
44901c7f7989014c3803daf03782d3efd562c1b15c0366e8c1264d43c598693ff435a3a534a7b999eb67ea47951fb369a048d7c8513a1cbeff15db6dbd5cb20b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ade6847d5e1fd34ca772d45bf7a80244

SHA1
39889366f1ae274ec1e4f8ae1b3edcd42f71647d

SHA256
eb76ffcc50ff8636728310d739b12e26502f101aef4cb868c044d51868c6bad4

SHA512
b11dafcb218e401a58b14998fb516e1f5ab02c45efd40308b778a1099d79b85e61715f70f69b7c285c06e6759f94cebd6385bf2a0269876884df8864c37a4624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
7580c948ba6ed8d1f16f3beb8e519fcd

SHA1
a024719d79392de9749a0621a010ed184407146a

SHA256
b2843d451d3544508b9ea47215571096f6626ae3d0ada1aadd07e31f25822598

SHA512
40bb17f40916ca0bd349e840c77ca4db7ca1f733cd0779b614258903f2e33ad71293d34f9c49504c3f81778dc966e6217832fac2d8c9e6ec932b727f4cec3326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
a875c4122cab450c196e070f2d39846a

SHA1
141310072848caf026822f76884c08ae9a940cd8

SHA256
255657f6008ebdd89c4e1f23ed8a628274ab54017eed02b7ef8b678ba4f2eb8e

SHA512
1e168621f9f5c59e6e839266802d590cc51b90ab153754968f2a2acb697063b19662059658f2b9cc4fb092b2d94858629348a39d94152ac54af87a1a27a809b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
358764f167f620c8e42f0ca8e17115f4

SHA1
6c59d14c7ba5152865b63d9e14d23c31ed43b81d

SHA256
93f73d4be280d07da240dbcf5671d050d721700b40381328638fa6048c64a74a

SHA512
bf9a3d862a7c07c4819c9bb5920fe161ab67b073f92546b13519656444e740a9409f1a57f680f6a3d54d7a800a71a7a31615056cbbc8f60d4bd847692890f993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a1fce.TMP

Filesize
204B

MD5
b97c905878561f79bd743eaacd847a0a

SHA1
70b529624ebe877283defba563774110fbb570e4

SHA256
492b5fbd42cbd76bc6aabbc02ad73b4ad42180488ad1e25bd9d1766251925428

SHA512
f209dd40ae51ef9a712391a2a7dd2b2f25ad1f1996566f3f04f306a6f8718445866732a0f422effdbba333f4e6efabd900a8e7ddb7c871e4a9951fdcba9c42fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
f915e01d108f6ccd1705e63be2ebd5f9

SHA1
4098f74968dac1db0186a04b5c79f4148439c862

SHA256
fddd953c04c590b26b38ebddb42aafa80d8ee2a203cb85455a74ab7ff3dbdc51

SHA512
dc16e5594c2d91c92cdf946131b71926dda6e9aa13786f09fe4522b989bc1225e213ba6f94da374504fbee503e9d4cdb0a87784a2881cc4ed01e87043bc60f37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
719ddf86ecd93a63e56c91cc89205763

SHA1
e35f311886841594cf02d9f0bb2ebeb0f0a252c1

SHA256
d461d383d78d36221fa7da6753be39e5bfcd729d7c718c415d97c2a0db77a7d9

SHA512
2eaffa13a9369c97c715cb5298e69c3150c817e6bc81976306b79bf3749260710ac3af8252916efb23af66378469275b03121b00ba45efdd39862dae68d32201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
58a8e64ff7522097fd04185b2b47fe1f

SHA1
0989e408f2ebe62e680743fd7bcbaed265603fab

SHA256
f6f06c215626a3a4368979764081a2c0e843744bc8a1d006dd2a608a6c484929

SHA512
de875caac413be5921aea328305f7cc25c26456e92192121c3103a25511e653e370adea46c48683d95a305b5f7307b7997a6da1a846f70216dc0475e5e7752f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
cc8d574fcc4eedb8d2247e00d239f98e

SHA1
5b6e20ce24719cbbea3b5446195ae5d0009ffcad

SHA256
32ab28f515b5f6161aadba23c47d51e248ab67f9699dfede31c411f3cf6d7ba1

SHA512
7a7f5f1bbe12a417acec8bcaec947c01d1c1e127efac9db66e609fee2651e65a91d0cf138d7786b5fefad127ac8e2ab6e1ddd6989435a417854ddf5e42e19dd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2cf9d3c9aa007271367150068a17d484

SHA1
cde60759fbbf76ae385837a9731515bbe062664d

SHA256
9082d9ae4e92b45caa2cfce37bf6034f993976ea6ad4b2ebc2e21f0cfa800f97

SHA512
b6113cc9514cf875127aa3529303754dd4bc6dff3b5cd798fce5ae421553e3ebfe6b33295c00acb4ef0dc45ab6e655a25efbef7f820c79dd2f267ab299091a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFIF474.tmp.html

Filesize
17KB

MD5
a4ce09d6b0d20ef94faf641bcab32516

SHA1
83e55f04f712ba28cd00656e412efeabfd4a3f49

SHA256
baf1afee9fe27135b488264b7a9ab1c569fa1f56b7ca851daba2b8871a4089cb

SHA512
ac7fc6225c4a02abd8e93ee6f44dd48bdd77ec49edca4414ad95956e05924ee278cfee67be1cf40defecb75fd90d5783a0683dee7259239132d78e7131f624a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\TMzpx\TMzpx.dll

Filesize
112KB

MD5
2f1a50031dcf5c87d92e8b2491fdcea6

SHA1
71e2aaa2d1bb7dbe32a00e1d01d744830ecce08f

SHA256
47578a37901c82f66e4dba47acd5c3cab6d09c9911d16f5ad0413275342147ed

SHA512
1c66dbe1320c1a84023bdf77686a2a7ab79a3e86ba5a4ea2cda9a37f8a916137d5cfec30b28ceae181355f6f279270465ef63ae90b7e8dcd4c1a8198a7fd36a8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 705242.crdownload

Filesize
3.4MB

MD5
46bdb27bef607370423917d822645f8b

SHA1
4e1cff98a74a279f72c63d14144b64174d54a8a1

SHA256
ad50bd4a42ecaaa7731c91abcbb9aa87303c97398ee1ad86b9c81ab74b021db5

SHA512
bcbd93fe3b300bd53541df409252a23421e96a5b606d24a1b560eb6a38932f0c84cd97a3ef4e26608a4b77ee9c828e13fc131cb6770793de25aca9d53914a4a0

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 821692.crdownload

Filesize
982KB

MD5
9e8253f0a993e53b4809dbd74b335227

SHA1
f6ba6f03c65c3996a258f58324a917463b2d6ff4

SHA256
e434828818f81e6e1f5955e84caec08662bd154a80b24a71a2eda530d8b2f66a

SHA512
404d67d59fcd767e65d86395b38d1a531465cee5bb3c5cf3d1205975ff76d27d477fe8cc3842b8134f17b61292d8e2ffba71134fe50a36afd60b189b027f5af0

Download Submit
C:\Users\Admin\Downloads\XWorm.V5.2\XWorm V5.2\Icons\icon (15).ico

Filesize
361KB

MD5
e3143e8c70427a56dac73a808cba0c79

SHA1
63556c7ad9e778d5bd9092f834b5cc751e419d16

SHA256
b2f57a23ecc789c1bbf6037ac0825bf98babc7bf0c5d438af5e2767a27a79188

SHA512
74e0f4b55625df86a87b9315e4007be8e05bbecca4346a6ea06ef5b1528acb5a8bb636ef3e599a3820dbddcf69563a0a22e2c1062c965544fd75ec96fd9803fc

Download Submit
C:\Users\Admin\Downloads\dotNetFx45_Full_setup.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
memory/6680-2474-0x000002345A6C0000-0x000002345A716000-memory.dmp

Filesize
344KB

Download
memory/6680-2475-0x0000023440450000-0x0000023440456000-memory.dmp

Filesize
24KB

Download
memory/6680-2492-0x000002345C7E0000-0x000002345D3CC000-memory.dmp

Filesize
11.9MB

Download
memory/6680-2493-0x000002345B100000-0x000002345B2F4000-memory.dmp

Filesize
2.0MB

Download
memory/6680-2473-0x000002345A530000-0x000002345A58E000-memory.dmp

Filesize
376KB

Download
memory/6680-2476-0x0000023440460000-0x0000023440466000-memory.dmp

Filesize
24KB

Download
memory/6680-2485-0x000002345B3A0000-0x000002345BFD8000-memory.dmp

Filesize
12.2MB

Download
memory/6680-2472-0x000002345A4C0000-0x000002345A4C6000-memory.dmp

Filesize
24KB

Download
memory/6680-2471-0x000002345A490000-0x000002345A4B8000-memory.dmp

Filesize
160KB

Download
memory/6680-2470-0x000002345A400000-0x000002345A442000-memory.dmp

Filesize
264KB

Download
memory/6680-2469-0x00000000008F0000-0x0000000000910000-memory.dmp

Filesize
128KB

Download
memory/6680-2480-0x000002345A4F0000-0x000002345A50A000-memory.dmp

Filesize
104KB

Download
memory/6680-2477-0x000002345A720000-0x000002345A75C000-memory.dmp

Filesize
240KB

Download