hxxps://drive[.]google[.]com/file/d/18YC3N9BLx9Dr7gS2E-nYbWih6B9a8kGc/view?usp=drivesdk

Resubmissions

06-09-2024 15:32

240906-syylwsvbmd 7

06-09-2024 15:29

240906-sxbqqstepk 7

Analysis

max time kernel
452s
max time network
454s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/file/d/18YC3N9BLx9Dr7gS2E-nYbWih6B9a8kGc/view?usp=drivesdk

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 19 IoCs

pid	Process
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe
5408	Loader.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 11 IoCs

Web Service

T1102

flow	ioc
100	raw.githubusercontent.com
102	raw.githubusercontent.com
110	raw.githubusercontent.com
111	raw.githubusercontent.com
112	raw.githubusercontent.com
128	discord.com
129	discord.com
5	drive.google.com
428	raw.githubusercontent.com
101	raw.githubusercontent.com
2	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
1204	msedge.exe
1204	msedge.exe
4936	identity_helper.exe
4936	identity_helper.exe
5680	msedge.exe
5680	msedge.exe
5524	msedge.exe
5524	msedge.exe
772	msedge.exe
772	msedge.exe
1408	identity_helper.exe
1408	identity_helper.exe
4320	msedge.exe
4320	msedge.exe
4544	msedge.exe
4544	msedge.exe
3120	msedge.exe
3120	msedge.exe
5596	identity_helper.exe
5596	identity_helper.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4876	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4876	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
1204	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe
772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 368	1204	msedge.exe	83
PID 1204 wrote to memory of 368	1204	msedge.exe	83
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 4688	1204	msedge.exe	84
PID 1204 wrote to memory of 2508	1204	msedge.exe	85
PID 1204 wrote to memory of 2508	1204	msedge.exe	85
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86
PID 1204 wrote to memory of 2572	1204	msedge.exe	86

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4000	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/18YC3N9BLx9Dr7gS2E-nYbWih6B9a8kGc/view?usp=drivesdk
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8bcd146f8,0x7ff8bcd14708,0x7ff8bcd14718
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3121601303588721565,3937412744818980175,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6008

C:\Users\Admin\Downloads\Loader\Loader.exe
"C:\Users\Admin\Downloads\Loader\Loader.exe"
1⤵
PID:892
- C:\Users\Admin\Downloads\Loader\Loader.exe
  "C:\Users\Admin\Downloads\Loader\Loader.exe"
  2⤵
  - Loads dropped DLL
  PID:5408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c
    3⤵
    PID:4808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title MCC Loader 1.0.6
    3⤵
    PID:5484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3296
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6116
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5504
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5140
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c title MCC Loader 1.0.6
    3⤵
    PID:4184
- - C:\Windows\SYSTEM32\attrib.exe
    attrib +H TOSVDOIAHWOIHSAKLFHWA.txt
    3⤵
    - Views/modifies file attributes
    PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3288
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:2788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5704
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5684
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:1544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.masterof13fps.com/forum/threads/rise-6-1-25-beta-deobfuscated.8975/
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8bcd146f8,0x7ff8bcd14708,0x7ff8bcd14718
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:2296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      PID:5904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:5672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6640 /prefetch:1
      4⤵
      PID:1972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6668 /prefetch:1
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
      4⤵
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7640 /prefetch:8
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7640 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7736 /prefetch:8
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
      4⤵
      PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:1
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2620 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9747993474325986089,18134700022455865406,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
      4⤵
      PID:5676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:6080
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mega.nz/file/UHVmgJra#SnSzvami3soQnZaTm4hfBswQNtL8BnTcGAGKVi1W028
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8bcd146f8,0x7ff8bcd14708,0x7ff8bcd14718
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:3052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
      4⤵
      PID:4072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      PID:1380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5464 /prefetch:8
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6724 /prefetch:8
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6404 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,3526889334386995379,2602720741523624492,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
      4⤵
      PID:3556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:5468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.mediafire.com/file/48i74z1wnp4icox/Rise+Patcher.zip/file
    3⤵
    PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8bcd146f8,0x7ff8bcd14708,0x7ff8bcd14718
      4⤵
      PID:1240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Rise 6.0.25 beta deobf\Deobfuscated by qreaj.txt
1⤵
PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x518
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
51c551b90f03dc62280c975d364a0deb

SHA1
9ab3977800394f94f6d1dd66d21c0c48582bc4ab

SHA256
ea01f4084ae6408b664f4716fd89212a7dd362442e409338522a9df42c04ac0d

SHA512
4bdde4ce447a1b3733e41f310470845ee820928e9ed2e179ff72d17418d6e67d8aeda8c4a548b1222c38b49461eca1809a179acbc7a4cca7428eb9c03b97a693

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e3f7140c95500cd9f45c8024bd218a29

SHA1
bcc5ba702afe4735f37d6a69ba3ae37f7360d941

SHA256
60041833a37f3e9080fcb1c60f2728bdf020e5590b6080f26a2f6d8372a36ee0

SHA512
4f27aed850c78f84331c267d4f6e594b0fe6b10987d1aa3c4343c288de1bc1e9dd20e6ad6f5278ca9d5d7f6fd1708dc2da5e35f1ba337214870a9805d0ca733d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a70fe1e-7eed-4e18-85fb-d34a8ae387ec.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a1

Filesize
18KB

MD5
54634884a74ee7e8e29c70fd792dc594

SHA1
fd58ff24d33de21640dad20f428e916383c614bf

SHA256
2baf2f6645c28551f5e6fcf13a9bf75ce44c5cbd250ee538631f6becadfdc767

SHA512
14966b2328978e0bd2801ac1b5e6c9a62a5004b1feb89591196fba9c926d8a4aee9d39a2d46c3d1434340d603b60e39fd785855eb94694a67d4f711cba3b360a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ba9a5d057c72ff4f5835785f5f1310d4

SHA1
a2172b1737ab872381d7e77e798608bbb298b5cd

SHA256
8adb9ff6f927817d866f343f9af82a26a669a3de54c984ce1052b5b21c3a3bfb

SHA512
dddb39fa4d0a16be8bb5d7b19d77dc3659770d76f45cdd30f856c0e98ecfd04cd861a9caeef21517238c541e46fe5d4a0e7f3258a86d9d247e2715740f4b8eba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
e2119834b280f2f252f21d57c699336b

SHA1
2a72586877d0a778b3490bd6fca7b40a874a64b0

SHA256
f47b69a9dc7be63fecfa374176987fe7c4eafc02a4b9ee2e93ef7a9783854daf

SHA512
3084f6a8932ddc3db3e8a802a277fd3f98f0a9fcaef46f301b8adf79d45e849a9ca28a9af0e6458ee039d3639ad7727a3bc9c57152b056d63cea9bd4170ac664

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a0fa2fe65b2731576ea0061ea67b6281

SHA1
b6ac9fb4c04149dda163eb31ce5ed60afac3adae

SHA256
4a6ee3a99f8533c55e4b6fa6fdd50c32f10eb831fb3fbdbe8d1ebad75e60a031

SHA512
962410aa2e4f5f9bbbbe2433b58b2398c75ef16fa8efa4e7ed127c74ebc16fc4a295e065854fb46826b4949e855bda965e1569aff5652b0ae6b7b5900142898c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
2f2136063f7b335f2daa691501d469c4

SHA1
fdc55ae9e54441481c9a150a7ec3d006c0a17c9e

SHA256
52b3cd33c4e52479d81b61cae51829a5742c2374df9dda15785b735f3e1a6894

SHA512
f0d5d587dbe3ae9cc7c959ad507e2659f03f6ca6b32a107649baf886590e154ac03b700ec5d550891da980ebe03e4784c5329d9566612a9f7a13328e033180c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e26d4be45dcf504697144c4e96ebfe7c

SHA1
1b3c0b25c2a138f343017c96182230f5f8dff2d9

SHA256
b8e1953fc17a9ce66e3727d5969adb0a98e5b3a21130b805a76744d8228d9c22

SHA512
3ab2e4de56c1e5a6ecc5411f17c536452d0ed458203feef584c502096879dce56b7f92e900f6b1161e86c1182487c242daec651001018f935917cb09590101c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
4008787f648732c441ea8dea59af3d2e

SHA1
283af64c6e7fe43226d3d83b3d24d6c3bc38df64

SHA256
07111e9d306907c5f7abc6290ec5f74a7aef017931d4e055e92a3191acc3461a

SHA512
b5488256540332bf575cbe1ce6a46160cdd799f48ba4aead07e2d4c1fb2b96af23dae195f03795983e0ee1a42cc9a58492e7aa0a019321a9b75958b543e789d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
bf9ff7573c43cb5aee6281013b48e68b

SHA1
f33b335d7191a17495463ca4410913d32234041c

SHA256
da6bec2baac92dac7955f8bc88aa1e4dfbff0efdafdd452e799cc42f73b954e3

SHA512
b18bda58c657574737570d9d195dbad7ddea0f4c6121c1bd209a4d289ee00cd65c94a08b781aeb9022dffb171a756c4d9113e35b24e7df4954b1db33d3a30022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
91458d5007ddb2d433582f3b273e45fd

SHA1
c744c94aec7a781b430db75912a8e7549881ff0f

SHA256
32215d4e296f52ec9668effe3570fbceb3e2de897edf70392fbc0551d0fcad1e

SHA512
263c63b1fe8cbab0ff71b6c4800a4759b023932d6173ac9cf6bf29160ba15e050383b21393a5c39ea876166440c81497e9e6c526cd790164e76489962ce3fa5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
5757799148830fb0c41525d8bd661064

SHA1
942e5c169624f5d9bd0a544335af0039454ae2b6

SHA256
8fc2ba907e661c4a5216103c5a332cbbd9ac0cea37d082995015c00227011615

SHA512
936a9707cc7e94a5590762c0b642cf269396ae4e715c5c231905f22ef35e73e24606e414ee64f90bb0b493e9bb02dbb3455c22ae8b3732fa4bce8a62c0a2b5b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
96e80fd3f600494bb5c662a5135fc22e

SHA1
f0115ec8e7baf820f8d7748d55999fbc2521813c

SHA256
9b33950648dcaf268b0b737a180c7ec4e20a6b8b63ef57f0690f9150052ca6c9

SHA512
a6144470a88cf7e271b9ef5b93453b04060449a4be8804eab188ad3d96a1f0fbc7bdb1b1c94e7be74a7c491919888345ec7857f61dd5278dcafcb2a05bf7e09f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\00\00000000

Filesize
4.5MB

MD5
0298efffc45211ceb1d9b36e3be02945

SHA1
c832a427528ca07716a708742261a778ea01090b

SHA256
23147e477ad428cda658e55af4a1fb7c42492d470efcba4c418a008d22b71c4c

SHA512
4867b3ded787db734c48c7b860f506190e54db7841d0dd260be60ae75cd4f1b56a308a1273ec5a7a05ec2af3605e53ba0f1607d9ec4584176841094ad958fa87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\000003.log

Filesize
23KB

MD5
da2b33b6fbef66a2e1d05b03f1ccb435

SHA1
80465dc6a0c2637d7b7d334c36fc3b1da918507b

SHA256
631172301ba086d6eb049ae9b174472c697a37962edec434a3c72ee45db0cd50

SHA512
3e33a060d43357e79fa5ed018c7abcff8612d607a703475f655d4dbace44bbcc5c2d981f0a185291c65920c64ffca76ee9b10c3d27a1674d30b4445ce4a0d905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
375B

MD5
a7dcdb0cdf321f3813d65833b0858c95

SHA1
f5fc6153a516866186e684a7179a3cef8761970b

SHA256
a652c5e9b085762879224436a39a0e73ecef8fe653bf297b2b20869022003ff4

SHA512
4acd824c957498b114e8b6e8c93a651bd2afd5e93e3ef8d4f9b10d895b770df92787c8a96fbfdd0016ef2cc83428100b707b7f13b33c0b87140c3deb457827f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
378B

MD5
dd5fd63cefb03f3211be64c598cb8291

SHA1
036c91112b296c4e8f2093636eae8a988362f4d2

SHA256
a85b4335a1e699f60f32aa26193b7c33279b2320b39d829518a82944b8b4027a

SHA512
cd4899a0ea99de329de4c05c976b8987fa8ec289f43d016c08039cc720fbe5b339faefe2f941d5ad0e796a51f98b68792cf940595bc5f498cb495279111807e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
378B

MD5
9321852ad77225456560e2fc3cc267e3

SHA1
73cff306e7582a673e0bebafe565adbde08afa09

SHA256
647fb78a9ad978e3d6483c672b61a3ad1cb7d8d9bd137ee0e9620d2b002906de

SHA512
7b4db6819a40875af9722c2ab81924e2dbe8c2aa4b3bcbc2a1050421a3f9f1aaa4a97a129ec1fb44efd99dbfe226f6c57ae084977ecae76c41cbce92902f57f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
375B

MD5
f0ea9d51aed50b83b6c84234df8acbda

SHA1
8f2bcf21ab853f597fe17941c372b20f8e4b6d5b

SHA256
7779469a66087110b7d9aa86acec23f085342c7540741a423e390c74156abfe9

SHA512
edd21d4cc01187e279fefe72172835e45fa707f9d7990bfc43479c0144bcfe8d06745176d7011bca0ef5608c9ba7563b6678a9f92d977ddbca8d2e523e24a7c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
378B

MD5
323736930c991eca16ccd2601478e141

SHA1
1f0893a97b93a270a607b45826c1ee311766e6d1

SHA256
fa8e4475302e7693265be89d45a43686ce6f7fc51bcecfb011d14f4d96c6b176

SHA512
ea24e47f571c1377c31a9b989f9807a8745f80d55e7192f4611aa7a4658a862834b8dfc25868122e1b609ad485fc4b1483aeb1e4850aaccbb4d48582e03b1d9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
378B

MD5
a1c2322be9a77a8afd88da43ebbc10c3

SHA1
8bebf0320ef2732cac6c47122d660895537e3e2a

SHA256
d49db5e608bebf6704d0e508c8da4285c13704496b4637261c69941ff453f819

SHA512
85ca5825c0e321b3b8450b745434088328757ceb1073b44f3af22c5fcadea63437533894c1da2cc2f27a2c34cda2d8e32f876aa2707a587fa33efbb96563c340

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
375B

MD5
e90135749d52237a386c5a1557dd10f0

SHA1
9a0b24cb7d2094f822f1937476d459a98984fd50

SHA256
4b172a38ccef4fbab381162f3ff20b3438edf1db1873a1ef4f827e653c27d809

SHA512
e3f8b426d363c0496d308b8b55afb84144798fa8a43897e3bc35eccdcc2663c8e27838fa07b5a0f46a58bdc68793c3ce112f413fdf2905c7a705bab8b6afa39f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old

Filesize
375B

MD5
710356fe13d292715832c790ebd47630

SHA1
45701fc35e0bb3dcf78493054e905160732a277d

SHA256
bd0499a4488a639775272c8b353c7249e26714d21d3f2cf5d72b4c494d2a49dd

SHA512
fa9350c0f8600334f856c46bd9bdff2660cdf664d73ffaa7a364cdbb7ed262382ada969f6a34528e590fb81851e304f06295bd735a7ea193192c4e7efa1de938

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\LOG.old~RFe5b5735.TMP

Filesize
337B

MD5
bfd20b82c6872af6b45410a7cfe55c6f

SHA1
2be5004248498b33011cf321b701cc2633791e0f

SHA256
2419e438049a2cc8e9c0df60a6636b8ef1c7926e4ecb87b2d64cb5974d901bc2

SHA512
b1e47b0574c8388cbc30f12bef3b309515cee838a9f159d18e9372caf132b90384cd7aac3f0c257621163f52db52fd1bc40c88a1d833349612f40540db87575d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mega.nz_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
68b6172e4899b898884444ae9a2145a6

SHA1
432a707efc7b9eaf677363291351694ce43b9100

SHA256
b21ed9459adf315b01c5956f498b9a6d3d89f44d979b45350f54c9307d8e3c65

SHA512
78709a2e3a0f456b668da8e10e13482ced6fd7df6d01e7cc30b11498a7f63ceca8f665a7223d0de1cd4941e1ad34adc3a83ee79df8cbbec3fed2b8b5689942ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
17KB

MD5
865c6e947b37eb1e5c590bd776862f20

SHA1
c946925d357eecb3d2f5a5d99f0c6a570d8961d1

SHA256
0cc3df924d1b8f9a0d87313faba79bd08385bfad8d13f5e7c44d87b48352db30

SHA512
f9835dfd0a0cd30817637675744738989f4f823d1ebbbe92aae8b1027b3c008585bc6e805436122d79c32831b2e030a38e4657ea4cc4a7c7bd9408c16749ce36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
19KB

MD5
10bfdd7e6797d48dbc6598572bc5bae9

SHA1
2767069163db6e5d18681f5bbd68421824ad9cfd

SHA256
429108cda7e4f7401f91d457fe97cf4e9eaebb246c157898fa655899bcb3303d

SHA512
6355a824612744dc2f7c32abf3fb8fc729fa4ffb2f3fb7d68cc95d15db9c0ae4a5aad774092123554f26e357d7c8da1d30580764db5175005363c5b51d3f97ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
19KB

MD5
4e90cfa160b10f303e70a0a3e027a047

SHA1
2771460fbf5c771717c34f0e9ab4bd4008010b03

SHA256
c225c67b8703f59fdfed5006247808d92c348682a648c1c3a406476b73332984

SHA512
5bcec23a71e7ff56efda93054cbb8af56151f9c653b7ea7f3620b7200e5a0e6c87c4b009c9339ab14afc80addb1a1061d4a3b2ed3586182b1138ae587902a14d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
18KB

MD5
3f055b0968d2ed20dd9c2b9c406cbb21

SHA1
e0b5d3ba7a9f37755573c86d5748ac19c21798d1

SHA256
0aaa8c415f8b9d7beb71ff642a0f9a3518d3737ba806cec037fdb0468079b282

SHA512
80144000942858b51480460caf405da6f8555aab8e8fcd4c3a0df838f49c2f6939aecc00f5b967ae8257752fa97210d3b6f8cab22feb558fec95123531be1d21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ef8eaf47bd442307a6cb48f0b88983ef

SHA1
c409ad961185c85eca23f0467e6e6bd7dcdba323

SHA256
5f038e2b773d9b29d001feb924dfb88cb54487114e7e1cbf4ac1af4eb7856738

SHA512
37ab0ff917024ba0045724ca2a15a01d5d41e559f24bdc8cff61e55b27a2b2519320060dd6845cf4e571bf9fed1a6682cdd755020f08425198d1904108881dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
42abc9e44f453b19a6515c1feece2b96

SHA1
82bd65814e4c5248705e4fb5ad51e1ff0f105ff1

SHA256
57a47313bbdd0245c5e3f2249adbe03784b13d9479558081a5662e4bf536e258

SHA512
f42b70f74fdb5a442bf98f604568df43238f3ac09193f3bbf082b1375dab2e9248ca669466a99171872f4675bfd1b911b0854f44c19030e05f72c816fe929460

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
0b74715322cb23a2008e843c2c8376ad

SHA1
ea71ed6484496f5e79fadf0a28c144dfb5557a69

SHA256
54e79e8c957b279ccd60535ee49e2c2a480edf2a8b58904feb8bd13ff6aa23e2

SHA512
5ce95859e35bc5b71d1b951cfa50eeccf45e6a488abae267f6c82bbbc3bcb32289cd500e2d3fc6a1412b634a180ee42802306b21429333c562e619f9956f0bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f20316e8863f84131adfc63c72a5137

SHA1
6e77e8b85f9896dabf6f167a716dfa75696d33dc

SHA256
ac969541c4d1486d63c966ac4905a9997d4afb8de442161525fef8412dc8f569

SHA512
d38c7bff759577b7ecd1f255ec927644a4cd9332c995a0e4ac262d4cd4f0264b50110b4b93484715f1235d032ec7aa046eace6c74e8d2b95a82a2416d03df293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
22316295fc118c182807b0c36d724ba7

SHA1
764dda0a201ea926b27c0d762adcdb04f2c6eb85

SHA256
f926711c6b2aba7d5407c1358790ea12759ce0ac344a8c31205ac10d64468db7

SHA512
b896a03000693b5ca979d73be81546bccedadc3531e8d7721b4240f1e88aa0cd7827bd7975971dcb2b2475eca599651dd2b6b50122a10c400aba8693d2b1bad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
85a09125bfdc2537261061500fc8e197

SHA1
a6f97cc7b5b85787c124bc93204a7297135a2c4d

SHA256
565bb3f06498d164d09f0909b9d1252e14e22ae82bad609c9c2914c82f796176

SHA512
94366afe1fc89f81b17acf818f32c81897ae9b48c8261e758bd4c22fc647fab965e9004df339d8bff14cc65d11af307ae12946512cf4da6cb81f1c0e7562add1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
b767069ccc8738f71b7ab34b559d0967

SHA1
dca638beadfabd4542d2821cc253757891cd3d5f

SHA256
b9336a85de7d2964491a11d494ecc519c3b18f1d71658bab23d799e01bcd3024

SHA512
2ec17d90f167270d7ef625f9bca313b39444c6486e4da69dec7a0fdde93f9756db69c5670d8637df89379df4e10524667618ce9856ac97f277026b5845c5b556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
7c220963e2bb5feb19347aa8eabcbd59

SHA1
417a74ead6138ea3572db836fe03a59a9723dc54

SHA256
c49a96f981b41a57351df4186bba3e986760b6d41bb59dcb0752ad63557f65f9

SHA512
6e3c693892298b2959b8c0a55bc26bae477b787e278bc1e698798c3aa448d02824ab59a8d5ce6adc684ea325bb27ca8cf6f90aec0a315f22872b56033fd7438a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b342514de9d3d25879a5be3e1a4ac7d9

SHA1
fee1b61383f1c6081b6485bbf4b445d58ec54084

SHA256
f34e62e1481152fe19b59a3579640f718d573d905f92492e37eef3429d6820c7

SHA512
d659858a8aed6bcda2178b2bca3bd261276f1fe672b0a21f84ff8a77e2bb11bbf5e4453b7aa4738c9e898ca8fd4cea97126c65ef4a549240e1d0df8997377139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f00269c52f0879ef5b509bfeebce5b3b

SHA1
316e300495311dbb9c1d6cad9d004a2d8f8ddf6d

SHA256
8e399f2afe05c4c69ac4cf1f4f093cf23a2833b0e1ff637aea551c21d530d8d8

SHA512
1e4469d6c0ee52e7a23957618fe9c469f65748132da7e652e93b6855752d38cfc791ccd0f2381df516309745fb83d3181eff6064ef441b2575e89150a13419b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
7decc2301ecac087cadeb7e316abb440

SHA1
4168acc12f6bb923ba3fa1a88f7db4df2698130b

SHA256
6b83ded07691af5b1b3cd75e0c337cf9da9926ee3dddddfec1ef35ef26a4a25f

SHA512
3449105f43981ae4a2c1684373730fab2a42247353ac89a5c9dbc660802c6162ebd8b41fca3be291a2bdabeaf3348d1a390e3fb96cfb500f70f2535bdebbcd69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
4b0931d72c00717aee3383c1053c2ac6

SHA1
b38f5595bb9376ce5f15f6275006a5292be27caf

SHA256
55e9d002485e15cf14120832140aa8dd7562ebe7d41fa5d66e7167e07eabc546

SHA512
973a25ecca011c06c6ab016db6a5772e110be756116ca83cd09c9929e907d5aa22570b6f7ca1c116a2b87ee5287e81119d4c4182489155f85f68c47fe776356b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
739f9399464a98a05f4123f06d87296b

SHA1
0d528efc02db920946f9965018849c083a7c61e2

SHA256
dfc1c2201b92271d306ee7c6cc3ce3d06dd343ba08207c501b1f1711a2af0063

SHA512
0a323f8d618d8cbf603d4331643c2f061ede869e88925845b148b4b0568840c9c063ed40560fa0572f8b9de0cd94044b5397aeb4f7005b255d6097b354814cb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
04c3c2e8068c0fab646ca2735147a994

SHA1
41784a33ebb8bf97ea9bad9245e75f6c0fb58a93

SHA256
b1a95ac196d0fc93ba5b980535484f1f909a706851e05b7c1ecaac2c0594be3f

SHA512
930da519a0230b8d4eefdd19ae6b8c83a0749a5660ab9e3b99456086eb5282945da315266f822ee2cf0b401c25191d2ca274f931f0de951c35f27a9868be3eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
f3e18ea6815b05271d2f944b2a010c7a

SHA1
b8e62ec2f048cabde48eacf759c957d1f271d2d0

SHA256
2539a65999ee1b75c8b968eb134871647a81ef8c36d7b61f69415e9dcc268099

SHA512
d709d358944bd2491daa9289a86c9a5e65bfe6127c076874f921ff126342831ff73eb5d4403ec60fa1e40b8b4767547d312766aef0e912afe58eae359f3ff9a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4e5912305c199bd8e1f09d553d8f6ee49d63741\f04e6b2a-2b8e-4a1d-ac84-01469df802af\index-dir\the-real-index

Filesize
72B

MD5
4fb59ea17d0142fa0bcfc86d84a18071

SHA1
616a3a718b6db0689654b095ca77b86ef17766fa

SHA256
aca447e4c6be307dc1a361fb481fb9857b810ce51a1adc41359be523ac35e941

SHA512
e5b35e117fc6698ed6706981f7b19eddd6254d1c600ec48a0202e335df7a5860848f52134408b6dd54dfe54ef7064f87e58d37b1f13c993d3d6ab20fb33ae7c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4e5912305c199bd8e1f09d553d8f6ee49d63741\f04e6b2a-2b8e-4a1d-ac84-01469df802af\index-dir\the-real-index~RFe58f70d.TMP

Filesize
48B

MD5
afc4953725096f2e64a6bf01b36bf42f

SHA1
0ca91bee819ea73812e446d46fd071170b6e5ce2

SHA256
0f0a0d382a619d5dd0ca8df08151e2f682e7e1aa8e1c3379045e1ec6c56d15bd

SHA512
ea7c90293ca1c5f54573c3b37f449da427e96ad7185737ad57c1a042fe62e57a81a1cd8583a13f002dd3a534d21a3d4bb0a018bfaf91ecd1ed9cc44cc35233e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4e5912305c199bd8e1f09d553d8f6ee49d63741\index.txt

Filesize
103B

MD5
938e1e54d6adc8c44755377953e053cb

SHA1
0542969dd695435bc04a890417add51879efae46

SHA256
5497ff3b2caa3ed34ea3fba4529ff8295c4fe6158d96bb4c02ca6c2daffc2203

SHA512
2f2a9c6902ce29fc52c489e64c3585fe7f248615225417d9705f62a62d3848b6a17e0bf98a8ccb6e9ca5f204081831d89a38a54b70af494f7efa194c085bda38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\d4e5912305c199bd8e1f09d553d8f6ee49d63741\index.txt

Filesize
97B

MD5
2d9d39edccea534f9366a4749f60e757

SHA1
fcc3100661b74820a46c922b1e73cc2320b1cd85

SHA256
efa160851a05f0c05101c1cc788072e5c203d213c71f06f9c2f70eeaad42c1ef

SHA512
a97f9474ccd1352b7a509529d3812f865a9d5b57adf8fe5b52c91a4b90eeeb4a49a58dc56f67f1f7013613f6d8b3d7bf15420109a940de386ca2b1ad36836dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
1b3bbc95306f434b49ff4bb1313cd019

SHA1
f590e15ea5d608ebf4fcb6a228ff301939fb0507

SHA256
3c36b032da5310d85f71f2119eec40616710bc94333bac2f40e611c28913ad64

SHA512
c4e0ef4d54bd41a5e0828121832021db8f3f768eb212e6a020570fbc492ddb7ea0710c3d7e574cac2b1b6345de592774eec7ee1052ce79dfef9dbe4342436f8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
19ed0dfdd6aa4afabdf2122e1275b46d

SHA1
3d21aacd3a024a7027ee8e7dedab58ab67f39295

SHA256
6d28d6825841e838d1074fc489ff72fe9e0d6d8acfce696b8506dd32192afa6e

SHA512
1e534e94cf31c149aa033a4f0003493389293aaf0ec5b460434851b8c16fbf5c023d302ed507c05f354cf2ed9d426bbbf607cfd92aff11e8b7d4404f29ee4813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f642.TMP

Filesize
48B

MD5
6cdab50e17555097a4dc5f1b33d8d225

SHA1
e367b6be9ef260d18722e1aabdba453ef0699137

SHA256
5c0496d334bf51bc47fe2f94a2df6fc79422e952af086d93e05533ef7c1feac7

SHA512
8954f212c6522cd6d233f2d4142537a7bf8034191a39f26572a9f1888963c9f2a9e6563f9a97dce496a796bc07c7164142c655d7216392e32ce492e30201f627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
04be11b40d1cf43df3b046a12993c38a

SHA1
07e778fa01a7871f4ad76e9aeda3292134eec6bb

SHA256
bba36de4054242755a0bd9f69efda2d188db4eb7bfa89c96aca13e067ff9f597

SHA512
88f65099d3608dcb6f114800602cae44160ba59c11a7ac44c593909dcb0490679652506ba72f467da06cbb7547c12b4d2319af432e3fb733477246fb2c372939

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1cbec8a197151bf374d3f8fdb857848d

SHA1
d4753e482e87e51d446241224c4c811b396c3924

SHA256
c1312050ab4ffa16c1335bd71c3b7dca80c8a7e9fef7e9527fd466901f84971b

SHA512
72f77b01d03dd14ed90fe7cd0ea113d8f05454eb5485f975b2154881d985b2ff2a7ad68cb4af13f0e068b9e76641cb59fb41d2213e3d82cd18b6318e9d543227

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3a8cf941a8c8210efcfb9d0e08eb91b4

SHA1
833f697dcdad56c426d8abb53462ad9cb2c569fa

SHA256
5e9f6339c823a67cd474d91cb84429316b202ef72c86e040768c67850570a719

SHA512
88b452964782e8a0209a8361c2bb7cafc102563c5d2dc1c53d6a9e030701ec8ae83ba7be6ff5dd27ea9d519ac89adc7575c6e75eece802e9a4e767109c100890

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
1034d441cafd7394fddfb88c5638a20c

SHA1
27dca080944159c2245f6b2efff24e090406a01d

SHA256
9dcedaaa746b4121742ea7940af72a7aea5be89d343213eaa76459385f12e0d6

SHA512
bcf2a0e795cdfbd9313378023d50f6b24bec42fb3788956c8aa6dd9582f722876b4debe47fbed1f7c599e25476c8d23d0fb7de813eb4d834129202d5ea52096b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
4f7eee3ec9acd3581e6e3be00f90cbb2

SHA1
b08834ea0f5d427a74e955d6a9bed1b00552d887

SHA256
f44101750f068b36a8b3afdf917ceb75d4ff7d99147c7ba6fd3c64479a424125

SHA512
7fee6f9c7b4701debc2d89f940f4d275bb01c937ec4572d24fe22806f08630a07a6226c663f97dcc11a7490dbf2b91389c7da6f9ed488399c927d0ed42d526b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
f919538c05ff3a56045e9f41b842ae49

SHA1
4e02a0ee9dc98888d732edadcb6d7ea20f50daa6

SHA256
49fec836b1e2073ed903c24a71362884e3372e9fee08feeb4f0b5a4130608680

SHA512
d9329d4401b089ca7b849d1e9dd6514c36237eab6e2cba6f369abd62c4f7e84d678a703310e91ed0e24403c3da07aff4ca13a8e7dee62a331d85a4c974c65257

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b26df7ae74367cbdc67a4372bbd1827c

SHA1
9e4cfab8312eafccc4fbc1a30dfddcab69f3a113

SHA256
1b9ad3d892b1f2994d73280721e76de80ad1df3b338c3e2a437602d03db727d0

SHA512
27f3ab53a1b94821101cc4859b77a21ad11cabca616c68c4d8aa8663ccc47ba702b52788746232b4bec49ef8f96cd175ca9a652a33e7acd94ca956d67fe79970

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
270ba17c0a80c2c065a8d2796be5666e

SHA1
64340f656e5bd22fc2a97890396ad8fff6e552f2

SHA256
1be485c223cb0073c41df61364e856b776b166c90f7df80af46eb0cfa1c8fd2c

SHA512
f926122c111c5a7d8fd997cc51c1ab8413d886cc2f545008e1a15b5f7a826fef5d9b67c5e419468f24ef92d0c61941427c2dc370ffce136e052ccb5824e658dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
eefa9847385c2e99c1b65feaca1b296d

SHA1
07e7f585c9f7ce37d8a5c2d9642367c4dc4b82f3

SHA256
934b96a4deb0224d95cda279dfbc8b7b3c127ad3f6dbbf3aba787023c5887666

SHA512
a9f357508e6727261e6247a76b120e6f2d4569f841dee065b8642333e086f43a27d8207290fd49e53c59426a045d1a548a5906892bba7c4a6bd055da7c1062ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
926b8dd269fd92211de08ea02e0a1018

SHA1
ff6b908b9400c7b3a88506c12193ce76eb77be67

SHA256
b00b6ed8a5da3c055ed3d28c7576202c594a90d9a7c51248cd82a6c014aff54a

SHA512
7f7b8b5099e470e62cbb852fb88282f3135285e8e8e46e8cc8855237d7ee732f6bcdb875f6e73a187d83c7dc675df96f6b3c6ee1e820c83a00cdf5161a6ae5d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
8f97835f6e3b535340d20cbfbda9eb06

SHA1
1c857ef4997889af3da3200460b0aab06975076a

SHA256
b5070c3410dc17f3f43f238ef9191459f5642dfff0e4ab57335383d344787c87

SHA512
0c159a437ecbc992c82fc878e0296e02dbe8cb07966e98cea65a1a94c3e94b83dfd38c2ddbe0105ce642393647b207908615610de8a90b1629b56e95b9fc8bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4136c4a26cf1a3f2c0da765396a65af2

SHA1
1f0be3a2de3c30c300334e37605ae658129b3a8e

SHA256
cb6f1fdcd87faecf94cb19d66d222d8c0039f181ac6dfe423246cc269155e485

SHA512
8097322a59c8beb0435bd3fa5772570ed7a3a5ce41947deae3dae6d7e66bd08631e389b36cea718e25d4ef7236e051cebafd76f7bac6a5c19949ba5421eb6e13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
69e0b8fe9a7b65822ed1bcbc90e4f107

SHA1
9a545ecc54994c307992acc80328fb9c7af1711d

SHA256
4681492ddcbd0359e33c9c67d5094c12b74bdebf49b3a57caf048f5731ca51fe

SHA512
ee98f08ef98fe3fd8491f86c7d53ba00664191b869666716f87a6b37decacaf55a6828afb24bb4ee89b6fe8f8c011222c8c1d2950008a12b83ff05a48f66e6b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
bd0183fbd3cadbb8db7757efde907b6c

SHA1
f692be35acbb4be0b907fbdaa41a5c2ab36d4db7

SHA256
954c9df61f4156e4aff9b10ca1eaddeb083bf5640a6e12d90e83296d0f0afa54

SHA512
641a53157210ce3750a6e5031ca635038db9947eec35c7a468a881aec6c7ce71e94be22f9f3861cec504df816fdf911f0eb47ef0392373b0dbbea7b3d9815062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4f1f5c9aa6b59cc9f1583252c24db0b2

SHA1
99306987c137f756156a4b8bf60dba17fd06b2f3

SHA256
1bdb7ee205b02790cd8047ef828d66fc326efcdbc21a569204312277cc4c4719

SHA512
e0c02fbd5128c4f10904257ca6c469b119e278f5a35793cc735bed7c8886b0835304acabda39e4671e07d081b999584210a5a3ead5b5257afed9d955d1ced337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c26d3bd273b1b02a8a70b734594ef954

SHA1
ae5b4c0320392b1859d74bd4a6c3b8d7d5c69904

SHA256
cd2e0d83882143b9682cfbd922cf0f9a38451d23d4ec2352e41c8363eb320698

SHA512
8ececde340746cc2176594b00e6c3a263b549691642fdc664712fa64e837a463b6486998979195bc76af621f5fd8fa222cae4035d71179e7a0cdd09621343f4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6717ae1-53fb-4d86-8eec-4d1691521546.tmp

Filesize
18KB

MD5
d66a43470660868fae9a2c5560c0c3a7

SHA1
0db63b3063e37a02d3e143bf894aae4290fe572b

SHA256
455a7b59067443ae428fe300964e2bc5fa60c1859dba0738e91b8b4c8b5eea74

SHA512
b9d41521a5a24c926c4e556a5436f70be24fa39f210cad1147b3e74523c634d473677fd948afc503fa386810dee50f6395d764506f946ce7f80c747a96324ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bf33a2521178aea35680b68a3ed11712

SHA1
672300341ec5aed4b0327eee80346d9e25bda7a4

SHA256
2b1c8ab4a22033baa8e1d824ec29cbd27d0582e6038c96c724edf98ae72aaabf

SHA512
decd0e6fece27717a5a0a140ede13fa6423a36076281960cd2cf4e13d7a4565508f1cc5aa8b0771432a19c803686e1a41a541f1195ca0c7d20818bb6ee6006a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a80e09103f54934f8f98ceaf849bbe15

SHA1
387945fbcefbb42846cd065e5e7b0769aab1e100

SHA256
374034cf2d85179b2501bbb797af532c807ac740b4ae33dcdb938999ee9fb617

SHA512
6e49f443a6bb8eb9ca4f288de78b752e86dbf2b11b01117b5cb8b7f5f56472ca0c34d26168dba2b05413515819e36ede6ae79f479c6409e26a31057683af62d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b3e66f2a77a509ac2babb3fbad379c7

SHA1
b59b20e89289350c9c114c8f40bc7299c6dfd494

SHA256
0fe95b31035fb3af92027064abcf8561eeaef425bcd4e2cd4b38e69d44d55436

SHA512
f5963aefc83d3f733a756256230727d16a18d5e143edd3f71798e59964db064091d62f91477a60b90e04b2fce98be348fba8812d7058bba8cf7bc8ba80ed687b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4ac3ffda0345b7f7ae908f1e39b7f78e

SHA1
7bc71081cda45eb8dec0751c655b3ff4e01ed49b

SHA256
f2a091d725c9c09c2fd774c640203565c84decc1e315ca48b4293c9e4d451c44

SHA512
02b4d5c4c79df4e535ae28aa43af4479defea7db158d28572104998ccd7aa349c524c2ad1757bc3eb77fb2408ebd441024a3dff2b5fe255118ad144995a5bd35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d471c3c63a80296c146ceca19f909f22

SHA1
6ddf742d54f89952b5351817c1a4d63cf9a49787

SHA256
df6f30ca8482bf54e18be9a014af717c579a7c7bd42246d00a62202bba24f001

SHA512
ce10520466a38b04c44ed5bd016102d559a437a8041ef89eee42dae49a8caa6394dd19a2a68cb75561be80d8a5bd0142a2cd170d37e486d8353031c5f9170683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5920faa3576d21aae785a153c27dafad

SHA1
9b9b328f30e0c417e5050778cedf79c3fc6e26e0

SHA256
92030911f6a5ead5dfa7069b2d07c3378d010005a3df70f2a01aeb98226593da

SHA512
84d0aa4cc428ebeb3fa3533ece6395184a7d1ea5cff41bad9533f33e2afc88bcd659efcd023a5fc003e0d9f6522a3ecf3b109b2479a3eacea09929eaf4c6f330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6ee86cf8701c410d845f5379aad4f130

SHA1
65ecaf031807ee8f2a19daa5ea0fa3bf11318bf2

SHA256
16cfe78c0b17d22cdca9a0a7c2e86a4e03c863ba7d8ca4ade2c58eca1fa87584

SHA512
0d9e011ddf5f2001ee285dd9bdcfd6b0236d462cf216e29a8a4fbd06e7d002039463005a5d7cdb8d792555870f93c9a7133728c867a02496d7aaef19c3b8183c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cecdeb77f11f3144a9a3f33076f51049

SHA1
50fc76faaef408a0b72e9a2abc3fbead8aa0c99c

SHA256
0757874d1d13738aafa0656b9828d951f2470288a10cc1e300ba58e118a07bcb

SHA512
d84a67979d766647dfbfb7525f6f8683c683fa818b578440ec80c71136531433d22460f93f7d0e0d6dc91a62c187ad64d7ff9be69bf9c4f9ed0c3915c6105491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
605ac98335d78fa98cc91a4f1353e38d

SHA1
fd3fb496308317bba5b3ae661fe2dffbd05ec702

SHA256
791ad5ad313d3844fba53d4f5abcee92cd8bafafb8f7d03b225eaea49710337f

SHA512
194390515e5d743450b8f7e973eb4b3c863a9a6462615ae1bb0052b2ce06b8e962dbe5083429ec8ac4736a5f056e98945d6d8164d0e83a19b40fd3e1179f89fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
90266389e3bf9e6c905cf34bdc28967d

SHA1
861c34d4678743844757f46f202bd464466525e9

SHA256
e2c079ee1c374cd84636499737962b25bb42c85c49cf299105fe0a50fc0f3eda

SHA512
72d178db82d09f6d9a895674d03a519be2363b0a7bffbfdc7acf0592d7b4e01e52eaa74aca391fbebf392936e6e8d85730e3b45c8420d7b4b60e7baad726b897

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\VCRUNTIME140.dll

Filesize
106KB

MD5
4585a96cc4eef6aafd5e27ea09147dc6

SHA1
489cfff1b19abbec98fda26ac8958005e88dd0cb

SHA256
a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736

SHA512
d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\_ctypes.pyd

Filesize
120KB

MD5
bd36f7d64660d120c6fb98c8f536d369

SHA1
6829c9ce6091cb2b085eb3d5469337ac4782f927

SHA256
ee543453ac1a2b9b52e80dc66207d3767012ca24ce2b44206804767f37443902

SHA512
bd15f6d4492ddbc89fcbadba07fc10aa6698b13030dd301340b5f1b02b74191faf9b3dcf66b72ecf96084656084b531034ea5cadc1dd333ef64afb69a1d1fd56

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-console-l1-1-0.dll

Filesize
22KB

MD5
09b2a90adc73421c3b7a70bfeff0baac

SHA1
4c9874195e917efb5077887be2f1677e58410861

SHA256
b2093752af55d7708dd9e0540c66a621c128870dee43efdb2a36d5128db463c0

SHA512
fc4b852127a34678d7dc735bef85494847a16a4a6505b8a12722672faf0169f234652ee24278c51ad681187760e41a27fe46348252cf29fbfd2c9a9e561aaecd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-datetime-l1-1-0.dll

Filesize
22KB

MD5
8dc8a35c4e043348eceda2657c263e5e

SHA1
d7572375b2ade6a4cdd0910f601340a39da6aba4

SHA256
f1ded4bbe9ac8fe71a3e0b1e72aa15d6fa699f986a6183681b36b38990df9037

SHA512
6275043f611001debad6efbe8b402f9d4a7ee405e6e1306b253ab26616a399400d845cf89355756e3d81dac245c367a5df42dc2880a728560f97ae43d1df4926

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-debug-l1-1-0.dll

Filesize
22KB

MD5
d646d8ea7d6c3271337a827551618e14

SHA1
63deaa4158f99509d88e39406cce3b9c57947de7

SHA256
41ff412526664f93fc6997dace8ccf56c709b34bf745e97091eb5e1a7c7e491f

SHA512
af9151905265a89164ed20301961c250271f8804ee087b05a575a15d2cc27084a258bb41eab1bc6376d858fe3f1871ddd32f9f79155624fdd89080037f6ac865

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
22KB

MD5
2b408cfb2c072c30f6c9007623932d25

SHA1
2835982048a9bf3528a532ee766651653f36de8f

SHA256
48435a9a3b4206b595741c34be6198a759569917cecd3c526f0d63ec0a55b0de

SHA512
3a9d593652a5e9a92881120448772d847901b4eeba1a2ce0161a66cf82e94c1dc2ce3acc17a95e595942b3e0854ffc466efb15023b37aad0925ebd0e0bd44771

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-fibers-l1-1-0.dll

Filesize
22KB

MD5
f5fca0b8661f1d2a8e72d3dbc95abe77

SHA1
9c45d68e7c64c39bd6296157fc812d765999be36

SHA256
55fb31da2909865d9b3b980afa37bff007fdb624524dcc337594118641953784

SHA512
6599eceaecda56ed2dada54aa01a8dae8a1c4dce09ab3c54d0b77885b9b5cc24f67bda6f5285a52a08b69d9e759a52781a829cf130d9224955397c41acaae468

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-file-l1-1-0.dll

Filesize
26KB

MD5
a5335665d8992582f89958087b60d3a9

SHA1
97fb0a21234fd243d46d21992e6016bf0af2f3d8

SHA256
9f8d03558282ec8afa80282d0736625db4c28ba2e1d358734fd9c4a29fe4ed1e

SHA512
b286004cc38d2873b1579b097785cbce24fc9d69989a0dedf05ca338981c6a13678bd71903a6a99f38013e1cf43729e48a3e50827f2dddce3695b9192264c477

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-file-l1-2-0.dll

Filesize
22KB

MD5
8d1531275b769c1bd485440214bfaf82

SHA1
c8bb901b148522595cd78f1e12f61730bfa3d9df

SHA256
0b7a730b6b10c9d2e2fe1b9b4419b1fc60db9074a0c6f830e1b2da4d0f65fe88

SHA512
55914f424c400208b0d2c4d6cafa355aecf4697d3a6bf4032fe298214ed3565013c969b1e23d91cdf995dad46760c80e3a0a3abc062b3084b2bb4bc83a90995f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-file-l2-1-0.dll

Filesize
22KB

MD5
50d07886dd9136e8da57bfde8fa1f69c

SHA1
17526cd01e870d4087c5aa423e4971c72882e173

SHA256
67fd0522cacfc3f5fb90373dd5fb388b6f63035d9a380cac4a3dd3d7801724ed

SHA512
7d1b12529f35e1bcd7a858fef4001a4a5e0ff15506789fb3ce56b58427d16c32a9c1768b87b2f66a1b37456a05f8e05ae0b0eddfb4335ae0cb8eda00550175c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-handle-l1-1-0.dll

Filesize
22KB

MD5
32dda59c16c53eda2027347b5e741e9d

SHA1
e9ad7505f468b62144a8a8551c2d6dc9f2f82a5e

SHA256
595ebe2feac7f57035b0ce803412bb4470d0366637a191cf4e48d5f5fd8bbffb

SHA512
d7c06ce6ebf509b90592d6262ad9950cd8916f715add79a384f688869de596c8e0546d1597380eadc954a9e5dd2a9dbb818899372ab51104e865644269cdec95

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-heap-l1-1-0.dll

Filesize
22KB

MD5
5ce4e2adef8fc502db7155483584338f

SHA1
9d7aabb46f1cb7cffbc04b324bb4a10c17c45e97

SHA256
23e4d57c2a94c8412308218a091cde0f4aaf3af360449e31fe524b153a08082f

SHA512
0b160aa88aad8e06d157cb4468cc1479ed31e01064cb8cd0900d34e3a708dd0d77dd239e357fa7618eb75325502f5f8fcb90fd9fc6ed2a9c1d7557cdf1876353

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
22KB

MD5
6455ba4882ce135f21239aedf014acf5

SHA1
2db779414b30759d8394184e1f7254818df62ed9

SHA256
57dcbe7343ac4427af6a82ef24dd7afac04bce59b82fe05aa506fde656f513bc

SHA512
81764d46251bcd76f8c127af3f00ecf13f673b46624beb3a5eab5cdc6d69a0dabba91327e30e976a3fbb0dc6280b0fb4e8e7f237615b27c484b8ac5fc084d056

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
22KB

MD5
7dc3a99fa667f8a00e9689133e4e38c8

SHA1
c37c13d833d6a11212dfae32fa19277baf5000f1

SHA256
d8ac0559b5cfbb8414b39d509bf96999567166ff63f4994c5af07cafa3ec4b08

SHA512
e772c4ba5181c2f543029aa3929f0b3ffecc2e25e350a900f798ae58543938c61e45a233593caf6c45ecc21877ed79e0ff2bd5cd2f61e7a3cd16d2e4e9520212

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-localization-l1-2-0.dll

Filesize
22KB

MD5
ab169047e1a0fcf3c98be20b451cb13e

SHA1
a286836c85ae43ed5c79b9875f97abdadf57b560

SHA256
3cbc6f8cc2a014c9c6e87ca05dd0e9e0884da58afdc53b589b3d7172c4403ed7

SHA512
c8e27ebd9335f7f34919e841f9834fa687f822d4289b47c20283e37f4a499008668bafd12e1f742597a6c8623312fc41881c18a56b9062a2a609dbb55f0cd17c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-memory-l1-1-0.dll

Filesize
22KB

MD5
87b17a424c4e5eed9d5794ba33317dd8

SHA1
7862d1b492dea9e6fe9c6e1e1706137825853947

SHA256
706bb10d0517bae082df6c955c3915d1104ec128bb62059f70cf9564541cfc01

SHA512
75f6dff05a6e06cd103b3b65a40149dde45abdefca67e352ee1ad4202da28efe9dfc530ed2a51995fd1ce019512339fd908f1762244ad7449a5d571ebee41e72

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
22KB

MD5
360557f082d00dfa55bed5bdcb7d9593

SHA1
f00534612643f0093a689d64cfc61e084e942e12

SHA256
6e2b713382e574f24b17e8a1c911e8256d50b82dc044ace459b6e0c679a3dc32

SHA512
41bc1078e1fda3527ae0cd48051a0ec91d8efe4de1b6ff0903779d7c7ec47b5327aaefbd8b5e9c7543aa786521406b15dfe1bcc65fde6fb3d4eae51cc06ec889

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
22KB

MD5
4887dd9dbaa261a8b8ba0c5bf5da03b8

SHA1
19b72460ba53f5d8d95edb83f28d8df2e714d344

SHA256
a41e6074348ca71f102eb9207ab8844c6c470f1260003dd453907f77d14a668f

SHA512
aec187be29253306cbb0d4b0d535b1f9a967ba5f9e868e38fc23de931bdc363119094999d143cb19b2231ad7e97907d1de92f8300ec80afd038079ce7dac5a36

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
22KB

MD5
6442313028b28d89f68b8e637a7c6510

SHA1
9d010e45f4faaa65a155d13211750517391a21a7

SHA256
bf1fb2e33c4fa6dfa0a50e2ccf1a1976a02d636e4e45406d2587c271b333da14

SHA512
7397599d60b7b1999e739454fbc1f23c511a20370a22aeb272f007778b2e67b9bcf05638a72985be7c9d133af1ea8744c14c0c8a55ad1451251ee35947f9da24

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
22KB

MD5
5132f7fe729791081561426904d45e76

SHA1
56fba2baed4123bf4be7be1c5344f95e6bd9db9c

SHA256
a5aa6755860602c58c0edb1353c965e6f0ba58e7276ba6fb5a0b961fb274d125

SHA512
b12e981ddb608049456dbfc0bb77350819f42caf0da457ad778bb9ded3979503ce6713d366547ac3f949ebdc01d0775da1d726fd367b11b8680a472017f59cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-profile-l1-1-0.dll

Filesize
22KB

MD5
2cf91da8fcbbb1f9edbd457196cd2b6e

SHA1
3b2ad932dc29a4fbbea664bcfd64050d2f2be037

SHA256
8a1e68d655fb05b18cfaf8f4bdcfbfc53cfaa7cd941e5aadbc1769c461dd1fb9

SHA512
63a12b7f220be481dd5240f44b6cf3a8c2d734dd460c2db551ac1a985e95702ca0c0caf99a0f4d767afb730b5105f9f41be03e491090893d5a16fd871364622f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
22KB

MD5
fe4c5f591405fb55676180a29c079f43

SHA1
4ca10f86a7a27b86c74205af7dfb8a4d05789e33

SHA256
78dffd464d72e82674647840c3361d860244d010f0402d87a7998d8afbf8cce0

SHA512
b3bb7911c33dfde7e04335eae357a8c9481eebbf7a74b341e37bfa54be400905ce1ad951cff21896f9460922290201242b071014925a4de0343a940f9c6a71da

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-string-l1-1-0.dll

Filesize
22KB

MD5
0519e2e84483ce47c37a160eb4d4232b

SHA1
dc986257568e666f2b84a3d1fc137f55c95426ae

SHA256
3a76a88faa313726977c44656c3004664c6dd171ff58cd935e9a5ca282a04cab

SHA512
931a7c98e72e56217b3ca10bb1c8da59f1a2d797bf1623345386023f42772ebb58e87e61eb142aae272641ee4f0976ed7e9e0b6ee4d8ce18fd6c745e848cf988

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-synch-l1-1-0.dll

Filesize
22KB

MD5
f77da542def06fbb430198b37506a09d

SHA1
d5a86f3e051d8f5647861fc6d0b66f9be2a41980

SHA256
0ecddd0a18b9759f79bc014b121f4fb97cc2299b15fb00bb54117d1f5decde74

SHA512
aa88dab30faebfb2de590c2ca5d4e64507bac1e09693aac38249eaba24d8a41e0d510e7a24cf1709e6bfe32cacb9a9ca8b210fed28868e2efc02e37abe570c07

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-synch-l1-2-0.dll

Filesize
22KB

MD5
a9e2fc6fadadca47a3d67174d054cf1f

SHA1
2bfd066deb3cc84fd0cc0b6b13c1266c68bb33dc

SHA256
abd80237d43ce594f6ca781571085b25db7325cf7549c8d95302e302408a9954

SHA512
fa7e9d43c0e7f924f219c1b478a280cb53f3625d4479c92dd6ea1e9ca403d30d854068bfb7310b3fd44f1effae91d88087ef61b4649160516e9264b1e92dde76

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
22KB

MD5
d8ad62c97e8fd8c00959a8812a763f1d

SHA1
a32c26b69d2a7d900a0de544203aa0f0e225a51a

SHA256
52049f5431f10856708fd7c6ed42beadaae65ae3092c0aa56f79704f6d5ef963

SHA512
87ea1a72a271faae38444969d7e9995c3cd926e5d85562eb33c7d8186274b2df663dd5e31af8c6731d678ae463843f8797b8e586830bb45c1b6b7ef7a1de4b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-timezone-l1-1-0.dll

Filesize
22KB

MD5
1ee744ceca8da8dba0dc27f25125242c

SHA1
4c168b8673cfabbbbcf00195cf0db7b640a0289f

SHA256
c67dd8ed74c0a207c980caa6bb453e62180a71af175feeb42c2c926ecb911e0a

SHA512
d17b8f1419e3f77729c686d4fe79feb08368953e0997ef67217e829456e1c13dde5d9e7a0c35d117d1ae4d40f37e160cb6390b45242c0308d809dfdadb3155f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-core-util-l1-1-0.dll

Filesize
22KB

MD5
ab75ac7acd7344fb84904f78f7eaf8fb

SHA1
48fddb6e311e8041f15cef98538a8e5bf4ee1eef

SHA256
e5f86dc2e31f3d8133a9bb22ccc57ed93d2154aa28251c1c26a989e4624237d6

SHA512
2cdb373117ae71ee56ba51c45998926cc125311098fbafd467556c40ca4d594f953e01b4d6b4e006eabbf966dfc82bafee4d4c14cd84009fd5e4029a289464bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-conio-l1-1-0.dll

Filesize
22KB

MD5
4e9dd52db3106bd2c7d79c9d29e78f86

SHA1
88b0295fdda5b307be33853572d65d123a8dd8ea

SHA256
312415ce3f3333f09fc207a69768133253c50b3e167ba303923fb357905591b5

SHA512
138dc82cbd5575d41c361a6a1fbf021386f4302ae1d936ac247a86be2bb1249099abc36c0945cdfd91010110c0f367d88d51bdce721e44229446a4e705340f4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-convert-l1-1-0.dll

Filesize
26KB

MD5
c8ffbe7204e1fe53a396ad8c9c99e9bf

SHA1
8f08f205ca5003b79ce238d257a7a6ea2513b206

SHA256
32d3fbe9d4cd6c7f3adac383d5ca67b36d3c9b2e569b204d54ce0a27b317296d

SHA512
58bcfc777f39f54b141a8474a8e08692e53e41783aa9f168cc3858d5137cca601661bfdefb846618c7c8299c31078c8c7ef508b25bbac88d84898e36dd5d426c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-environment-l1-1-0.dll

Filesize
22KB

MD5
97d2bdc7b5daf5568f4333513b536adc

SHA1
c16ef9c9a40c4b4d79c019869e8838cc6db897c4

SHA256
cfb7bc2a80acbcc697e3e5d1f7ae43e069554b33ca944b0dffb8f631232cb05c

SHA512
86aea6582762002e3f19fcb4074de18c1f7a0fc9045b647dcde9a996c80085fdb12a47901a6c1cb6571077b32870ddd615425ad3eb6e5424863757743211bd87

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
22KB

MD5
d9e64b48ec7135200f1396e017d1351d

SHA1
65d0e077bb80da2a71c1d2aa5986f4233ab2f04f

SHA256
f66c1e092b1a96333245b18dbd7267d3e712b5cb7bb6c9fbe9de44d304582631

SHA512
51adfecc9ec6c03af264f73645a2f83614ac8b5c453d1fb64e2f32ba8ddb492189762a302ee317eba844776ba49acc27afb760469734672730cd1670251b1fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-heap-l1-1-0.dll

Filesize
22KB

MD5
1a70583c28fcae749bd262a34ee968c8

SHA1
5e4555f4f4250a7e8b336d25145795e597dd53e0

SHA256
be91f29c0def06c532d900c397ac7b79213f466e3c30cdb2231c7e08a9ee2baa

SHA512
7ddf949b913e2a4e079e303995aaa6b26d06ecb66499270fac3cc6578dc37e03671d8a069c8657f20ecea26e8dc106eaa8b13e045d2b5bceadf4f7bb899d0d30

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-locale-l1-1-0.dll

Filesize
22KB

MD5
4cee8303c0994cc97c0b426c719032bd

SHA1
d60d2a4efd2d1db5d3c9f64761ad6bd1802874cd

SHA256
7478756d70840c9bdfc3c38fec5667f309a70970e6d5af058a25e6d9efb2aef1

SHA512
eb13ecd1517e66f0d787d2fd6a88abc6d89d2d3392839d6cd5b277a52fb45dbc2fa4b849a0ee6c6d884d074ad2cdebd9f63511b08f8a746b5eb10978b8fbd646

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-math-l1-1-0.dll

Filesize
30KB

MD5
33d4c8d4f8598d32f25c4c78b681c3dc

SHA1
4f9b6b99640472531d1f6c11f030e043916cc6f7

SHA256
bef4d133abe009f50ce9d67f31acd963a1a77f41b0ba71b4707be8f45d974289

SHA512
b163e8d20e99288cc823a649396549671bd9be4dba323966f3567f10e357d90d9318f589c1f45995c332b8a491fd09655caad3a25676e0fda3bcd20e64a11a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-process-l1-1-0.dll

Filesize
22KB

MD5
9fdb0d60d5bc511c84f47d84da43a3ca

SHA1
806137977ad4b16b86e333c1453f01f8c3e49690

SHA256
d18f92bcb20f14c8888491e8c38246d97b5f138951dc8e4056c80c6ba5e0c5f2

SHA512
af00d5cee6e3c3ae70d0c35837222f74ab030da72899997cea71c9c1ff9fb3d611e6e6b2a8ca75d59ab4b7ce12382e1e11ffc7cfb1c4cff2eaa2ad7c81fbf5b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
26KB

MD5
b4076e1e955e3b9c33f03edb77b67b04

SHA1
fdc44cee07598ab865f8a7ba1e96ed32b87f6525

SHA256
009a2fbcd43b701177c02c779fa01ce7b7e8e9d8ed5db3e305880e086bbf2aa4

SHA512
85766b23f3e95f010734933eb45c61491b268efb0f13e86ddf9fc361a558588968c7884cda5865b717738044bca4f1f9c9295149f70b58b3809dfcd58ea43907

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
26KB

MD5
0c513371fb7e1345f2c7a8c737bdb938

SHA1
30a40972e250080b68614e4fe2a721a3cae177c1

SHA256
bf28630e9a216e6f29ef9df48689d8ed364684638c0aa54f09ab53e9367c4cc0

SHA512
43fc864273d0f29a4c0bf7439022dd776a52b721ad74d1f0ddd1f02e87556eb93821f04d72d353fc40a54ef51b19c8b42c41af17240809deb3c2e72121e6678c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-string-l1-1-0.dll

Filesize
26KB

MD5
e5341ed2725f0076968f08976d7cc32f

SHA1
88e2bf83e6f282b9d96cae288eb3a61d9a22694e

SHA256
5e8e44dc9d9166dd68ddc71af62714daa4106eac603638f83bfaeb316f8bc711

SHA512
d724add4cfa1189789d06f0cf036351d4d05763716dd6cdfa0a3f952cb1b1436c3cbdab1c8800ba06f98f5bbf0b90a3e0d93de6cac0052e15b86295320ff07e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-time-l1-1-0.dll

Filesize
22KB

MD5
731bb5b95efffade22fbe82b790afa73

SHA1
b31d46f7762f9af9b0b5a1b8c3449036a475faa3

SHA256
bbcc243488e48b4b77abdcddfa45264bb1311384284db3f5b432abe8c16a6ced

SHA512
cc77510ba367b1be7189b5362ce49925a749587cd3a81ceae0dd7cd6264fcbab8eb688475a7207e6d37b71d8b87fd0a616314597610d5d3eaa49ae9b4143c1b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\api-ms-win-crt-utility-l1-1-0.dll

Filesize
22KB

MD5
9dc2fccadf649a038ef9f4233c4f2a58

SHA1
1a97d6496240a567190cc816a9e7ff0da1056e4e

SHA256
32d55661717f9f7090c4220fa99d5cf3ed712372591935d12d4584eb44d354dc

SHA512
0829d14165ae112f2394a64f0200fa674e3c8708527ca4ec573982b0d049ac31f9147ce44564b0e12f9d4f704ce637a1990503106270d417f0aafc0c5ff5eb67

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\base_library.zip

Filesize
1.4MB

MD5
2f6d57bccf7f7735acb884a980410f6a

SHA1
93a6926887a08dc09cd92864cd82b2bec7b24ec5

SHA256
1b7d326bad406e96a4c83b5a49714819467e3174ed0a74f81c9ebd96d1dd40b3

SHA512
95bcfc66dbe7b6ad324bd2dc2258a3366a3594bfc50118ab37a2a204906109e42192fb10a91172b340cc28c12640513db268c854947fb9ed8426f214ff8889b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\faker\providers\job\es_MX\__init__.py

Filesize
83B

MD5
eeaa6ca5cb7f4bb1d7e75797f9b5af37

SHA1
0ac3743facacbc2090930b41cf38bcfe2951eb37

SHA256
ce99db30f577944104a7365372ea8363cd9d0087a6e9d88f7b835a1926da336c

SHA512
b492e6fa3eb607683a6c6f5696835aeae5e4c12fd2d44346bfd954d25c0bcf5bda808c175b0b17e26a0d5daf4f91d8588de119f5b747a80b3cfe53f68bbecd7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\libffi-8.dll

Filesize
38KB

MD5
0f8e4992ca92baaf54cc0b43aaccce21

SHA1
c7300975df267b1d6adcbac0ac93fd7b1ab49bd2

SHA256
eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a

SHA512
6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\python311.dll

Filesize
5.5MB

MD5
5a5dd7cad8028097842b0afef45bfbcf

SHA1
e247a2e460687c607253949c52ae2801ff35dc4a

SHA256
a811c7516f531f1515d10743ae78004dd627eba0dc2d3bc0d2e033b2722043ce

SHA512
e6268e4fad2ce3ef16b68298a57498e16f0262bf3531539ad013a66f72df471569f94c6fcc48154b7c3049a3ad15cbfcbb6345dacb4f4ed7d528c74d589c9858

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI8922\ucrtbase.dll

Filesize
1.1MB

MD5
28146c66076a266e93956111981cad4e

SHA1
44797bab4d3d3a8ccdb9df3a519cd3dbef838c31

SHA256
ed570898508c9d9186052157106b6dd9722bed47a27ecfeb424386c8970d81da

SHA512
078c8d6595b0afcee215a44ef9caa82f990ef2bf5dadb8fd84d83ac89839abeee1f9ce250e80b77cbbdde5d13688ed345da1f4bf22958490e645c074d2453f85

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 334567.crdownload

Filesize
11.8MB

MD5
5c12c277f20d7052d238170c0379de04

SHA1
fed7a3721abbcc987506a2b8b0057ab263e69877

SHA256
a267f536dccc5a1c4bceccdf6e25d9c363539e37de1f4d4f897df85cb83b6366

SHA512
bb606621a2ace658b6e7d2dfea4dc08a1ab80ff942f26312ccc04829fb5c72c6d46a2be732ee3688a826e93d6a0a908538026023aa6ce121b606d1a06f9ac0c4

Download Submit