790d8d9f0163cf4bc1bfff37d3109a7387626327a561ace0cfeb6e9273aaab86

Analysis

max time kernel
299s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/08/2024, 01:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox.Account.Gen.v1.1.0.exe
Size

16.7MB
MD5

d08800a125f32eb3053ba77d75f9095b
SHA1

e456be4de88c109f40435a562c6f2ea3b42af0b5
SHA256

790d8d9f0163cf4bc1bfff37d3109a7387626327a561ace0cfeb6e9273aaab86
SHA512

165a2bd5783411664e27ad129118f939625bf70338ffb9b032f306c78b27e0d3f534ccc6bc63e1fe885ce2b483185aa279b451577b5a36871d4ab0ba8e7f873b
SSDEEP

393216:DDTk3+eBcGfdKT74mSy7BAcE1AT+F5s4PG/zz2mH0P5Aurc/m:DPa75Fq74mr7uJA85s4PCzzlHn

Score

8^/10

credential_access discovery stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 56 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
1804	msedge.exe
3652	msedge.exe
3268	msedge.exe
2700	msedge.exe
5032	msedge.exe
4332	msedge.exe
1804	msedge.exe
4732	msedge.exe
1212	msedge.exe
5108	msedge.exe
1420	msedge.exe
5064	msedge.exe
1436	msedge.exe
2940	msedge.exe
4200	msedge.exe
3080	msedge.exe
4692	msedge.exe
2948	msedge.exe
4980	msedge.exe
2892	msedge.exe
3092	msedge.exe
1228	msedge.exe
4420	msedge.exe
2624	msedge.exe
3032	msedge.exe
1436	msedge.exe
4688	msedge.exe
4680	msedge.exe
4812	msedge.exe
3840	msedge.exe
3396	msedge.exe
2528	msedge.exe
464	msedge.exe
2636	msedge.exe
500	msedge.exe
1700	msedge.exe
852	msedge.exe
2560	msedge.exe
2720	msedge.exe
3120	msedge.exe
2668	msedge.exe
1868	msedge.exe
220	msedge.exe
4848	msedge.exe
1860	msedge.exe
496	msedge.exe
3644	msedge.exe
5008	msedge.exe
5100	msedge.exe
3580	msedge.exe
488	msedge.exe
4532	msedge.exe
3424	msedge.exe
4204	msedge.exe
4620	msedge.exe
2696	msedge.exe

Executes dropped EXE 14 IoCs

pid	Process
4276	selenium-manager.exe
1792	msedgedriver.exe
4056	selenium-manager.exe
3032	msedgedriver.exe
2900	selenium-manager.exe
3176	msedgedriver.exe
3904	selenium-manager.exe
1852	msedgedriver.exe
1128	selenium-manager.exe
4544	msedgedriver.exe
3612	selenium-manager.exe
1952	msedgedriver.exe
1084	selenium-manager.exe
1744	msedgedriver.exe

Loads dropped DLL 15 IoCs

pid	Process
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe
3896	Roblox.Account.Gen.v1.1.0.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
24	raw.githubusercontent.com
22	raw.githubusercontent.com
23	raw.githubusercontent.com

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	selenium-manager.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 21 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4260	identity_helper.exe
4260	identity_helper.exe
1852	msedge.exe
1852	msedge.exe
2636	msedge.exe
2636	msedge.exe
5064	identity_helper.exe
5064	identity_helper.exe
2560	msedge.exe
2560	msedge.exe
2064	msedge.exe
2064	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe
1800	msedge.exe
1800	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
3156	identity_helper.exe
3156	identity_helper.exe
3176	msedge.exe
3176	msedge.exe
4812	msedge.exe
4812	msedge.exe
4940	identity_helper.exe
4940	identity_helper.exe
2720	msedge.exe
2720	msedge.exe
2300	msedge.exe
2300	msedge.exe
3908	identity_helper.exe
3908	identity_helper.exe
1516	msedge.exe
1516	msedge.exe
4420	msedge.exe
4420	msedge.exe
4396	identity_helper.exe
4396	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
4848	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2636	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
4812	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
2720	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2452	WMIC.exe
Token: SeSecurityPrivilege	2452	WMIC.exe
Token: SeTakeOwnershipPrivilege	2452	WMIC.exe
Token: SeLoadDriverPrivilege	2452	WMIC.exe
Token: SeSystemProfilePrivilege	2452	WMIC.exe
Token: SeSystemtimePrivilege	2452	WMIC.exe
Token: SeProfSingleProcessPrivilege	2452	WMIC.exe
Token: SeIncBasePriorityPrivilege	2452	WMIC.exe
Token: SeCreatePagefilePrivilege	2452	WMIC.exe
Token: SeBackupPrivilege	2452	WMIC.exe
Token: SeRestorePrivilege	2452	WMIC.exe
Token: SeShutdownPrivilege	2452	WMIC.exe
Token: SeDebugPrivilege	2452	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2452	WMIC.exe
Token: SeRemoteShutdownPrivilege	2452	WMIC.exe
Token: SeUndockPrivilege	2452	WMIC.exe
Token: SeManageVolumePrivilege	2452	WMIC.exe
Token: 33	2452	WMIC.exe
Token: 34	2452	WMIC.exe
Token: 35	2452	WMIC.exe
Token: 36	2452	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2452	WMIC.exe
Token: SeSecurityPrivilege	2452	WMIC.exe
Token: SeTakeOwnershipPrivilege	2452	WMIC.exe
Token: SeLoadDriverPrivilege	2452	WMIC.exe
Token: SeSystemProfilePrivilege	2452	WMIC.exe
Token: SeSystemtimePrivilege	2452	WMIC.exe
Token: SeProfSingleProcessPrivilege	2452	WMIC.exe
Token: SeIncBasePriorityPrivilege	2452	WMIC.exe
Token: SeCreatePagefilePrivilege	2452	WMIC.exe
Token: SeBackupPrivilege	2452	WMIC.exe
Token: SeRestorePrivilege	2452	WMIC.exe
Token: SeShutdownPrivilege	2452	WMIC.exe
Token: SeDebugPrivilege	2452	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2452	WMIC.exe
Token: SeRemoteShutdownPrivilege	2452	WMIC.exe
Token: SeUndockPrivilege	2452	WMIC.exe
Token: SeManageVolumePrivilege	2452	WMIC.exe
Token: 33	2452	WMIC.exe
Token: 34	2452	WMIC.exe
Token: 35	2452	WMIC.exe
Token: 36	2452	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3240	WMIC.exe
Token: SeSecurityPrivilege	3240	WMIC.exe
Token: SeTakeOwnershipPrivilege	3240	WMIC.exe
Token: SeLoadDriverPrivilege	3240	WMIC.exe
Token: SeSystemProfilePrivilege	3240	WMIC.exe
Token: SeSystemtimePrivilege	3240	WMIC.exe
Token: SeProfSingleProcessPrivilege	3240	WMIC.exe
Token: SeIncBasePriorityPrivilege	3240	WMIC.exe
Token: SeCreatePagefilePrivilege	3240	WMIC.exe
Token: SeBackupPrivilege	3240	WMIC.exe
Token: SeRestorePrivilege	3240	WMIC.exe
Token: SeShutdownPrivilege	3240	WMIC.exe
Token: SeDebugPrivilege	3240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3240	WMIC.exe
Token: SeRemoteShutdownPrivilege	3240	WMIC.exe
Token: SeUndockPrivilege	3240	WMIC.exe
Token: SeManageVolumePrivilege	3240	WMIC.exe
Token: 33	3240	WMIC.exe
Token: 34	3240	WMIC.exe
Token: 35	3240	WMIC.exe
Token: 36	3240	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3240	WMIC.exe

Suspicious use of FindShellTrayWindow 14 IoCs

pid	Process
4848	msedge.exe
4848	msedge.exe
2636	msedge.exe
2636	msedge.exe
2560	msedge.exe
2560	msedge.exe
4680	msedge.exe
4680	msedge.exe
4812	msedge.exe
4812	msedge.exe
2720	msedge.exe
2720	msedge.exe
4420	msedge.exe
4420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 3896	4248	Roblox.Account.Gen.v1.1.0.exe	86
PID 4248 wrote to memory of 3896	4248	Roblox.Account.Gen.v1.1.0.exe	86
PID 3896 wrote to memory of 4984	3896	Roblox.Account.Gen.v1.1.0.exe	93
PID 3896 wrote to memory of 4984	3896	Roblox.Account.Gen.v1.1.0.exe	93
PID 3896 wrote to memory of 2780	3896	Roblox.Account.Gen.v1.1.0.exe	94
PID 3896 wrote to memory of 2780	3896	Roblox.Account.Gen.v1.1.0.exe	94
PID 3896 wrote to memory of 4324	3896	Roblox.Account.Gen.v1.1.0.exe	95
PID 3896 wrote to memory of 4324	3896	Roblox.Account.Gen.v1.1.0.exe	95
PID 3896 wrote to memory of 4604	3896	Roblox.Account.Gen.v1.1.0.exe	96
PID 3896 wrote to memory of 4604	3896	Roblox.Account.Gen.v1.1.0.exe	96
PID 3896 wrote to memory of 4276	3896	Roblox.Account.Gen.v1.1.0.exe	97
PID 3896 wrote to memory of 4276	3896	Roblox.Account.Gen.v1.1.0.exe	97
PID 3896 wrote to memory of 4276	3896	Roblox.Account.Gen.v1.1.0.exe	97
PID 4276 wrote to memory of 2320	4276	selenium-manager.exe	99
PID 4276 wrote to memory of 2320	4276	selenium-manager.exe	99
PID 4276 wrote to memory of 2320	4276	selenium-manager.exe	99
PID 2320 wrote to memory of 2452	2320	cmd.exe	100
PID 2320 wrote to memory of 2452	2320	cmd.exe	100
PID 2320 wrote to memory of 2452	2320	cmd.exe	100
PID 4276 wrote to memory of 568	4276	selenium-manager.exe	102
PID 4276 wrote to memory of 568	4276	selenium-manager.exe	102
PID 4276 wrote to memory of 568	4276	selenium-manager.exe	102
PID 4276 wrote to memory of 3024	4276	selenium-manager.exe	103
PID 4276 wrote to memory of 3024	4276	selenium-manager.exe	103
PID 4276 wrote to memory of 3024	4276	selenium-manager.exe	103
PID 3024 wrote to memory of 3240	3024	cmd.exe	104
PID 3024 wrote to memory of 3240	3024	cmd.exe	104
PID 3024 wrote to memory of 3240	3024	cmd.exe	104
PID 3896 wrote to memory of 4732	3896	Roblox.Account.Gen.v1.1.0.exe	105
PID 3896 wrote to memory of 4732	3896	Roblox.Account.Gen.v1.1.0.exe	105
PID 3896 wrote to memory of 1792	3896	Roblox.Account.Gen.v1.1.0.exe	106
PID 3896 wrote to memory of 1792	3896	Roblox.Account.Gen.v1.1.0.exe	106
PID 1792 wrote to memory of 4848	1792	msedgedriver.exe	107
PID 1792 wrote to memory of 4848	1792	msedgedriver.exe	107
PID 4848 wrote to memory of 2576	4848	msedge.exe	108
PID 4848 wrote to memory of 2576	4848	msedge.exe	108
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109
PID 4848 wrote to memory of 1336	4848	msedge.exe	109

C:\Users\Admin\AppData\Local\Temp\Roblox.Account.Gen.v1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox.Account.Gen.v1.1.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Users\Admin\AppData\Local\Temp\Roblox.Account.Gen.v1.1.0.exe
  "C:\Users\Admin\AppData\Local\Temp\Roblox.Account.Gen.v1.1.0.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2780
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4324
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --language-binding python --output json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4276
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic os get osarchitecture"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2320
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get osarchitecture
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "msedgedriver --version"
      4⤵
      System Location Discovery: System Language Discovery
      PID:568
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:4732
- - C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
    C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=55875
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" data:,
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4848
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce3ee46f8,0x7ffce3ee4708,0x7ffce3ee4718
        5⤵
        
        PID:2576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2152 /prefetch:2
        5⤵
        
        PID:1336
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --enable-logging --log-level=0 --mojo-platform-channel-handle=2244 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --enable-logging --log-level=0 --mojo-platform-channel-handle=2676 /prefetch:8
        5⤵
        
        PID:2016
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --enable-logging --log-level=0 --mojo-platform-channel-handle=5868 /prefetch:8
        5⤵
        
        PID:5100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --enable-logging --log-level=0 --mojo-platform-channel-handle=5868 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3052 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,9478863390207161387,6496781004596567236,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:452
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --language-binding python --output json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4056
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic os get osarchitecture"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4980
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get osarchitecture
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3652
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "msedgedriver --version"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4812
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
      4⤵
      System Location Discovery: System Language Discovery
      PID:796
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3492
- - C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
    C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=55788
    3⤵
    - Executes dropped EXE
    PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" data:,
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce3ee46f8,0x7ffce3ee4708,0x7ffce3ee4718
        5⤵
        
        PID:2784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2208 /prefetch:2
        5⤵
        
        PID:4684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --enable-logging --log-level=0 --mojo-platform-channel-handle=2260 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --enable-logging --log-level=0 --mojo-platform-channel-handle=2816 /prefetch:8
        5⤵
        
        PID:2252
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2668
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4732
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --enable-logging --log-level=0 --mojo-platform-channel-handle=5744 /prefetch:8
        5⤵
        
        PID:4632
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --enable-logging --log-level=0 --mojo-platform-channel-handle=5744 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,611239043264459140,5285191924810328566,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1356
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1952
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --language-binding python --output json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic os get osarchitecture"
      4⤵
      System Location Discovery: System Language Discovery
      PID:496
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get osarchitecture
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "msedgedriver --version"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1396
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4632
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
- - C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
    C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=52379
    3⤵
    - Executes dropped EXE
    PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" data:,
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce3ee46f8,0x7ffce3ee4708,0x7ffce3ee4718
        5⤵
        
        PID:2320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2208 /prefetch:2
        5⤵
        
        PID:452
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --enable-logging --log-level=0 --mojo-platform-channel-handle=2272 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --enable-logging --log-level=0 --mojo-platform-channel-handle=2808 /prefetch:8
        5⤵
        
        PID:3392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:464
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:488
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4980
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --enable-logging --log-level=0 --mojo-platform-channel-handle=6048 /prefetch:8
        5⤵
        
        PID:5096
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --enable-logging --log-level=0 --mojo-platform-channel-handle=6048 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4500 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2892
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,13035803994446439771,7294048012579950315,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4192
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4852
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4332
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5052
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2072
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --language-binding python --output json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3904
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic os get osarchitecture"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3212
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get osarchitecture
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "msedgedriver --version"
      4⤵
      System Location Discovery: System Language Discovery
      PID:704
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1196
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1448
- - C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
    C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=59634
    3⤵
    - Executes dropped EXE
    PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" data:,
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce3ee46f8,0x7ffce3ee4708,0x7ffce3ee4718
        5⤵
        
        PID:4764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2056 /prefetch:2
        5⤵
        
        PID:2556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --enable-logging --log-level=0 --mojo-platform-channel-handle=2412 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --enable-logging --log-level=0 --mojo-platform-channel-handle=2780 /prefetch:8
        5⤵
        
        PID:1688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --enable-logging --log-level=0 --mojo-platform-channel-handle=4452 /prefetch:8
        5⤵
        
        PID:1172
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --enable-logging --log-level=0 --mojo-platform-channel-handle=4452 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3156
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1228
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2044,2195808246378747374,4024377824438059553,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1920
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1292
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1432
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3344
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4752
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --language-binding python --output json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic os get osarchitecture"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1952
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get osarchitecture
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:648
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "msedgedriver --version"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1448
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4980
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1172
- - C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
    C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=51197
    3⤵
    - Executes dropped EXE
    PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" data:,
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:4812
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ffce3ee46f8,0x7ffce3ee4708,0x7ffce3ee4718
        5⤵
        
        PID:448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2208 /prefetch:2
        5⤵
        
        PID:3424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --enable-logging --log-level=0 --mojo-platform-channel-handle=2276 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --enable-logging --log-level=0 --mojo-platform-channel-handle=2868 /prefetch:8
        5⤵
        
        PID:3592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4620
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --enable-logging --log-level=0 --mojo-platform-channel-handle=4292 /prefetch:8
        5⤵
        
        PID:3676
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --enable-logging --log-level=0 --mojo-platform-channel-handle=4292 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5064
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3268
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2192,742648277376409961,8610049881531750709,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:220
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4448
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:492
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3328
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --language-binding python --output json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3612
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic os get osarchitecture"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2228
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get osarchitecture
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "msedgedriver --version"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2040
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4080
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
- - C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
    C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=56179
    3⤵
    - Executes dropped EXE
    PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" data:,
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce3ee46f8,0x7ffce3ee4708,0x7ffce3ee4718
        5⤵
        
        PID:3052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2068 /prefetch:2
        5⤵
        
        PID:768
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --enable-logging --log-level=0 --mojo-platform-channel-handle=2352 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2300
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --enable-logging --log-level=0 --mojo-platform-channel-handle=2964 /prefetch:8
        5⤵
        
        PID:1256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --enable-logging --log-level=0 --mojo-platform-channel-handle=5684 /prefetch:8
        5⤵
        
        PID:4232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --enable-logging --log-level=0 --mojo-platform-channel-handle=5684 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3908
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2028,17937917180021704941,4109516739038867875,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5064
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe
    C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --language-binding python --output json
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1084
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic os get osarchitecture"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4396
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic os get osarchitecture
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "msedgedriver --version"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2252
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c "wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2012
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
- - C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
    C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=51449
    3⤵
    - Executes dropped EXE
    PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" data:,
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:4420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce3ee46f8,0x7ffce3ee4708,0x7ffce3ee4718
        5⤵
        
        PID:2476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2184 /prefetch:2
        5⤵
        
        PID:3116
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --enable-logging --log-level=0 --mojo-platform-channel-handle=2248 /prefetch:3
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1516
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --enable-logging --log-level=0 --mojo-platform-channel-handle=2848 /prefetch:8
        5⤵
        
        PID:5072
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:5100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4204
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --enable-logging --log-level=0 --mojo-platform-channel-handle=5620 /prefetch:8
        5⤵
        
        PID:1764
    - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --enable-logging --log-level=0 --mojo-platform-channel-handle=5620 /prefetch:8
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2696
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2948
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,8812612734833349332,576157851242740395,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:2940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4340
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2464
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI42482\VCRUNTIME140.dll

Filesize
106KB

MD5
49c96cecda5c6c660a107d378fdfc3d4

SHA1
00149b7a66723e3f0310f139489fe172f818ca8e

SHA256
69320f278d90efaaeb67e2a1b55e5b0543883125834c812c8d9c39676e0494fc

SHA512
e09e072f3095379b0c921d41d6e64f4f1cd78400594a2317cfb5e5dca03dedb5a8239ed89905c9e967d1acb376b0585a35addf6648422c7ddb472ce38b1ba60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_bz2.pyd

Filesize
82KB

MD5
4438affaaa0ca1df5b9b1cdaa0115ec1

SHA1
4eda79eaf3de614d5f744aa9eea5bfcf66e2d386

SHA256
ec91e2b4baca31b992d016b84b70f110ce2b1b2dfd54f5e5bef6270ed7d13b85

SHA512
6992107ac4d2108e477bc81af667b8b8e5439231e7e9f4b15ce4bce1aeea811bc0f1aaa438be3b0e38597760cb504367512809ee1937c4b538a86724ae543ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_decimal.pyd

Filesize
247KB

MD5
be315973aff9bdeb06629cd90e1a901f

SHA1
151f98d278e1f1308f2be1788c9f3b950ab88242

SHA256
0f9c6cc463611a9b2c692382fe1cdd7a52fea4733ffaf645d433f716f8bbd725

SHA512
8ea715438472e9c174dee5ece3c7d9752c31159e2d5796e5229b1df19f87316579352fc3649373db066dc537adf4869198b70b7d4d1d39ac647da2dd7cfc21e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_hashlib.pyd

Filesize
63KB

MD5
1524882af71247adecf5815a4e55366a

SHA1
e25014c793c53503bdff9af046140edda329d01b

SHA256
6f7742dfdd371c39048d775f37df3bc2d8d4316c9008e62347b337d64ebed327

SHA512
5b954bb7953f19aa6f7c65ad3f105b77d37077950fb1b50d9d8d337bdd4b95343bac2f4c9fe17a02d1738d1f87eeef73dbbf5cdddcb470588cbc5a63845b188a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_lzma.pyd

Filesize
155KB

MD5
737119a80303ef4eccaa998d500e7640

SHA1
328c67c6c4d297ac13da725bf24467d8b5e982e3

SHA256
7158c1290ac29169160b3ec94d9c8bcde4012d67a555f325d44b418c54e2cc28

SHA512
1c9920e0841a65b01a0b339c5f5254d1039ef9a16fe0c2484a7e2a9048727f2cc081817aa771b0c574fb8d1a5a49dc39798a3c5e5b5e64392e9c168e1827be7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_queue.pyd

Filesize
31KB

MD5
8bbed19359892f8c95c802c6ad7598e9

SHA1
773fca164965241f63170e7a1f3a8fa17f73ea18

SHA256
4e5b7c653c1b3dc3fd7519e4f39cc8a2fb2746e0ecdc4e433fe6029f5f4d9065

SHA512
22ea7667689a9f049fa34ddae6b858e1af3e646a379d2c5a4aef3e74a4ff1a4109418b363c9be960127f1c7e020aa393a47885bc45517c9e9aebe71ec7cb61a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_socket.pyd

Filesize
77KB

MD5
64a6c475f59e5c57b3f4dd935f429f09

SHA1
ca2e0719dc32f22163ae0e7b53b2caadb0b9d023

SHA256
d03fa645cde89b4b01f4a2577139fbb7e1392cb91dc26213b3b76419110d8e49

SHA512
cf9e03b7b34cc095fe05c465f9d794319aaa0428fe30ab4ddce14ba78e835edf228d11ec016fd31dfe9f09d84b6f73482fb8e0f574d1fd08943c1ec9e0584973

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_ssl.pyd

Filesize
172KB

MD5
a0b40f1f8fc6656c5637eacacf7021f6

SHA1
38813e25ffde1eee0b8154fa34af635186a243c1

SHA256
79d861f0670828dee06c2e3523e2f9a2a90d6c6996bde38201425aa4003119f1

SHA512
c18855d7c0069fff392d422e5b01fc518bbdf497eb3390c0b333ecac2497cd29abbdae4557e4f0c4e90321fba910fc3e4d235ce62b745fa34918f40fa667b713

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\_uuid.pyd

Filesize
24KB

MD5
4faa479423c54d5be2a103b46ecb4d04

SHA1
011f6cdbd3badaa5c969595985a9ad18547dd7ec

SHA256
c2ad3c1b4333bc388b6a22049c89008505c434b1b85bff0823b19ef0cf48065a

SHA512
92d35824c30667af606bba883bf6e275f2a8b5cbfea2e84a77e256d122b91b3ee7e84d9f4e2a4946e903a11293af9648a45e8cfbe247cbdc3bcdea92eb5349c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\base_library.zip

Filesize
1.4MB

MD5
1e65f6c9ed52ba79f93c0d0395cbd591

SHA1
0f30bd8baefe9876a7973aabd86b003c31ee869f

SHA256
b5fdda23550867243f1b8df3818b955255685660d61a15aab8f5de1a49735d9d

SHA512
51074c9d578ce0b03cd92338dae929d290c2bb5bd8893268bc7b9de6a7f8ada62d2dea999ee80ad3c8441736b01017b23d9bfc6cecc23488d87e4413143d62ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\certifi\cacert.pem

Filesize
275KB

MD5
78d9dd608305a97773574d1c0fb10b61

SHA1
9e177f31a3622ad71c3d403422c9a980e563fe32

SHA256
794d039ffdf277c047e26f2c7d58f81a5865d8a0eb7024a0fac1164fea4d27cf

SHA512
0c2d08747712ed227b4992f6f8f3cc21168627a79e81c6e860ee2b5f711af7f4387d3b71b390aa70a13661fc82806cc77af8ab1e8a8df82ad15e29e05fa911bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\charset_normalizer\md.cp311-win_amd64.pyd

Filesize
10KB

MD5
28af0ffb49cc20fe5af9fe8efa49d6f1

SHA1
2c17057c33382ddffea3ca589018cba04c4e49d7

SHA256
f1e26ef5d12c58d652b0b5437c355a14cd66606b2fbc00339497dd00243081e0

SHA512
9aa99e17f20a5dd485ae43ac85842bd5270ebab83a49e896975a8fa9f98ffc5f7585bef84ed46ba55f40a25e224f2640e85cebe5acb9087cf46d178ecc8029f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\charset_normalizer\md__mypyc.cp311-win_amd64.pyd

Filesize
110KB

MD5
6cdca2fde9df198da58955397033af98

SHA1
e457c97721504d25f43b549d57e4538a62623168

SHA256
a4a758eabd1b2b45f3c4699bdfebc98f196dc691c0a3d5407e17fffffafc5df7

SHA512
7b3c384ba9993d3192ed852191ff77bdcd3421cbc69ff636c6deb8fe7248e066573b68d80a8f280ae0c1cb015f79967d46d910455d932eaeac072c76d0757e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\libcrypto-3.dll

Filesize
4.9MB

MD5
7a6a8c2a8c379b111cdceb66b18d687d

SHA1
f3b8a4c731fa0145f224112f91f046fddf642794

SHA256
8e13b53ee25825b97f191d77b51ed03966f8b435773fa3fbc36f3eb668fc569b

SHA512
f2ef1702df861ef55ef397ad69985d62b675d348cab3862f6ca761f1ce3ee896f663a77d7b69b286be64e7c69be1215b03945781450b186fc02cfb1e4cb226b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\libssl-3.dll

Filesize
771KB

MD5
64acb046fe68d64ee475e19f67253a3c

SHA1
d9e66c9437ce6f775189d6fdbd171635193ec4cc

SHA256
b21309abd3dbbb1bf8fb6aa3c250fc85d7b0d9984bf4c942d1d4421502f31a10

SHA512
f8b583981df528cf4f1854b94eff6f51dd9d4be91e6fa6329a8c4435b705457c868ae40ee030fa54bebb646a37b547bc182c9cbf0df9a07fea03a18cf85c6766

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\pyexpat.pyd

Filesize
194KB

MD5
cdcf0e74a32ad7dfeda859a0ce4fcb20

SHA1
c72b42a59ba5d83e8d481c6f05b917871b415f25

SHA256
91fe5b1b2de2847946e5b3f060678971d8127dfd7d2d37603fdcd31bd5c71197

SHA512
c26fdf57299b2c6085f1166b49bd9608d2dd8bc804034ebb03fb2bba6337206b6018bf7f74c069493ffae42f2e9d6337f6f7df5306b80b63c8c3a386bce69ea6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\python311.dll

Filesize
5.5MB

MD5
58e01abc9c9b5c885635180ed104fe95

SHA1
1c2f7216b125539d63bd111a7aba615c69deb8ba

SHA256
de1b95d2e951fc048c84684bc7df4346138910544ee335b61fc8e65f360c3837

SHA512
cd32c77191309d99aeed47699501b357b35669123f0dd70ed97c3791a009d1855ab27162db24a4bd9e719b68ee3b0539ee6db88e71abb9a2d4d629f87bc2c081

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\select.pyd

Filesize
29KB

MD5
653bdccb7af2aa9ccf50cb050fd3be64

SHA1
afe0a85425ae911694c250ab4cb1f6c3d3f2cc69

SHA256
e24a3e7885df9a18c29ba058c49c3adcf59e4b58107847b98eca365b6d94f279

SHA512
07e841fda7a2295380bfa05db7a4699f18c6e639da91d8ee2d126d4f96e4cddaedbd490deb4d2a2e8e5877edfff877693f67a9dc487e29742943e062d7be6277

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\common\windows\selenium-manager.exe

Filesize
3.5MB

MD5
f3f45ff4bfa86c89cc5869bf673a9f82

SHA1
88be70a22c945dacaf2f2f37d706103e5eb56c8f

SHA256
6cc186fc7d11f3b70932f20cf701be791ad41a9b6a091452253b1774539e10d6

SHA512
76718a6c0a6ab96464e7b0dc83743a69ed985569d27dd9757a261497efdef57c292a6d37a8a290b5361af33f11de143f299687addd8813a0e08c8c430476365c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\remote\getAttribute.js

Filesize
5KB

MD5
e02d070d6419978d26f2d771541f79a4

SHA1
53efb9c65d5eb60850225313c5251a68bdef6476

SHA256
df3f5a60c6ae1c5b35760c0389f299406e14ec3b68ba6ae0511ce18cb7c20cff

SHA512
dd459bba00feece414f8bc7546927b5019f84c12cb58041ba85e22f7a8a9501723a0fd9b9d6c900469983e81d8ee84c6426a8906ac794c673fe2b6ecbf84a75f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\selenium\webdriver\remote\isDisplayed.js

Filesize
16KB

MD5
242b20671aadeb2edcf5c0394686cf40

SHA1
926ae986a71aeefe20dbf23d47437f5f9a6fb186

SHA256
c47a1d83321abd87bf054c80a4db4912108cf0af151958a1e563e57f9bd7fd56

SHA512
53aeda4b6bcf8616704c44619aa123dba3e5455817bd8d7145e0395a77ae204f33ee4832407e3fbb3fbd0be3c779d20173e941ebe9481774e9c5d503ead07776

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI42482\unicodedata.pyd

Filesize
1.1MB

MD5
1905b5d0f945499441e8cd58eb123d86

SHA1
117e584e6fcc0e8cfc8e24e3af527999f14bac30

SHA256
b1788b81fa160e5120451f9252c7745cdde98b8ce59bf273a3dd867bb034c532

SHA512
ed88cd7e3259239a0c8d42d95fa2447fc454a944c849fa97449ad88871236fefdafe21dbfa6e9b5d8a54ddf1d5281ec34d314cb93d47ce7b13912a69d284f522

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522\Crashpad\settings.dat

Filesize
152B

MD5
708a70c405764e1a33ee64025ab9f584

SHA1
ff215d92cd263edde2c5a0ef2fc91d7627fe0f73

SHA256
4627207068856859f215857ab3ddaad930637ee7309af09b7c4874dc94b9d19c

SHA512
01dc9230ca89851bb6e58afc4ef7d49e6994869aeabb706787bc4ce3689f5d0cb597337f0c480a52f0ad14e69250f6a82134fc7e98e9c1bdbab63ad4d6f09aa9

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522\Crashpad\settings.dat

Filesize
152B

MD5
c2437033f21353f4fd7576a6ed5ecd8f

SHA1
96e8b8d9ffe31940dcfc2f3276073ad303157107

SHA256
147620b5308838e6dfe61efba6061caef17f26a5458c7e92fbe7a47466eb4b99

SHA512
f6b0b48dabc2b25c1aed0ad88196e27833fa149caf815734e0f9ac192ab855ba79688c92dc4e76c12e0b645a0bebf55b9f40ddc9115249ed623704abd6a4d38b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
470a9f4b0443bde07113cf9e20855d27

SHA1
4e97665747a1c188362c8bef42257422159db2d8

SHA256
d41ecdd8fb080a8dc0172f77d1abd29787526d4286b65de00e1c200de18e12ac

SHA512
8e4b65286bec1e6d4c4e4de983d566273e1832cd058547b6ba419e806235d832b00c5e6de8556b910b5c89016f1bceb76b5b1389ed8ed2d74160f2b8b939a8e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522\Default\Preferences

Filesize
4KB

MD5
772e6b7e326566d1202fb73ee9ef402f

SHA1
c193d5ced548144eaa5c1de568c9642bb909e9d1

SHA256
6ad46c90e6e7543ccb4586ff220423209ad4d7453a0d42530994ffe58c3ce8cc

SHA512
8557755ef9be11040217d748c968178fa9afbf2cf3f7ff8640b58990529fd5ec1bf1ed021914944bc560ce2b08fb3e35def287de3eee73ff65a4a55b7c5b2fac

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522\Default\Preferences

Filesize
5KB

MD5
0c2bd25cb39b96fff0bc6567bf205961

SHA1
bab3ffa50bf14ec64c3705faae3cfca5e026a14f

SHA256
f865646f7b3fe5a335fd8694c68bcc502737527131a76263ab716ff219356af7

SHA512
4425bdb88ad1203198bc97405eb6e8469b4167b6bf5fcd3b33af77a12b4bcbff5840ec18bd3f43ffe73e7f9761983a243d226e420ce26789e6df25ed864ce5c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1744_1205211522\Local State

Filesize
3KB

MD5
41ed939dbfe0d9a2af5235e880a957fd

SHA1
6ecf4b18bdf8767f735650f66df8efc2ce81df70

SHA256
41a6927ee4f24c651fa43fc3ce686ac020a2b48d6ca744f1d684594dc8306c1e

SHA512
4d52ca2074f35041a21f65b1d6a48ac341ea9ec5d52dc79a0cc4b37496c4c0e33df66b8f734fe47cf5b2c7c2c70d5bd9f80696bba7c084f376cc4b70f63b3c9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Crashpad\settings.dat

Filesize
152B

MD5
2e8dc13c271d84bb5dfdfb6c72b4b7c2

SHA1
118f5660fbd65a2cf26d5559132b753c6ad877c7

SHA256
67bc64dac9bd73981cef7bec5854228167d9f07a9565777742ba6387a011df36

SHA512
759b3638a86ac497ae3f538d0962a5fb2753c613b594ba6c600db4efb0cb68da078d0c9e8c5668265f724aab9ef1cb652bc5286e5c028b4fc046fddaf3e82673

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Crashpad\settings.dat

Filesize
152B

MD5
bd2afba66d74113c3bdb9b42bc57095f

SHA1
5f20619f71d9ccf2f95f20edf9c077f6428c62e2

SHA256
bf6ef62040b3511e02d80c4aa0fb06e5d514af4af494c61a876da4a7608ce201

SHA512
a87a6dfe57c455a02e6a32c6b299b8c4f94f5ea4ef559baa0d917747fe73820217bf6ed1a66bfb21ba0aeb818bacd2b9916ee766399fb5e7e862d4cab28975d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Crashpad\settings.dat

Filesize
152B

MD5
27b491b03c31655cb52bae589423065c

SHA1
8489e0e0f97272e9d422a568c20f5ec15b49c43c

SHA256
6fc9258e8f611950694349dfcd309ef84c459043c4f05aed854c12dc5cddfadc

SHA512
3166ed7b4d9d7a95548eeb6a41acbcdda55bd46f6e3a7f58181d1360a655522e97be7f571b3d91ba296afa29740b6686b3448cb671c19276ddde23781d06cccb

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Crashpad\throttle_store.dat

Filesize
20B

MD5
9e4e94633b73f4a7680240a0ffd6cd2c

SHA1
e68e02453ce22736169a56fdb59043d33668368f

SHA256
41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

SHA512
193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Cache\data_0

Filesize
44KB

MD5
2e811eac5dc72799ea358ce614af5c5f

SHA1
d2863be4e95129e8252e8dd6f17235b880e7fc6d

SHA256
47cdb9d5c0d5d89c58b622a3310a63ae8ab8fc9b3c4aae1cb9b4452ac905d107

SHA512
7c9cbccb6a40ae8c4c46d62418b3da7c2366759d51fbbf51eef6d4f3cb2f7896be2dacacb67758a219e624ffde12e7f9ea0425a31e3b0f862fe11e5d22b90cef

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Cache\data_1

Filesize
264KB

MD5
435c2d03c154516180cfa75d99d0957e

SHA1
e5d5259e5c717b34b6f12a564bfd4954b138bd16

SHA256
f94f157007aa5f4027b6cdb08eeef466d49276fc802097e9a6ef24270602dc05

SHA512
559156867f9acfbc6392a8a9fa71dffa495b4f1db1df5b8c01d6af35bfd0568091ffef8dfa3dacb80af589a71a2c86a22392a732b18adb25ac3e9763ff03eeff

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Cache\data_2

Filesize
1.0MB

MD5
26d7e007a70dce2633dabaaef61dae94

SHA1
4d36910075355670e466c1735310b98f4f971d1f

SHA256
24554d3d844b384c7d2d9a46bbb9765623623a61fa1d770f7873315bc3ef07ff

SHA512
174cc783dcb2d994944f8fbe5ba64f13f25e99ea5f1b02503a31f7c1fec8786e4aabd5dfa725e67c77dfd93d066bbbe65e0f5fbe98b1845fe388b8b58a48abed

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Cache\data_3

Filesize
4.0MB

MD5
b90c7af2dc146762a8d1ed9c90247639

SHA1
f7062614941a402f72e5edc68bb4e8d4b095ecaf

SHA256
e37cb6d3d4845bc249979e4990f4a8b2750abfc67a5a62527f4f63b7cb056dec

SHA512
73b78be47165833720c2a86225a0fd60ddcb333d64ae56731099d31c844c0787b4ea9f3d6093d52286ad182e9beae430d4a38453fdaaf15b7b14e545be8f7ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Cache\f_000001

Filesize
23KB

MD5
e4b0d20f483b4c24ecffd4678479e3ae

SHA1
f0f3175f2c92922d123eac1e3a4c5bc8f6091b49

SHA256
ab25f94f51f31d69f3a7ff1959eafe9ddf3fad8e983fa216c91795bae573e13a

SHA512
54dda1d96956961788768dd0d5cb0ef9f660898b3b4fd1f6c02d5b092fe3629cb38f478e5e2fa5b074963616e63a235593a2de9e3fb420b502b40ded7430a715

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Cache\f_000002

Filesize
44KB

MD5
28d6deba0823880f8331bd4695469645

SHA1
a9fb38e13eddaed233b777f4db8efb4762c215a2

SHA256
2897ce935bf259f030e1c67dc25840da8793d4b58bc5fc8d5450525490d62590

SHA512
05261445ce6c11d1cf49716c0a2c6c2abbc930af4b7c817d36afa7819446f7e40f740a31b8e9734a5f68a0b140f2424db8779f27bae349a429002bdb30c79e7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Preferences

Filesize
4KB

MD5
8ee2ae6a26f7a516ad7c52e11ddb15fd

SHA1
aea6e80be250231e933527d1c0208904b5b7eb74

SHA256
21c49e1d59d092405250e9a62bed334ad0ad856c02b2a11bd59f82decd78644d

SHA512
d88eef7bdd54a89c4063d76f6c9cb98676ec03f9033cb2b40d6ba30f8e7f33879db05f8eafb1579524b0888683e4ceff27ef13d4dd788cfcb509d8c9d5afe353

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Preferences

Filesize
5KB

MD5
e961f2e1e5e60aeb5d37645f04200892

SHA1
d765cbc3b2f561f1f64b14f5b94b57455cac131d

SHA256
53cc548542be957be4434c63d9c50f2dae122048ff5a2350ea0b8e8c5bf38c7f

SHA512
22682b87ebb5ef6c4052be3a2a75547fc337066e4def472e52776dc1b34170d11d23c901cae31c400f5ea844f84b75cc6d07183c58b5e44f0675e3b135902b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Preferences

Filesize
713B

MD5
e048a8596409adadfe3ff10db8e5efbb

SHA1
332d79dfb5c30c125c8b030caaf0b007b1b1af31

SHA256
e19cd56e347efca1cadfc1fd6875ef82b35631e5cb7f9b54aa4bb9ea71ff66b0

SHA512
1758879d426dcd224c06dfc32ba2930f453e52bf8b9a85c3149cab82ba4c19a6637d6a27ce605e8925c17352ba7eb93223fb7d1441cbfec8252569a08cb11f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\Site Characteristics Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Default\shared_proto_db\metadata\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\DevToolsActivePort

Filesize
60B

MD5
dd58ab05ad292a64b7ced26b4adf6282

SHA1
fe870cca6051734e1a87a1e68bdd515580ab047e

SHA256
00e882192daf99c48d7b9c53b68baee484d48b81444bd2048c9537ab0a1afaab

SHA512
a77ff184003fa11eb00b8ea2d29449908d407e51815448594040681a442bf785506d44c9219bc1cb89d4b43b3e4395b648433c53fd3d0bf7b6c831941172dae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Local State

Filesize
78B

MD5
8b61e917846ffa930e0cb308c1f1a026

SHA1
3d9e507a7a41e36a1c25659ad72a448368134fad

SHA256
bfe95ecd1ff945712f2697925858b4a50834f6b96d90ab230b448317fc602aeb

SHA512
244ceef0649f72c7371c96667cc829bfbf6c853d173d89a3f206b3384ca95f48f5d5a4defec7897d84a876336942308a9d3357db3ff56cb80c6d9aa1ce5b5fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\Local State

Filesize
3KB

MD5
6b931b120a51918b1725f0c8c210d47f

SHA1
d9792fa13afe69c96b62830ccc87440ee6a3802d

SHA256
3c2a497f8e1275bf4ee52e91a48676441caee9c35864a1f410584ccf7fa8b859

SHA512
fb052c820214fd9a33437ba01f841d442be6f86f43bdb0f4babc90588cb3d81e49b2d9cf79e361941fd1818da8a1be44d147f7dafeed5c9c6c20d70fe18b2c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\chrome_debug.log

Filesize
284B

MD5
d29d2bc80c38b7b9338e7dec5ea39bf7

SHA1
4b09f5e74840fae7491769103ea69a175d114435

SHA256
c7e5cf562436fe857fc6e084b1957ff51fb7b0f8ebbe9d79fe14bae609f998f8

SHA512
4d06e632ad2504fd5d6f8122eba0fcfab1cf6e930db830cea1b56b40b2d61682a1ff49ab171f4a1057b6eb928d5101d86544599a704314f38853e75239dd405e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1792_1833789276\chrome_debug.log

Filesize
2KB

MD5
84efc3877c461321af829aa3c02dd9b8

SHA1
14ac066caed85be7910b7a746f5f028e816fedb5

SHA256
eaa924e6ea651e494777a109520cd73fd138cc35351c93686d8bbf85aa3cfc25

SHA512
fb14e3899bbbfa6a6e62c6e9319e95a03da50322bed647fd55a68347adb75cf7a5445c6cf69901110da0df31d5e623cf3f4f639159b8dc066eec7e4b6016039c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Crashpad\settings.dat

Filesize
152B

MD5
b1d426861e13a768ac860cb3b2c21202

SHA1
2f7a0cff75b672057ed3a0ebf3229aeced3f9f67

SHA256
5b50546d88236fa824c12153dd22efeb92e12cd7de9e723c89d586fb9a079658

SHA512
5c116d7ed3e2d4ace62b5035af2fc0afa2ff9ef3167f02f05a751dbb26cc61ec810c931fa314d64a0e4c3694020b096d35b01561a1a1bd600c3b88374926fd8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Crashpad\settings.dat

Filesize
152B

MD5
9b9f421de47d385616102cf36b5eabc8

SHA1
92d07de23b50f593dcccc316da73a04c9948005f

SHA256
fe7268afc63bb0f4603c6c426b4a2dda1b73061f177316d0e63344483fcd2dcc

SHA512
c44f3030b824e0bbd247e6b2fe4de362b0d4d94510ca5078ec01538bc51428c442b024b404270654334c52138f9cf6f90880f10832443904c989842974e5bc76

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
922ef12f335fff4f82062afeda7591d5

SHA1
5eec554021cf8b8f837879c9e1ac0d0ae36c78c2

SHA256
74f3f34701a03f7f9785c1f689efabe32094aeb5cb4e0d9f35613f00d7a44810

SHA512
c20f0193643ac137cd656cfd242494ce19b85c7dcf41dde4b8e14cff6c64118a693c61baba2f5fb9d648bb80a5d142828c99c79d45b15a4432c5b1b54b9d3d47

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2965ba75a2ed48bbb89e9910b02aba3c

SHA1
89f88ae6223bae37530ae917464f96d2fc8030ea

SHA256
55c8af9ba6fc8a103fb3df30d087ec26151ae175939c593bd00e86941d9c0ecf

SHA512
10cf6743854bd48188765c6e5a4e7f83fd6f6295452bde4a6e10c4d04c8d64989e8f8458a440d6874b220be6a7db110ece1a480e7b4715b68a10fbae51c35a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
7ef8ddebe7d3e748359f4d60042aab8c

SHA1
cef50aafe03f620016bcf50b1e441298a340272e

SHA256
46c279f4919912a52caec904f73f59713c9478c3e59a50370a143ae737e97e13

SHA512
f61ca64ec0858c03344901f51b5fd9d5ec46609ed3a6cc0d0ba2bf23b6b4be3fae614aa3f6d02e7644d3168f9bd0fa820acf0ab6c25a9ac3e12c4f97bad631fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Default\Preferences

Filesize
4KB

MD5
9bf3511e25c0f90b0af1dcb2ffc39e8a

SHA1
499059f0437d756e729f7f0a9a3ce506b0a1271a

SHA256
913eeda87be2a152f96745eb913d23ebf340005ad0ea93488c0aea34d8cd4c69

SHA512
8c91714c9a4907f4b2ee17366b6ef20d9e5c6040854a934203b75a508129fe4edf158f902c04eb4ceaf62a5a57b81336b930a3640ee25a2a55f102c3120c5a4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Default\Preferences

Filesize
5KB

MD5
6f7f6bc07bd76e9712b06ef48ebe127c

SHA1
68deec7329a49bd606bdf2caaf23a7a892187d6f

SHA256
62dab7f464307f2ee35f978aead0ef646a934733c7517f9025b0b03f7f67fdee

SHA512
628ab9664f402126bcf10a224672fe03884d033d5991644f32a8e5d70c4f7132deb9aea41b6d4b57f30f104a40aa1fa42dbfeb6d993be9a1a3263578ddff01f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Default\Preferences

Filesize
5KB

MD5
27d94880a61055009ba153ea5e6e260f

SHA1
d833d8cd85996387553032bfc2c511520016dc63

SHA256
3eb398861e342af61d00b6d872a1b01099e060c9145d9a06c6e3d511ae479541

SHA512
74e462895fbf2540a05a8d230a8f8158c32c2fad20723f1d2ec5d00eb9e883ac9251044809f5e9b8c2a7e58f849b56e586ee90db0952d0aff2ca86ea15591e8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Default\TransportSecurity

Filesize
1KB

MD5
a3e32933d0e6c6ad40a8ef0290dc7128

SHA1
75bee2f96d8c40c31972954846b7d36c2b7666f4

SHA256
91795a991fdb06014855b4eb62a3961df1cc1da6b0182064be819bf693dbed16

SHA512
e0b15d983d11b402071194e127ed99378fab77fe4665896df313b53203085633857774a02d2c46d9e19188422c3092cfa81c3c085230fa3f4c499a638418441c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Default\TransportSecurity~RFe5b0183.TMP

Filesize
1KB

MD5
5f7e93f67cd37d0daa752f515dfd884a

SHA1
2da1c67057cc711d224914cbc110e17144a7be3e

SHA256
80aec136202180b18d26b89fffc468a948b2975498e40a0f0608beafdbdd09cc

SHA512
3a93ce3a81f76bfb4cd9ccbf194e3792f13c90fed47027ee6e8a8c96accd2d434f4313a24fd857f6c96b9866ce47684971a9e3ed4994c214b8c690555a6ae4f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1852_1187280906\Local State

Filesize
3KB

MD5
641c85bd23eb9e63b7fa60d451f4f4ce

SHA1
809dfb79b89ce9d725e08f0b6521e82df468a0ba

SHA256
35c6e8729fa58dc16ec66fab2d24f00f5cb345a33e4d2962a10d8fbb4ec84652

SHA512
8f129de08fc114b508be6d5e605155b35e578600c5e654bb0f932756c24e1e46a181a6c951a41500cb2e7c81f2d9a893cf34fe241e352b6bc519bb92257fc4a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028\Crashpad\settings.dat

Filesize
152B

MD5
3595cab6d08ebf4bb350b6b06cf5ff00

SHA1
dd2f0fc434145f5d88f876892e85bb4ab1016d5f

SHA256
2b45d127645ec14720bf847a6a9a625a3b9a1a61cc71b33c2a2c65771f2a5b4c

SHA512
1e3fb4c6c28659800916dd6d3b140e546a785493a4ea8a6fe6d58736cfc8687b10c950e650854a66512fd5a119b6f3d01ed9af7cef84ed05b0380b0b1cd831fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028\Crashpad\settings.dat

Filesize
152B

MD5
8566a04b6ddb0bc3f52d47a577e0e5c2

SHA1
6b9fb85ea95a264471bfbe52bd57ec519127500d

SHA256
b61a48daf660bb068b673a3db24f3dd1ca625ae54ebf05b750c741f48f4e9bf1

SHA512
b2e039d73a0076d59ed9b4b875db4fc00c923b80ad35c67a0e63e2797e761ae207ff08f2ead173a493322ed34a257c8998edf2eccb557b3921a306f908269b43

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
818e69a41756f04293680362dc9ca286

SHA1
f20d90d0bd3b89dbadb2528ef2959f316c6f6c6a

SHA256
7299943a036c0d2d88d5bde50e938d7f4a117a8296780b273ae2d7db64ce17b1

SHA512
6f3770424e2e7d095ae854b2c9d8c8e01ffe3e1e929157a3ded1097ee99e2ecb327b1e5536dd8b91560e95017c2556583927751e4e1091aad90356711260d793

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028\Default\Preferences

Filesize
5KB

MD5
cecc6d26b4f71a97e9e28c8a696c24b7

SHA1
8e2f902999000792fcab6ea50557757a0648bc6d

SHA256
6283743dfb07ddf7b9ed2f155adeb4f4e755dc1c6fc950de76861f99a95842ac

SHA512
4d9cc2a3e5fa7ea73acaf19d464d8099abcd2e9541f50cb453071c327eec210806d1f845ae665d76cba4b80ffa73c9b69027b54d19ef83f01fc2b4b7b5bfccf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028\Default\Preferences

Filesize
4KB

MD5
f833eeb840cc1db767deb87ca90a5dd9

SHA1
16bc1f7aa8b08df4fcea951249bae6ee215e4818

SHA256
c5737d5d7e3f2793b5294678a2ad7a08e668467cf2c6d0380284b55962920935

SHA512
552781b1f17ea6968a4cbb47ab6c2f7cf37dd461eb54014989e1ffa81c890675527355aa60348adc02b484539b079020ee74626e5d1d31326e378552b3ca9246

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir1952_1169785028\Local State

Filesize
3KB

MD5
2ef1f3536a6a85b8e886e971554f7589

SHA1
20802322e654a8f0450742c668e492a23e03b5a6

SHA256
d0947a8b14e0ecc41c67b142d288e61ffc36f6ee4ff4eaaa26facb3fd959f6a9

SHA512
242e8fb5bcd4c806505e0098289541e83ca4759a22b33067d3c9d04c62750b430efee9ad61de8f6a5f088f286fbf6fa5257bc2befb251aaacc3be3ae83257f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Crashpad\settings.dat

Filesize
152B

MD5
96bc0c044e8b5f37e08b53bfb0af4c01

SHA1
7d73a969871327897546ab62d1a02967f69c4dc9

SHA256
e79a55f1566c7f210ffd14ab81b142073cf36e1e48af60654f70f7668b6587b4

SHA512
af6bdd375fbf6b5966dca365d7d89c0b50fdcd88b1f7f34632d8f057374d4f1a774047f9e97ceed1277e0014e77f26e8fe77b9979b1716feabf9e2ddad15ecbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Crashpad\settings.dat

Filesize
152B

MD5
e7bd663fd63c8ddfdfe5e816030872fb

SHA1
73bce7ab7394c344d8c5b87684dc326b0f3c0af4

SHA256
ca263d8bd93abc68185408a2bf134a1c125e4c7d0788f099c831e9d4e31eb11b

SHA512
3a6d21dc11048bbb2197f51bd7704371d604f68772deeab26a5d69122a3a8ff9febd071c8bae0d2ea0ad8bdf5cec7705693ef2105ad1ff24e24fcc0570ce6c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Default\GPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
588a8a02acc464ed23747302869baae3

SHA1
ebec5bfdcd5281bf8c65332c58929a598bf96458

SHA256
93027453cab11845db99b24bab57132fdde8cfa446faaf017767d4b585339f3f

SHA512
726e05f0c0916a0bc649de069f10150527ab5bfc37c911329605aff13585e71e504141261517f11bb5106761283771426d1597fbcfb137e12ca652c90c8d7920

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Default\Preferences

Filesize
4KB

MD5
e69992de2da92e1285526ac17c407062

SHA1
f3dd631a56e99d6b34a9f1cbfa4fd769acc21748

SHA256
1a440d49392129d1cb66d4917235c26c264811395da59ff1e41b546115973245

SHA512
96cd904c01fba9147e114c72d54854b0cbeeee0dc985f705d5ae808ceb8b6d7ef26d6f04cc5fceba4a7828f3ba2e1a3a38f5fceb1e4fcc55af969669836035ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Default\Preferences

Filesize
5KB

MD5
95e35318993381d4d58d8c635585c629

SHA1
a6cfcca5d0971aa3abbb1d9d6c918d5ada09ab43

SHA256
c33d627a47c6aa0db58221a0440c546c7f5df44847919491d3b37a35645dc795

SHA512
c4d0be8ea68e2a94b0cc785962fb263f2e20a797cbc7b21fa8a697602348b6fa0cdd0c366d9a557ef5fc8239dd3b7117f5e1b0c044e0fc206ed389a6834f4236

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Default\Preferences

Filesize
5KB

MD5
adfa4d7580cc7d362b214302bd084d4a

SHA1
dc9e80e679c913bcc14e62bee577b76335ef9e93

SHA256
17b90899d3c3fcafc92745c0d5a4094d72fe50cf91e5f168a1fd7ae6eb4783a6

SHA512
057349769d8184882a6740bb5fd5302516d0defcb72f98cc3b23f41f9d4af1c13b95fe5c0691bf7ebdb05b6896ca8366087e5c464519832da89c18bb6b1257f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Default\TransportSecurity

Filesize
1KB

MD5
50e89e42de7d4abfe0c655deeac4dc35

SHA1
60758f2608642825312109cb1fb414c6963f501c

SHA256
961f42a5ed9f8efc0b45c649a8c119934a35527403ad549addd79b92eade247a

SHA512
6a8a3f61adfa0e02f9da452f8e3ef2982957bf05632549d6923fd4169228caea6cab718485a27da24959ac4d18aa870ba401a2494e97ab6578324d3e96cf950e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Default\TransportSecurity~RFe5a2944.TMP

Filesize
1KB

MD5
f937f7e871b1187eedd24ebb223cbcd3

SHA1
48f6159cc45bf092438b1bb58e912c2eec4135bc

SHA256
c63790eed2c6bbc8fab766f9aebf7341f96b905c182aa8b0b565de216918ff23

SHA512
9c8d4d69c3613efcb6a8ffb93f0b95866261e82024bab7372ee3d516bfe66fa28f9a38c0d4f497ad4d00d928776c88c9c4a9ee343b83b4f516b053537d47234d

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\Local State

Filesize
3KB

MD5
ef405279322e02b5170b7eddd529d747

SHA1
f121ba0edfdb34b35992b8a545b1917678c8822e

SHA256
d6fd087b6c1ba3b387879432d7341663f021faf7c43110910a0012bbeab55491

SHA512
6bb69f7a73192ee11237521e134d0c9d4897ae9749bd91d018491fb4ab0438ae2fdb3bdcfd3270542c4cd88863290c72775c82fc19671aed97a10224c40d5b7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\ShaderCache\GPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\ShaderCache\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_226664909\ShaderCache\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Crashpad\settings.dat

Filesize
152B

MD5
0ad52a201731dc94a868747f07e89ed5

SHA1
854823e2e0d1990cd2864563c256af09dbfca7ce

SHA256
d1fdbaad1d9d45330e33b85956f75fa5c0865d4f08270939cbd7fbb693860a0b

SHA512
af98d8b14cdfe6c614721d57611741ddea20407294b6a63cbd697090c40af933ce2e3f5a564ca427ada9c0cf405db195911fa485267b7a13708c52cb3202a526

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Crashpad\settings.dat

Filesize
152B

MD5
2be03dbd8c902d940889191fed08821a

SHA1
81192d8d38b83efa1a811604eb3e1da8e5779bae

SHA256
123ee88d8a4f4e26f5f3f03b17c927aa0396f38839c19bd30be3f86186fbce01

SHA512
126f94162c7de9092ab33ae8a9097540ab7d9965cc062142f00b6eaea00b2c79059630290e9a9bb5886766efb68c5b98787af499dea3e82d97706d7ef97cb49c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\767b8a18-dd53-4a45-9a7f-e5fadaf2fa74.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000003

Filesize
43KB

MD5
70f6a1e1f287ec962c89fb8e4ed38bce

SHA1
65fc137952b567815f00e45e5c1bf7e1de661b72

SHA256
1b455a005fd6d5dc5d8239834e08a68437761ad748ae521df0504c7b2f134907

SHA512
bc21c6d2a568b410d1ebf9d3c7313c06dc7106d0dad4cb2dce050c6de6775fd0cd5183a71b8e3c6cd4dc7d1cf2fdef34e790bebef50b5419ac5ca6eb9abb4820

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000004

Filesize
100KB

MD5
fdf09c3c067041ffdefcc9e1bdea9718

SHA1
e31cf28187466b23af697eedc92c542589b6c148

SHA256
144754d90b3eaad27d8a11c86faadb24da4ddc251bead8e43b9ed515fafb84da

SHA512
9e32b294cfc17fd52fbdd62732571f4ee57dc0308d62af476331887d0e2446b483ceac06ba4617cfbb1c347d771c0f7ea12108bc384e93f69b180c7ca1a92268

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000005

Filesize
29KB

MD5
0184869286788eacac1ba69396519d49

SHA1
0c5f414d628c549f94ad3a74b0afcb60e5dbedd1

SHA256
f696dbf8cecfefca50ea3fa5cf29f5ba98c37e723bbcd5c6381269e08be54e0f

SHA512
b6bb6bec302cb11e978fb40be6ed3ad6ec18afbf3bc4e81aa5aa078c841bc323542b7a4c83037c7eeef8245c29e27d0143528f071d33acf5346ccef4fd5f38df

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000006

Filesize
29KB

MD5
b1727661978071f12ccb444a66ab7956

SHA1
7def5e98608cf93e806b06157fb87fe47deb66e5

SHA256
66dc49e6ee4b52575bad10c80b7f4a1678d2a776333308fee83e3c3df85cde6f

SHA512
e7f1edca8a75acf2b4773d930aea860f7989660e599e37a54edd50149696f10a2be4763dc26e957c6147812f6d056bf4bf519ab6ca09253a36e807c16433b493

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000007

Filesize
35KB

MD5
eb2e77369b43827422ede6ab0d16d973

SHA1
b29f6696e9a5b808cb04d4f90b0f2ab1b072fe45

SHA256
0341483f6e2422b1d5afc9fc646402889b88ca8821fc1ce41c3fc7d7ec21f41f

SHA512
f22a602864fdacef15a72a72c2ff20a3ae88b4b05960cc38f87303da41df2caff3c0376494c47d868c6240e59766073cc918cb431ad7092ec9378495cd047d6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000008

Filesize
65KB

MD5
355600a808b2313d9f4cd06d782dcc43

SHA1
b922717f483f40a7275eed1d0f87f823b01dc3cf

SHA256
1255a0be566b322de5650b0dfbf9380a4ba7accd817f9fe77eac25aabf965263

SHA512
2d9e247852fb23ad2620eddc7fcdead49b2b2a77bff6807ef463335591a12e44578197f192e83b75e96f923bf69e540f1d4a55e176acb4d8946d06088d33b91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000009

Filesize
20KB

MD5
efd99f6b50b61e6bc88ab81db271f5dc

SHA1
13a91d8c6aae48306779d950cd3da773bac54a04

SHA256
3eb3416904e2d4354a4760874b015d4b7ad0f4f231889eb2e80a7c2ba79c22b9

SHA512
3532987383c85b0cb80ada4314a3fd155cfb78d23470aa7ea43c40342d48982bb8b3824b65c05fe496662e433ce65598cc902cc9e51d6a32802709683221e160

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00000a

Filesize
30KB

MD5
6fd1421c547715cb7b78ca67104bfb78

SHA1
cc7f1d6761d9c7256745ef7586ad53e3183f0e2f

SHA256
57b9a684f743cf229723c1a5e9936d930cf48c3b5056c16c09cdd71ee6fe803d

SHA512
f64899cf62a1696adbf62f597f69c3a1ddd62319071f9a87076977b9f6c80992b333223a07cc1645a2fd578306e30abae12e18afc41cd582ee9717ebcb423a69

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00000b

Filesize
59KB

MD5
7fd069146ea79b16633bc8b45f90482a

SHA1
98dfafac54f6f5db51e3baea698208833ed1b642

SHA256
a746ba588555b584fe98e42ac1a2dfbb92c2831b54c263f51fe91d124b9214d7

SHA512
c31822f497ebb35a5da455e77965f16a83e2007215ae88e64bc21019d8d45fff4671ab4300d9cf518bd2b652d071cc582fdfb99b4807c75e2022755e6c60a06c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00000c

Filesize
23KB

MD5
33d5a74d320f6503a64f7e0ff61c49a3

SHA1
aca03ecbfc484e5ec52208a129b5cb4842cf6c4a

SHA256
d22eacb75f95fce81caa5637a1cfde05528b98d52337d82aa3e0f9309856cf4c

SHA512
b0d87c96080300f077f3406a940f89f07bd148b66ef1a1a28286cf4ee8b6bd3fa45f56fa0feaea1e49e9acf16427526db23fbdfe64361b4e55360c9fb69551ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00000d

Filesize
75KB

MD5
15a2f0d9497bdefec193f1951b076696

SHA1
b673c0729fa90d589261edd38bcaa74439297cdf

SHA256
aad6b6bb918d96aa219dcb54ff8a8a9587a9abbe51b4ee131fdb1a82f028745b

SHA512
36cb398ffe146e46e57ba37a2ac92d03476ac0b0368c64ce0102ac3b9d6a484d5e4200c136db9e04f25b327641299457b8f9d140aba6bef6a9fdc04313415e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00000e

Filesize
88KB

MD5
cf32003b2a71b7f09b15e9ad77a42d40

SHA1
dd13a04a430ae36e5947a503abf60c24f17d31a1

SHA256
9442cba9804cbfce11010881cda395e6df369f778358e50536bc183c926370d7

SHA512
6007af3fe5be0f250b877d18351510f82fe40458033c7342e26aa4ab8fa75f728881b2b872e1bf1a6aca7810151523bb53bf9609f87d414390b45c32c0e66542

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00000f

Filesize
81KB

MD5
875d53cf33befef3adef25147ad906c0

SHA1
aa0d686777ae5a887c22c6db9c88836f6a2cfeb9

SHA256
c01bb4c47ad0aba8f6d8d3cc3e89bc042e1606237fdde13d57dd62e94c585c1b

SHA512
f8d774aa9a7a631a125c575b08cb2f32a6cdcd21046464c33e60b7f464c27c87055bec18e194aedcbaec5d4694539ec87f6f911238546f4e5aaf81a8f89451de

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000010

Filesize
101KB

MD5
761338e7d858565d6976e2c442e65384

SHA1
c36363d7b6391c958778f27956a8f033e79675be

SHA256
8dfa8eaa5ffee5d0f297c5793bc907f1ecdd88980617064d15751b0191cf5d9b

SHA512
630332ca5f39c7edb2f829f5cd445ac27f157dd2efae8670fbbf0808665917ee599c197e8f1d071db3d54d7cfa1225603704c46c16a330b79a606a07e92bef77

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000011

Filesize
68KB

MD5
2f4c4483d3f4a087d5a26b0180688607

SHA1
6f616df9d2f7feb4d7ae7e623265318f5f44aabc

SHA256
d65eb75c2f3cb2b808687bb9667615029ba71a52d6261cc922a239a7df8a8d28

SHA512
25ee93d819b12b7e8c8649a115b40fe7c70afe0884c51868db9223458f13fcd22acd46406d7a023f950862b41593957d2a435e120db0e4b81d6baedcbdfa6bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000012

Filesize
30KB

MD5
f2f68467bb4ed1dab4d06e9c049aa992

SHA1
e1764a8621ee45d2f49e03ff8b1d3bbee0f1cf5b

SHA256
14a3e243f59b2efa3eab9cbb49437b8d7061788a45e2efebc9850e96975fe456

SHA512
98b3cc6772ec5b49b408a9aa9c6e32ca80e2ce8685bff9f5a6b57e8ee44116dc23c74bd69a36632e249218599c503f2da652445b1fab25bb7ba65a16c62f9b67

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000013

Filesize
16KB

MD5
18d460a7c11a59904399d1b54784f780

SHA1
d9580c4481818d5ebb2915c0d0beb2a36f1a0685

SHA256
5d7e8e13437a8feced33e51ed1feb8ebd20c000871bf046e14e1e4535b64643d

SHA512
e2c75c3d184b571721d9da3722ca11026188ed309214de38b393a6edaa990d6694acf6e1bf145ab1f90ec4715707e98e155e4fdcec86693d6449697a8baff538

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000014

Filesize
46KB

MD5
d408676bcc1853e7c91216b610145dbb

SHA1
96835f4d65a128ff94713896f35f2344dec5e5f1

SHA256
221b6c742d3b5030fe5919e5c1bc450b0d0611c38f4bb75a78223bb9e9dd5c56

SHA512
70614474d7de28366cb1b73485312ce3057bea421d8bc1ff7a8945e69a0ae01723a1c4166c9afa87db7db8fdb6fd7cf1e4200c3b81e0967c67371d48c719f75c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000015

Filesize
20KB

MD5
f550dad3dbfb045a5d3b91aaeca0b384

SHA1
ae0700d295166c471d2e3640134d7bcfb183bbcb

SHA256
a2d804e54d655a53053419498366fcc7e4a9e485fcc872795b22b31c6b889720

SHA512
1eeab46bbd2eaadd75ba18fa3d74f9ba0555082588e7dfca77425adf6716d9553b669250af5cb2948cd4d4a5a4453866834f018709941da5aa67214c0f6b8b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000016

Filesize
33KB

MD5
de261901336ef245e265c814802bf513

SHA1
d707a79676b8aaab346670209ee29ceb4fe6444d

SHA256
ae8f6aa139a0c67699799ccecbd82e25bd8bb88f1d7ca0b2cfb751bc29c6e2e6

SHA512
497ff630d2d0dce5dba8bcfd71a479156858e9c82137073b86be074bb72f771ee8e082be888cc2a8cb8149d9a9184aaff7d956646e60cede5c26311366cfb9af

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000017

Filesize
39KB

MD5
e1f6e032096b2924e561c3928b9dc73d

SHA1
f33a3bb1b04f04ed1b93b13d21b6b3ce529690ad

SHA256
fa802b853572d8a40ee939940d0cd9562ea8f5954c0522b0777e01fcb546c3c8

SHA512
b13f6e1f984d28c5f4cfc4ae2298b321c314892cab1e5ccd6f1f61ec98d8c1a39669078c88ba541c91648963abc6e16e0a1cdb4e9449b4be16927e9bad8d0f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000018

Filesize
42KB

MD5
cc7ad65e0558327d8fbe8ade40ab94e8

SHA1
6c153e9bf971f196db25cb2cb3b62f77f0a1299a

SHA256
956e1fd407995ff1ecca3bf42ca0d01086edc7eb6a965e1d9d4a48f197a8bd30

SHA512
0af63a7bb1151ef7564472b90ddd766857e3fd78973195817aa751d97093558688733876114ea7341063c7f1bc01f90aba1016980ce2c009a0cc399f40614377

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000019

Filesize
41KB

MD5
60df02cbc9b6a531c2d3cf32025a4dc8

SHA1
71ce31d6e0f59f98855a01b3eb9a37a86352189f

SHA256
2d73eefd868f115745117f76888a9b0124453918522046796a55c3621ad2c15d

SHA512
cfc2d4bc147bc757054c07a7e347091922d4ff9b7a0f856d0a3c278f5a98fac1a539d05ea5c375868b372f006a530d14558ac7027723f83f3b22087bd12992dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00001a

Filesize
40KB

MD5
f1cad4800853bba09a023250de102801

SHA1
76e1a6ae10ac4db2a3e4e8bf6b7edd692c4537f6

SHA256
e73ceb9052ea848498daacd8a9fff37846cce47324b38df12e9dcf0bf25d2e3b

SHA512
4e869ccea434e71f03ab513b3aa6212da3326cb9625c467b782df48367cbf5c69fb8a073d68180877cfde2510dbe74670046b897125b55f013fe595bb7d3595f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00001b

Filesize
51KB

MD5
0a7c0eb14fb4f288d5c61cba111e3dc3

SHA1
48f6448938e1b8df723a9f7c6490a78887f240c6

SHA256
8bef2cb55b40f46f7e2fadfe280e4c41b71a657081858a8224c6fb639d910e4e

SHA512
a63a2651e36b03846d5818a4e03f7582ce95a34d9b4d4be9a5ee152ce22c305a14fec2618aa3f904495bed4c94a3256951ba75dbb0fd0386b3f570096ad4226b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00001c

Filesize
435KB

MD5
782b7fc18a24ee997efd9a7f02fa4bf9

SHA1
db1f15bf56aa30ec79bb6a9d2632fe2a12de099b

SHA256
c45388c0937dde58151ba6f3d2225751b8b89ac001be1ef1f40134c61d391b8e

SHA512
c08790580afe4c89fd3e6cf9dbb4b26548b4a686b1e9bcc3a9dbc6fdcad49e84a0a5ec2ea7f3935308ac059af040af3879e29f3c0e2150d7687bd02fe5f4daf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00001d

Filesize
63KB

MD5
78413c0d5e05d6c36720ecc0c3013cbc

SHA1
4ea7f7a04d11a77a9aff562788ac57374607c329

SHA256
4238a86271d25bf5f8f4ae9e2e911200e54618164a67e1b624ee497563af74ee

SHA512
0835b56d178ca0b3fe555b43e3e265c2f847da9fbb6167b52385085a1bde981000153f65f2026d45352b783d155f3d3edce5ab9576b9333e1c31d8f7afa4bcde

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00001e

Filesize
19KB

MD5
1c0855f1be21f499eb7a4027e5dd1d86

SHA1
e6ed4d7fe3cd0a8ab318139e185bb3dd8230bbe1

SHA256
22e535eaaf874306552b8ec2683073504976ab14ecbc9939fca4ac53e60066c7

SHA512
e8307c98600bf5817163ee91895cae89bff946c2c151645969f469262d90385e5556f3b6da0c24dfdc4b64a07e84e0a9418b259afd821b142c6bd8f95546d685

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_00001f

Filesize
43KB

MD5
319095e8b40952b12b266eb47a2b2c40

SHA1
1ac8f74ec55f61066a241e5e4e7fb063ff0239e4

SHA256
a8de00bf5dc0b0f5c64627adcb24e8a39c938aad90a37e7108dc8bd2c773ab24

SHA512
20c72b91e7ff900a4ddcd93ff306b32778dbbf065bb67b3e4b4141a144612e4abc1f30936fa38362db484155a0fd9a87e5e5cb2ab0fbbba5823bbb40d397da1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000020

Filesize
40KB

MD5
31d4e713ead43eb25da2aea42b6e36e9

SHA1
f30ca6f9b4b5f3bbbf27bce20d88dc155f924057

SHA256
410f12a76d6da2005dedb821a310d072c07c988f736c20a4b3bfe7791c3530b6

SHA512
3700c090ba16c21f155c49e49399471cb019beb9a5f7bc7f0da9b5a975009d5499bccfd4da7887ecb8a123d7c3b1e0d1800b9412233e245e09aa7cd318629916

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000021

Filesize
132KB

MD5
0eb85925bd5a3e685d5cdfc482fad198

SHA1
c00b9cba0d988f4a66b71166f55f1924265e6425

SHA256
b8d6db24cd3d57746bfd5965eec1f25c4732f0db83104134832bf1618210f658

SHA512
633b18af25ff914c7eb346eae4b43f4cca3f41487b114ce47bf053c72aa4e598e7f59f4ac8614cdba07593cf43027cbe32142b5bf28c0e7abfe7c390afdfd6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Cache\f_000022

Filesize
54KB

MD5
820da0e97c5b725313877863020d4e3b

SHA1
6631e0515ce53d76048ed4ca7bb9386a57224bfd

SHA256
79896ac91c4d46d2095c365ae44e687516c867580a860b7b00568b04b6d34ebb

SHA512
b922ef4acf1197f0a001c7782ebb9b22cdb60cbe74b9486b3397f7ef9ce49036bc88d40bb3df89dc19ffda90f30473ec52f0cf2df792a6d130b577c6fa91d9cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Code Cache\wasm\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
bcf2d1a60567b4b9033b77b2aad64e98

SHA1
237d2bd71181619ec696f707dab499742ca96a52

SHA256
8846d2744aea40837b4fff98a47f730322f7a03e62a249d9002aa23e75aeb1e0

SHA512
94b17e33459c4b1d275e66bde4f48ed897a1fe4d358d476dad19b38358411e0e6168de1fb145a5857fb747fd2067ee2f5a51b2282c19092eadc18c4d641236d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Preferences

Filesize
4KB

MD5
19c43fbb5853b3d7ac326355d6d6e649

SHA1
e5001fa43de193597b23e5266492f0a5576446f1

SHA256
413ce5e4bdaa2f59e00a76c1fffe96aa8f6a5315dd4a1f81bf78a41939d4c402

SHA512
e91e560def0ed233023f78b542688ee84bbe501369c8b2db48829a0d10d2c9d0ea618c976f110ab46515b61f4cfb902d1ed29df9200128f1f3061cac93fea76e

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Preferences

Filesize
5KB

MD5
2b446faaa12b92026bf6339f4533a043

SHA1
2115ff89951109cccd0a42c3c2a23f76ba164cda

SHA256
696ed36e584a38eccd2f023e5e098a17b7b55714d36480f30b31ccd4ac0e6dd1

SHA512
33982879c09393cd00abb3a4cfa32ec2f3ace97573abb5b4cf98b7deb31d664acd17d22d0d86a3fcb679ac3c3f2f32d47a3b5a5823988ceb02d4c2ac10c7a828

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\Preferences

Filesize
5KB

MD5
fcdcd34ebdba4a795fd420fc559daf82

SHA1
2dc63fb4aaf284be35cd58f6b8a6e959434fa7fa

SHA256
3bc37b4809977ff81a40943e6e6ed8810428f543d6373bc83d9563e0051e3eb9

SHA512
74b27575dffb498fccde31387b1d88bff46ab5765a3f9849991cf77d91a972a62b057d94fb9f2f11e788189c6c80a42c172484026f14d5fa8a2c121da798f375

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\TransportSecurity

Filesize
1KB

MD5
4f12e6a8946612a10ae3656f9deef606

SHA1
a227f501f9c22173778841cc6ee981a550763ecf

SHA256
62ea4a05147cde77d0f9659c9efb031ae7a0cd9800e05a9988990a71325f691e

SHA512
ad514d9a32150e81b861314ea7d5fd83529e9fbe6177523b72c17068933cb358b8c4f286cd923dc81b8b29551ae0e85e7568999023af57086403675e145b2123

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\TransportSecurity~RFe5a93c5.TMP

Filesize
1KB

MD5
c061535fcc455e3d87bdb4513da79d08

SHA1
b91350772e2622be11097fbcee743baefd119c30

SHA256
22aa3dc2f10e191e5643005d22408bcf3ffd6f4abf96c4aba584427c819378f0

SHA512
fc585019c715bc1bc0048da51b52259ce4c79a607db76c927e7042272e198d44f774e4f6e41abc815430f102958e04d0482902f33ff643217b0eaab764ea344b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Default\fa87940b-a5b4-4464-b526-b258a4caf422.tmp

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\GrShaderCache\GPUCache\f_000001

Filesize
25KB

MD5
596c754665dc3ef9437ef542eb4b130a

SHA1
2fd7ba914e8df3314850a0f0085d5388e7d45811

SHA256
bc79b14f5edf047445a5ead84ac1c46d8bb2e8015fe8465f1ba90a8286375500

SHA512
d224eca48a06915370fd20858d6250df1f19a8990ec3bf2230fc5d72f1b5f356f609a4098fc5c22fcad8137734d4adfe9d69f0e91836fcfd6c1c4464559168eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\GrShaderCache\GPUCache\f_000002

Filesize
25KB

MD5
5bd00f5103ae7cfe8b3ffc53e19aba5a

SHA1
86a2c393f3fb55a45e8b352df59935e6dabd8408

SHA256
3ff9bca3baca0698e2ac5df01a5fd26d80ab2bf0e9c067f73ad934ebc0fd7d97

SHA512
c5ef76a734365feb32aa4fdf5bde4de5cb550ca1b71eb728ff2f587c2656918408169464546723287a2247d911785780b523cf9aa6c962e11c88e67fbfce4961

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\GrShaderCache\GPUCache\f_000003

Filesize
19KB

MD5
3ec20f00a772d639978e1d890b0ad168

SHA1
34dd2f0add1d59492e31da27417aa940899d9a67

SHA256
af24bf1e1b1c40e8288ea76a04f429e91030ee8c554fa2ccb0d143c8918a745c

SHA512
3e90f549962394cdb9cc840cf1864e6855c2cbe1d5ee5a1806f1836eb071fe8b6554a3dc5d0ca06ab52325f3b2584b92eeac0aac20a5b19a5dbe6d4f3dfa2353

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\GrShaderCache\GPUCache\f_000004

Filesize
16KB

MD5
bb8508b1f315e3da5f8663ded69b22dc

SHA1
d05efdc01769b64a3e578f9f0921e6e10a373f32

SHA256
3ff611197ce09fb9883a0bb0f809bcd7d469a05bf6a41e443f4dffdea47e9d5d

SHA512
ff84e49f689b60bdb58efde65fed19639ef8e00af5f37f46ef34b4848c2321221513780c75ada1aa353816d20616065c3d6226d4bff16ade59f17876d6c598bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\GrShaderCache\GPUCache\f_000005

Filesize
18KB

MD5
767402b2b0e1ab41cb828360a2403d9f

SHA1
7cc33a9b60b5587c5aa64b3601752b47c8a90bac

SHA256
8a68a417ec1dede58073167964e0a9baf8c24faf4bfe83d2bcfede4fcf4f223e

SHA512
afb4677edbc4cd621ae5aef1f07186ca1c63c8bf0471e58b8cb786a7a3bd02f1b789fd132ad7447d27d9bd49b585fd5e6ba56136e6b1cc1c97baf8609d7d092a

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3176_1756132269\Local State

Filesize
3KB

MD5
6b07ea401fd749b4c8e13845fcf77cc7

SHA1
aa7c1157bae1e08fa1cfe4f95ebc9e3d119cfad4

SHA256
dd2e8e0783d3c8b86f7897721c139f68a9f64e176e4cfb4b37abb6b6927fb819

SHA512
3b1dcb4304decb0c796c67b42312f7568dbed0faa312846292663c9d8cf951efb06f179b04f1e5504b6a6dad8fba10d4cc6547a16ed06038902ec9e83e7cf196

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Crashpad\settings.dat

Filesize
152B

MD5
357fb43dc3e776d64ff6388a97263ffc

SHA1
c26ecefecad062707e3aecc76aa46ee22f53bdf2

SHA256
25c9607a6679d0b0c0b418bdb1efae53b7194da16cb3b74fd641e36b8a8065c8

SHA512
1f97dd595feaff2466df3d3436df1b55bbaae7577fd3dc734eaa4dfb2a3738a90f4a52507e577f85c8f80a2011bf004866429ecdac4f0af938bbe0612bb9a320

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Crashpad\settings.dat

Filesize
152B

MD5
4107cc231d1a94f30115f2dc1269d2d5

SHA1
6b80f2b912855e413031ebf0399cda1b9a045c57

SHA256
d20bf889aaaedf9b4dce4fdb83aea3d4d0925e6323d5701bee644de75413b64e

SHA512
7b63f81c1bfd397f0a5fcb9433aed8f03723537efe47043a051a263593b8c3352a71812227e883ecf73e4e9da420f896368bd81671d068d261cf5210f9e2ae50

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
5985d883678567b1d6b28e0fe7cc51e6

SHA1
184900795297dedbc0159e136e616a23c17e474d

SHA256
496086906edc9d9e71283144304fe3f5aef9b2ebad262c2790f8a3789b15537f

SHA512
e024dde1a9ee2d403195542703b1f06e4a1b4b205d98232bc9cf342a1b7e9236133e64ab772de6a87af8b36ecc3861115c5ea49ab3cb0ee4f6ff7c603e9a2f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
7d184b6c165ed5b8902a8d513f229450

SHA1
39497c536f397f35f2a02ee81bf4ebf603a4f118

SHA256
e920c34b7d534b233cc6e94530d0b20255d95f2fc226016efe28fc1365a28b79

SHA512
8a480f1fd48e11aee1953cc9a2c1624cc543157fc637ce39b13d454e96ad6a3b90cf0bbbd573c7d75138f0a16f2404cca23bc57f4448049a2a41f4302720cde5

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\History

Filesize
124KB

MD5
9618e15b04a4ddb39ed6c496575f6f95

SHA1
1c28f8750e5555776b3c80b187c5d15a443a7412

SHA256
a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab

SHA512
f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\Microsoft Edge.lnk

Filesize
1KB

MD5
52d24a906f0a03941a6e9ae911713ed3

SHA1
d57cd9d3674a986a5d4810394cf2668c5c8e6109

SHA256
aa89636c004676f4de36b7d2e86e785b96e43679eaf24ea21fb267b1334fc7bf

SHA512
48ce99792808701132370a76a69b4b8ed11d1f657c1b82026c73bd4a0e4ecd336e18c002baf99994b41f6e601c51fa889a0e9d24e755e31482f726ef5cf154b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\Network Action Predictor

Filesize
4KB

MD5
09b447ccdffb4c0ddd124855552713dc

SHA1
6bc4b8672841827d6dac1610987ee25e85b0e436

SHA256
92d575e72b2f0e6916233fa92efc9f4fd63344eb259b572f3530e47c0eb1fd95

SHA512
2b4476ecf7e8be5436d0daf417e0f75f4971750bd686ed5b2e4c84ea51ef59869927da8c214e82a3e0e4c0760ab530e647a43a329ab4667916a7f6d1a9f4fbf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\Preferences

Filesize
5KB

MD5
065bae8858082acb8bb8cb552170a846

SHA1
fecae71ab6bb5cfe1e2c2e933b011c08b9d8cbdf

SHA256
c712d006754b8bdc9db202aa909c4566fa5d874a1d0cdcc52eb97b34e884a6e9

SHA512
6cb88f980b173ccbef29b6c6f54e587b0032c992cfad637d98e2b427338127a795bd8fd8514d9a8b764933d798a21cd55a8c511d18b5b7a40478927ada45d00f

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\Preferences

Filesize
4KB

MD5
b24276f651aa426b5246b93252d59a17

SHA1
bd3c78e8bcd68b5d418589e866e94d00ceea7ca9

SHA256
9f4940f80a9e3dcd6bf74a7eb1ea7eb29757f9893659b615d0e7c7261f0acaa1

SHA512
883ea6322d156dca5e15756238530622c4b9526ee15b50d844db5b9b53d339199d2eb4c126931b124439263c736b81d1e7199397bb031eb03b7936f5695551ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\Preferences

Filesize
5KB

MD5
dede5b00477b334c593d8a9db5c6fdef

SHA1
42435f5097cbac27d50be4ae7cc77f248b2414ba

SHA256
9cb695d73fbfa61b384801259ea18a357900ff9dffd26d08c8480bb9cf97fe47

SHA512
adfa790856d724e9bba4114f3c1e694f879b675956460ce36b062c5fd0ba0720a38e9b8a08fd4c03a83d25f75455ca603de4803e7c1397dac322b422c448b6e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\PreferredApps

Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\TransportSecurity

Filesize
1KB

MD5
eaac08676246e21d34293345c4bd4fcb

SHA1
5f82a0b94972c091e5f9ddaa2789c4391aebf50f

SHA256
39decf541389b056b799e178591e0f942aa100466a39d1662a0b277dd62a5ce5

SHA512
1455be96f11aa6b4cda4450b7cee424cb32ca3b8ef444277026d0d0b07b6beeb7b50dd9a2e79031bc0dc125e3fd6a606352af4e785e13706f4c3047b8d2418a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\TransportSecurity~RFe5b76c3.TMP

Filesize
1KB

MD5
45785d16f6763eb4f2aa2c86e7cfab6f

SHA1
79da247327f01d4e3a567e8357002cf993a52246

SHA256
bf92d0d830778faa0e38e14ff69cebd2c1a6f4477c56d5e9531b7f6fb63eb111

SHA512
4872b66edfcdd92bb7a7aec8dd76e3a7565f5e95fb1a0c9d30a85b178af691ff56a6905df3d7bbfa06ca53e27360142124635a49662bdeffbfd9199099c8f93b

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Default\load_statistics.db

Filesize
4KB

MD5
d9f84c8cf73422f2ca07d7e7462b9534

SHA1
cff6e092bf5bf1f3f47b7074847e204042a881ae

SHA256
5bf7b14dde109f722782628bbcf3011a23cd2416e7621a62b49ee0333cdec6c2

SHA512
1ea893c62d64304c35b9086e2c7e760716ea5ce220bafb76632670fcd2f97eca5c6693ff98004a861b190060c47c9d97ac92b41e3b1da1a4e8f89d9638548c38

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4544_419938400\Local State

Filesize
3KB

MD5
e3eceb057a95d552ff3cda1d85434b43

SHA1
3a7e3937b908cec2513e9b10ba3c6886a256155a

SHA256
1635b4d5219ba12e0e77d4080ba6c0169581080b9030e553b23be89969856f76

SHA512
1c088e3d9c5ff42f98e1d2fbe9c7c0d172541f055fb109b7263fc471b0ec16fed9f9bf394c89b0f29fba4de344943b072403c5ad3768a8315dd2bfc1a4c04c14

Download Submit
C:\Users\Admin\AppData\Local\Temp\selenium-managerJHqztj\msedgedriver.exe

Filesize
12.2MB

MD5
3c87947ada98200bcad42fb66edc22fa

SHA1
c36e9d8155d5f65e3c03141a5548c1cac07f1f05

SHA256
14db8a90fa498dee0a073504e8c4494269369687e8ed5aec7f09b066ca126531

SHA512
21f1821afdb27006f0846d9b35da38589dedfd66dab831f055f72d64b9134a9cadf92fe80439273f3755031676fe4b615c89815496d1d9e2d3181b3a98aceb6a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

Filesize
1KB

MD5
6b80253c708199c772df475a63c22fd5

SHA1
3ea880ea4764870bfc885ca257ea5785b6908dac

SHA256
d01d206aaf55b225f2e4fd3b1ae3c82ced1425113d8d9c3d68cf6355454a63dc

SHA512
7a210e30b770c2d1f5cad07b7b32610b2b7badc81089a9c6b7993e592bd989c99779586a0c3c30a6124f034541654514c444a519dd92fd74577bbcefade1f214

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

Filesize
1KB

MD5
9129bd88cedbc6d110c74257fc182095

SHA1
d861347e3de53f7b615413730bc092d7b3432592

SHA256
4b8679c52419d756735b808698dd657d523ce81d4a5f40dfb0446b858ea2fc88

SHA512
b1afcf907a55a43e1b4918b53ea84c460d9287b5c759a437c757aec02ad73c0235135671523f580dd4dc9e9bee08d38ce973399dcf03187b00c68f2e9a6e7559

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

Filesize
1KB

MD5
65050ca779a9265195235811fe691be7

SHA1
344ffd0d6b686893e4a0deaeb1285caec907ac46

SHA256
14f38c5c563481904cc0bdb292f26b56d93d624a816166e1ea09a64845722295

SHA512
386d1c5b98ce20a1a57a1ce9899d03acf580267df5055b228b3e4411f04613876723babda25ced8d99e36e69061ef2fd8413af631e7b53138fe34cc2bdf07990

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

Filesize
1KB

MD5
5fd2523e9ee7ba77afee1e923d07d9bd

SHA1
30f95cede3c3adbba3b8beedef249ac9d109df5c

SHA256
ed62f0395d1cd393c98111ea0ce0594c0ec0e03467d2cc49770f793fff374372

SHA512
9bcb6ef5a3280a5a74970b1efe86313c1f5cf5f5ddecc588ae770f6186f7fd9a8b0fcc45e1a8226d51dc975111bd41e8f4dae25f511b81baa1e5aa1651c5f6d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

Filesize
1KB

MD5
c00b49dfb3d151550773493aec49a996

SHA1
fd63dd77d28e583aab95e8c8c8d0806cd52d78c1

SHA256
1d6abbf8af751f04c030eef9f3130a316989cd142aa24d80b6f271e36774d90b

SHA512
26ab01cc5006c5e689808ac9dfdbf7a567ef9a882658232231f0699e83be6bdfd93a94b868eec9d3663c8405aa23babd461eefa6afec7dc2bf9c454b46b47eb6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge (2).lnk

Filesize
1KB

MD5
bc7b09bb39985426b018ffae10c43f82

SHA1
40ee9007f28cb50ede1ebe7634ad0902be7dfbec

SHA256
1a2916f66ebbf84da48398b69c142fc82d92537653f02c178286486cd25def3a

SHA512
44c3d6d3895f33c1b56e5ce3e5223f18878cee137eb3a5e239e77ef109a3ae7a77fd8daf865a1ca744719f530d4dba862615475fac459e4a876bd19742596c2a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit