Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://filetransfer...

windows10-2004-x64

10

Resubmissions

07-10-2024 02:05

241007-ch6dsstbkd 10

07-10-2024 02:02

241007-cf75lstakd 10

Analysis

  • max time kernel
    245s
  • max time network
    225s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-10-2024 02:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://filetransfer.io/data-package/n0Wqebxu#link

Score
10/10
discordratdefense_evasiondiscoverypersistenceprivilege_escalationratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIxMzU4NDcwMzAxNDA0MzczOA.G5gvU3.iXtPKXjmWkHoW5yr2PNn40t0ft_Fzq8gjWiFNI

  • server_id

    1287154116333666328

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion
  • Abuse Elevation Control Mechanism: Bypass User Account Control 1 TTPs 2 IoCs

    UAC Bypass Attempt via SilentCleanup Task.

    defense_evasionprivilege_escalation
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 43 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 26 IoCs
  • Modifies registry class 29 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:604
    • C:\Windows\system32\dwm.exe
      "dwm.exe"
      2⤵
        PID:336
      • C:\Windows\System32\dllhost.exe
        C:\Windows\System32\dllhost.exe /Processid:{cdd61acc-5d8b-4750-8b0a-c8f8ebbbabbe}
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5460
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3959055 /state1:0x41c64e6d
        2⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:2920
    • C:\Windows\system32\lsass.exe
      C:\Windows\system32\lsass.exe
      1⤵
        PID:680
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
        1⤵
          PID:964
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
          1⤵
            PID:1028
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
            1⤵
            • Indicator Removal: Clear Windows Event Logs
            PID:1128
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
            1⤵
            • Drops file in System32 directory
            PID:1152
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
            1⤵
              PID:1164
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
              1⤵
                PID:1172
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1260
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                1⤵
                  PID:1276
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                  1⤵
                    PID:1320
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                    1⤵
                      PID:1420
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1464
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                      1⤵
                        PID:1592
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                        1⤵
                          PID:1612
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                          1⤵
                            PID:1620
                          • C:\Windows\System32\svchost.exe
                            C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                            1⤵
                              PID:1736
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                              1⤵
                                PID:1760
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                1⤵
                                  PID:1900
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                  1⤵
                                    PID:1936
                                  • C:\Windows\System32\svchost.exe
                                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                    1⤵
                                    • Modifies Internet Explorer settings
                                    PID:1976
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x2f8 0x51c
                                      2⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5972
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                    1⤵
                                      PID:2012
                                    • C:\Windows\System32\svchost.exe
                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                      1⤵
                                        PID:2040
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                        1⤵
                                          PID:2064
                                        • C:\Windows\System32\svchost.exe
                                          C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                          1⤵
                                            PID:2120
                                          • C:\Windows\System32\spoolsv.exe
                                            C:\Windows\System32\spoolsv.exe
                                            1⤵
                                              PID:2204
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                              1⤵
                                                PID:2328
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                1⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2356
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                1⤵
                                                  PID:2600
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                  1⤵
                                                    PID:2608
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                    1⤵
                                                      PID:2716
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                      1⤵
                                                        PID:2764
                                                      • C:\Windows\sysmon.exe
                                                        C:\Windows\sysmon.exe
                                                        1⤵
                                                          PID:2792
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                          1⤵
                                                            PID:2820
                                                          • C:\Windows\system32\svchost.exe
                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                            1⤵
                                                              PID:2832
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                              1⤵
                                                                PID:2872
                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                1⤵
                                                                  PID:3028
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                  1⤵
                                                                    PID:3332
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                    1⤵
                                                                      PID:5088
                                                                    • C:\Windows\System32\svchost.exe
                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                      1⤵
                                                                        PID:5024
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                        1⤵
                                                                          PID:4436
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                          1⤵
                                                                            PID:2900
                                                                          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                            1⤵
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:1588
                                                                          • C:\Windows\system32\SppExtComObj.exe
                                                                            C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                            1⤵
                                                                              PID:4892
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                              1⤵
                                                                                PID:2020
                                                                              • C:\Windows\system32\DllHost.exe
                                                                                C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                1⤵
                                                                                  PID:1972
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                  1⤵
                                                                                    PID:1652
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filetransfer.io/data-package/n0Wqebxu#link
                                                                                    1⤵
                                                                                    • Enumerates system info in registry
                                                                                    • NTFS ADS
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3304
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff807f246f8,0x7ff807f24708,0x7ff807f24718
                                                                                      2⤵
                                                                                        PID:4548
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
                                                                                        2⤵
                                                                                          PID:1364
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                                                                                          2⤵
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          PID:3660
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
                                                                                          2⤵
                                                                                            PID:2584
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                                                                                            2⤵
                                                                                              PID:3120
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4056
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                                                                                                2⤵
                                                                                                  PID:1744
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
                                                                                                  2⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:2568
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5520 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:5084
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:3872
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5260 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:2412
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
                                                                                                        2⤵
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        PID:4036
                                                                                                      • C:\Users\Admin\Downloads\Bootstrapper.exe
                                                                                                        "C:\Users\Admin\Downloads\Bootstrapper.exe"
                                                                                                        2⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1604
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https:pornhub.com
                                                                                                          3⤵
                                                                                                            PID:5956
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff807f246f8,0x7ff807f24708,0x7ff807f24718
                                                                                                              4⤵
                                                                                                                PID:5976
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=gckR-PzCMZ8
                                                                                                              3⤵
                                                                                                                PID:3548
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff807f246f8,0x7ff807f24708,0x7ff807f24718
                                                                                                                  4⤵
                                                                                                                    PID:4484
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=SvNz_LdystA
                                                                                                                  3⤵
                                                                                                                    PID:1452
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff807f246f8,0x7ff807f24708,0x7ff807f24718
                                                                                                                      4⤵
                                                                                                                        PID:4200
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:3988
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:2664
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5140
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:5148
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4292 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:6040
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6736 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:3408
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:5484
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:2364
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:5784
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6996 /prefetch:8
                                                                                                                                      2⤵
                                                                                                                                        PID:920
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5916 /prefetch:2
                                                                                                                                        2⤵
                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                        PID:892
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:5572
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:5084
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7212 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:4952
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:4816
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16052510805286597042,10858684332723960429,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:424
                                                                                                                                              • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                1⤵
                                                                                                                                                  PID:2440
                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2412
                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3428
                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                      C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2536
                                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2464
                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2628
                                                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1656
                                                                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                                PID:3968
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1016
                                                                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3968
                                                                                                                                                                  • C:\Users\Admin\Downloads\Bootstrapper.exe
                                                                                                                                                                    "C:\Users\Admin\Downloads\Bootstrapper.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:5916
                                                                                                                                                                  • C:\Users\Admin\Downloads\Bootstrapper.exe
                                                                                                                                                                    "C:\Users\Admin\Downloads\Bootstrapper.exe"
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:4152
                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:5428
                                                                                                                                                                    • C:\Users\Admin\Downloads\Bootstrapper.exe
                                                                                                                                                                      "C:\Users\Admin\Downloads\Bootstrapper.exe"
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:5832
                                                                                                                                                                      • C:\Windows\SYSTEM32\SCHTASKS.exe
                                                                                                                                                                        "SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Abuse Elevation Control Mechanism: Bypass User Account Control
                                                                                                                                                                        PID:928
                                                                                                                                                                      • C:\Windows\SYSTEM32\SCHTASKS.exe
                                                                                                                                                                        "SCHTASKS.exe" /run /tn \Microsoft\Windows\DiskCleanup\SilentCleanup /I
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Abuse Elevation Control Mechanism: Bypass User Account Control
                                                                                                                                                                        PID:5304
                                                                                                                                                                    • C:\Users\Admin\Downloads\Bootstrapper.exe
                                                                                                                                                                      "C:\Users\Admin\Downloads\Bootstrapper.exe"
                                                                                                                                                                      1⤵
                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                      PID:1848
                                                                                                                                                                      • C:\Windows\System32\shutdown.exe
                                                                                                                                                                        "C:\Windows\System32\shutdown.exe" /L
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3232
                                                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                                                        \SystemRoot\System32\smss.exe 000000a4 00000088
                                                                                                                                                                        1⤵
                                                                                                                                                                        • Suspicious behavior: LoadsDriver
                                                                                                                                                                        PID:5832
                                                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                                                        \SystemRoot\System32\smss.exe 000000b8 00000088
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4548
                                                                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                                                                          \SystemRoot\System32\smss.exe 000000b0 00000088
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:3732
                                                                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                                                                            \SystemRoot\System32\smss.exe 00000214 00000088
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:3916
                                                                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                                                                              \SystemRoot\System32\smss.exe 00000220 00000088
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:2652
                                                                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                                                                \SystemRoot\System32\smss.exe 00000214 00000088
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:3556
                                                                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                                                                  \SystemRoot\System32\smss.exe 00000260 00000088
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:2920
                                                                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                                                                    \SystemRoot\System32\smss.exe 000003f8 00000088
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4200
                                                                                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                                                                                      \SystemRoot\System32\smss.exe 00000280 00000088
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:4020
                                                                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                                                                        \SystemRoot\System32\smss.exe 000001dc 00000088
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:2136
                                                                                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                                                                                          \SystemRoot\System32\smss.exe 00000228 00000088
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:3668
                                                                                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                                                                                            \SystemRoot\System32\smss.exe 00000200 00000088
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:2520
                                                                                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                                                                                              \SystemRoot\System32\smss.exe 000001d8 00000088
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:2540
                                                                                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                                                                                \SystemRoot\System32\smss.exe 000001a8 00000088
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:3388
                                                                                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                                                                                  \SystemRoot\System32\smss.exe 000001c8 00000088
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3232
                                                                                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                                                                                    \SystemRoot\System32\smss.exe 0000019c 00000088
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:1848
                                                                                                                                                                                                    • C:\Windows\System32\smss.exe
                                                                                                                                                                                                      \SystemRoot\System32\smss.exe 000001d8 00000088
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4152
                                                                                                                                                                                                      • C:\Windows\System32\smss.exe
                                                                                                                                                                                                        \SystemRoot\System32\smss.exe 00000160 00000088
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:4484
                                                                                                                                                                                                        • C:\Windows\System32\smss.exe
                                                                                                                                                                                                          \SystemRoot\System32\smss.exe 00000154 00000088
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:3660
                                                                                                                                                                                                          • C:\Windows\System32\smss.exe
                                                                                                                                                                                                            \SystemRoot\System32\smss.exe 00000008 00000088
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                            • C:\Windows\System32\smss.exe
                                                                                                                                                                                                              \SystemRoot\System32\smss.exe 000000a8 00000088
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:4816
                                                                                                                                                                                                              • C:\Windows\System32\smss.exe
                                                                                                                                                                                                                \SystemRoot\System32\smss.exe 0000010c 00000088
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:5976
                                                                                                                                                                                                                • C:\Windows\System32\smss.exe
                                                                                                                                                                                                                  \SystemRoot\System32\smss.exe 00000150 00000088
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:424
                                                                                                                                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                                                                                                                                    \SystemRoot\System32\smss.exe 00000140 00000088
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:1604

                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      152B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      53bc70ecb115bdbabe67620c416fe9b3

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      152B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      e765f3d75e6b0e4a7119c8b14d47d8da

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      cc9f7c7826c2e1a129e7d98884926076c3714fc0

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      20KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      9a95465d3764f96b7999c7c0f30f87a6

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      5d2f08cb28acc8716afc6406beec43120b5737df

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      425485dac92e5a7f24fbe3c728977bb245cd9425ddfcfe51352eebbd8bd2c0fb

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      e80de30197ce9460abac1f3831a85da660aa382afbebd41524b448dc0e092c0270e5758c6b5e67992d3129ac6e3bf55f5a01316c0515b241a4aa88044af59913

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      de13712e957fa9209f1be5edfa7777d1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      3c9c700f244bf33ea5b2f125ae5e2aebb428936a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      cf2750a02163dcd679adfb9916a44be0df08fe03116b2044d4edd0e36807f287

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      52728e3b6bc6303fc590a14581fb0fb7566db406e6788b6c2d91590f66f9adb6f4c8306fb49f0678e75b2633368ff8b1baa7455d3b349f2ea3cc6eb02e5b754c

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      502a83ec331e08ba0768dc7899f78563

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      06d8141dfb2059a32e71571bbdb7d1cc14592239

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8cd17852bdaf74392841a407ee05f95ee271ea10891de53bfcbd9cb727511869

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      945531e28bf49036ce9158ccb0709ca415afb22ea9b17a722174d80dc54f57d479eb222a7ca6f00fc84cda55f61a918b366d7c04c650021f7e7f87fc5b425c17

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      216B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      85639c2bd020e0337f28d87f429e0441

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f94ef5d9229c39f23e4f83dd1d326b276f7ae506

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0a151e7e5096f163216836390df13e0528de49ded68ec1c9c5681fe07506739b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5e3c668b494bf2aa7385019c3e083bd93af7c3669eead67ad26a4c39ae8ea6316fee7ab350714f094d062506fd49b45a373473afb21d2594cfebded8180a1fd2

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      16B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      db30f4cdc1149065ba2d2edb41b222cf

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      6e7014224614e9f6ee07570e6ae701ae28cd4bbf

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      46221c0cb15bbec3fb5e65662076d5109b314dff8490282763f22a74a228a6a9

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      188660d344f109c19751139a857c198b5c4e3e92a873bb7d40450330b69ce14e4ce09034cb356c3b4fd0d993691d5e19bc56621b22c62d478596f0f09a06fa2f

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f46c5a60c5b331a506fe135e2123bb22

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      10a39bd47dc57f266fd15d64f6a76f09ef3d7106

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      48da8b41bf5cb0845e5aededc480d0431c6b0da3271bfd6122c6a52ea241b945

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c8ec168c3435520c12476696a4fe951170a5872f708cc46cda7f1e12981a63eecd246663c3a7f6793009b0bb50b29831cbf24f90a47424ba966e8aee92f1cfe3

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      46a647a83a0e193a8fca630b57209b39

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      35ac224f7e9108afb1b825815cb3a560c3e5238b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      48b5e6936a6fc3beff8247ab39a0acd4d00502360a663bec31cab17b63877c5d

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      87c48700e178501e6f7686942083edc5eaa67c7ed271d55a48baeca3c0bb3b182fe531d93dedc0381156169a6708344f5da0c1437ae273c2fa95e070c9f806d1

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      bc682446fcc3140dc91747d56de40a53

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      111d87fc117403539d8fb17de272b98d7d18ac8a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b63321593d62d4ee7d10c28e69a265401e299022239a0ebe0828ff839ef382e0

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      502feffa28827d72b61d61d8aedbdf647937d71a0453e0fe340074052ef7840e46b4a79d98f2f18460d39988c6346d25074f72e478d640e48ae7ca07cc2ac3ca

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      7KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      6733bd33371df434fe7d8d93af07e61c

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      58764a5606411de68df6b1f0a6275d5f21dc45c3

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0e531f6cd13201a88d1f88478667d19881ea8b9e335dceea4209ff7f16193f7d

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      3730d51fd4a9e1c859a8be30c99250066d46c0195e3ced24845de0a5dc7f293a011413f106e38d316a02ed1db127dd5cf4ba363f14f65dd092940392a4a5dc58

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f199de899fe307e20c77078619ca9df5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      cb917783b64d56cd4b8c7a5f45e5d61d1ec79c36

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      de402c15732ccf33d62e2d2bb41d6d2ccd53abac7d8300cf11151eeda0055ca5

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      31a95532629dc9c5a3139d9b51fc6710cc659c1cb705de0b548c623fcb6d747e3e8bcb167e5b7aed8a46cab1ca77cfaadb74c1f4cbb308277bb1244af68169b5

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      8KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      2b22458f5915922b8f7c23acdc6d9b5e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      31f3050c64d5b2569671fd82c691116ea3817f72

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      9199776673138a8c8ef096af2e3bc8925d2f4168d3abb6c5bd8b6cb26fae048a

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      e37bd781245473ae4db999f7525df6fff60746b53c4aadeeed4c56379fc84c1dba25039b1d537929d64354a6e8fc28231759ef145b81c0e6ca2206a2b82fcba8

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      00efa34101734d40a3110c03b2f1d4f5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b17bc8072a840448d236cf823f08a93c38fa7d70

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      e9518bea53f34520d92693ed3f2258ca2a9d7185ea4afb129dc2abe8501b604a

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2d8bcb914893530b2e5197e248d502e79dbdfc4772cf68ae640e819fe5c72bf587074422f771db0ca19ac0977d4b0c78f488a2dff7feb6663b29dd563b7689ee

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\806583ab-7f79-47a6-82ab-3ee292678d0f\index-dir\the-real-index
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      236d49854e91e9e650b57fdbc0cdc64a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      8ad8b694fa34227dbbb9a1794619a72833cfcd58

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      1056dd2a613698ddf0b51b47004e05cff526f2a8e9c95fecf49753a78a482a98

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      82805b30a65f9a622156c36153372784a9f3872eab80ab2795f8afe702c4a18698a48566a84a771f8adf8596568e12069bb946b195103712ce24658931ee8d76

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\806583ab-7f79-47a6-82ab-3ee292678d0f\index-dir\the-real-index
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      c5dc457736a30ba6bb708aaeb7cfda3a

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      46e501c5d27a7da9d4cbef516a089aae090150f0

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      43b100cb653f142b91f82c1d6023de78dafc7d1632dc47f9a712a0256d95217c

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      7a1b439059258368107b42f200234a76a654bddb711ce64e8594692e6592de2454c943e4f03fe1c952e6103ed706dab9b42fb53495db8c9bf66aecd3ae4b9f1e

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\806583ab-7f79-47a6-82ab-3ee292678d0f\index-dir\the-real-index~RFe5962d7.TMP
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      48B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0ad56edaa06506abb562d69829a03977

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      0f196ba46b2b79c46b9513744debb950f4e9b021

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      3232f22f96f6d909c6628f5b1c4e85126d7015379237e43a57ac5fc6c40f9b72

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      fa1416355302ec7fb73059f17f2029985706695e7f77f41865e69d1c46c0308a287894bb47d40b664c3bad927eaf1c4c8cf6fa2c2586566af6b7c4fd2377043b

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      84B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      cae7eb1978ca85e381ea0ee44b859578

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b9d55d8a9459d6c7411464e3d5c321ff2f9514eb

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      ecb933598eac1a8d0bc3e422ebc5bd99bc164c83fbd9372e1c8ca44095e6171d

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      39aade7334eb08b6132a60fd3ad10aed5da444ad386caca992f8232da29c310d5cd1a15b3581a82b40a1c1332a324f69a0b35a1a8ff2528576975796e939abe0

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      89B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      a833dd14c9c44446a69e3e5f158dd985

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      24fb115033c143ea11d385d8930072519568d5a8

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      97f827d75bd60ad243094e462ae7828930edbb2f5fee11e584e4690bc2236236

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      89dbf69cd73da86bb094f36ab5f7d205ffc1cd060d4b3371e7e6da8a720a395dd8b4b3f07c0b809255cc791a9756c37d00e83141fafd939ca7b9ef8abecedbf9

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      146B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      14fa919e62971265c71f01928dd11b74

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      26416e8a10ff8d4c239ddf906028dfb900597af2

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6efbb62eb94736089a261a60def42e420b9e40ffa455434dd0a8e608e2bd83ce

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      fdca0c321ed791b247cd5c4849ee32cb36501d8cd69b7ddbaf354e00a6114e7318c378f995f9d77aefd64321d6bd36b22b48e43b42f44dbe2906622fb27d1a55

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      148B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      54a0d804265e4a588ec1f5c127a23ed5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b2d1c26db5fc9baec31208fc99f62cceef2961b0

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      4b05aa88b0bfd6ab9aef5afdef533c3901bad4665c96dc7a1e13e28f429b038e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c63f2147d04f9dc8836ae77a7982196eb6ab719acadfc16112c3609882afb15b2da5b69ecffb12441a0114e17df8ebfcece9ccf8564a38afae02400e15fe8725

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      84B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      777ad9bf25b36d90ab724b9abe72f395

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f934a3a0af13c414a44ad1c15b7d724c455d3dfd

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      2061c8fa06f192eef8b269f7af0e6b98878741445012db9a410bd82d7b237029

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      cf35a29e3b05d457beeb4ae4261fcb7223c21068f30982f0a3dbdbd456b8c78081ecfe8fb055f85e09db7836960a90ab97c3aab894e68d6a6b5ebe51dac6e065

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      82B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      289491fd139a6690f2486a42ba0f2df7

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      70a931fe5e7a337c92b1599660fcaab47faae68a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      7237c2f0ac645e3ff06c3553c7b3947362fb1a382ca1f80adefdeb505b6d484d

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      166249783c0a2d745ab83f454af6b02a2a50511f67aa75a0478604785ce3b761fb6e72f35bc4e94cbab6f3ef529052b6c44e5f4c193bd83a26af85f2ebbb3b00

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      120B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      00adf9caa9534a1d2243c68744c1fca8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      2a0f15af975e86317808775afb24393f19d66d17

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      cad419994dcc41b32f3c2be0ffb56faec1bcf07295020d672dc7fca83ef39526

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d8967c600a749bc480e38a3f5fcbd9bace08259eaad1a760dd619c17e18dbbd8074879d0d901a0b504ed4673a22c2807a2378dd09693ae92b649d9b34459dd64

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5958d4.TMP
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      48B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      a4298971fcf44d94b93e7b5cdd6002b5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b2a111e67d2caceea06cc9c04b6a06e7ed07c42a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      52e5420971263a2881b7b38dd192433dde57e98fa0bf00489add71d9c11a4b05

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      073a7032c9baa4325b31476652fe579aae0b3160f23ad681e5beac8ade8f71af500fc7c3a65a4842024c8441d15c0bacd8ac714c416d3acf307a90269915d247

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      409bca8478d44bfe686874f0e2fdc8ae

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      3fed7325d91f6b5c6cb9aec906103ecf7fea15a0

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      1945274b9785587f267f38dbae739a61907a29c844074612bc4ab2b25f693cc9

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      e0c9e7f856220cd74dac4f2ba819722689525539b90bcf1422c5fd2c3c6e5f5334e5fcfe90ca35c8e549d42613286899128711d40e33220f233b966e79027ceb

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      871B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      e6fd3ccd0eea21b9c6b055f4732117aa

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c99b84faa7c494fdd8e7b2d787e8ce6b6f96e45b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8ef1f88b0df2f94c62060baacb2aaf96b0670a746d60eb60eab4cce75da3dd5f

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d5ed831c7356314589a0d38c85a8257231d43c37c830e304f964a46497ffa4b299df3566a5da0101460ef9f3a4f9adf985b9b1e397a508f3552a680c4866c9d4

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      dc4e9a109ee59dd0671057d714a32be5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f9e53a4e0c1a326aed231d40c0b19d26bc360e23

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      d2c1ead0b82ed032f0da16d25cb3d128d266d73b5524af2f0ebd49369b89fe9e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d5b74f0a8cb5ce8cdd5608cff9ff82e8aaaba44826c45adac83e440e3875679e5438a456fec83f5c8eb6405dfb2fa442cef379ffd109fbea80a8509e17109cd6

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e589.TMP
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      537B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      912ab1b8a9fe5c3b5f5dd29b5b2fadb7

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c49b10c2fa0b22f8beb1e01c76899a2c83eb405b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      84a16d51293af9b5abbcfaed48daafcaa33aae352fe6e248f01cfb890a3f81a7

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1768b7769bb40244e71763feed85c88551bbfd8d18296c6e2d286b05ed826cd44b3839316bbfafa6114cf3392b372946fdfccd742dcc5d06319de9f25070bae8

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      16B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      10KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      bb9308dfe22aecdcd648e96ce5444db9

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c478154ad463e1964c0894495f3a689748d7da0f

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      7a65fd5feab899381d11cfd9063997aa232c023f3d81eadd34631400246f1d62

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      ef17e733e63ed053a201c78bd60e7753061b86abd27bcda13b79ff2748daff5856917f10465171aee9daec00beeed952f3f40481e8c51dd61d436cf2e5c3826e

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      10KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      68eec76d07e757de4cfb20008fab8127

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      dc45c32dbd76f065b8b3fe499e21544deda30c4d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      58367e3c843fb2363df268c693b2478884c9193b48ccb3d471e87775bf84f1ee

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      09d6e11fd301f2d035ccc384aa9c8bdd95b2dbd5789665e17cca3964d9de7afa3a82832c55bf0cf19642e4b157f000ce504be83812218ddb42954447fdf487fb

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      11KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      e83f423c67c3a202a7d86d18c757e0d8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      e0b683e31ae8130cb0e64f310b014cdc8ea829d0

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b3e85ca8eff5a2ac05ad7d1564b759d13765599c11b2d8d916a681e3d1888ead

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      8a919d5a584309d5a21bf1c8360502e4a5890b36b519d3ca9ceb9df24bebc05e8a6839b035688e49cc0581a52dd02b14c2d932cc8e8e4a2c6fafe91577af24f3

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Users\Admin\Downloads\Bootstrapper.exe
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      78KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      46727b830b6d2ea38b9671b06bfb3c13

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c8951d6ec375a514415e12e7b62003282a92ec44

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      ea8e0e60212fd393b332441e4adab70e386865240fa913d7a4f0d7589da643b8

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      10dd8bdecb7d50495e68bba9fb4a070ec4cbaabb771458ac7fb042cc646b93f08b956724e1b6a8f432a8fa27b6634cd22593aa72f12c012ba9fe1350ee7bf787

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f313c5b4f95605026428425586317353

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      06be66fa06e1cffc54459c38d3d258f46669d01a

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a3879621f9493414d497ea6d70fbf17e283d5c08

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      7d612892b20e70250dbd00d0cdd4f09b

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1e8e2076314d54dd72e7ee09ff8a52ab

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      5fd0a67671430f66237f483eef39ff599b892272

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0b990e24f1e839462c0ac35fef1d119e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                                                                                                                                                                                                      Download Submit

                                                                                                                                                                                                                    • memory/336-970-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/336-969-0x0000024CD45E0000-0x0000024CD460A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/604-959-0x000002791DE70000-0x000002791DE93000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      140KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/604-960-0x000002791DEA0000-0x000002791DECA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/604-961-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/680-964-0x0000017796430000-0x000001779645A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/680-965-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/964-972-0x0000018864DA0000-0x0000018864DCA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/964-973-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1028-981-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1028-980-0x000001DC0E730000-0x000001DC0E75A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1128-984-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1128-983-0x00000202AE180000-0x00000202AE1AA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1152-986-0x00000210FFF60000-0x00000210FFF8A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1152-987-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1164-990-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1164-989-0x0000023277510000-0x000002327753A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1172-993-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1172-992-0x000001D954D30000-0x000001D954D5A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1260-997-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1260-996-0x000001B6C56B0000-0x000001B6C56DA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1276-1008-0x0000021DDB990000-0x0000021DDB9BA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1276-1009-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1320-1012-0x00007FF7D6E50000-0x00007FF7D6E60000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      64KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1320-1011-0x000001F17F660000-0x000001F17F68A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1420-1014-0x0000026795D60000-0x0000026795D8A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      168KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1604-106-0x0000023951D50000-0x0000023951D68000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      96KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1604-120-0x00000239521D0000-0x00000239521DE000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      56KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1604-108-0x000002396CC40000-0x000002396D168000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.2MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/1604-107-0x000002396C440000-0x000002396C602000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1.8MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/5460-956-0x00007FF8166E0000-0x00007FF81679E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      760KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/5460-957-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      256KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/5460-954-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      256KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/5460-955-0x00007FF816DD0000-0x00007FF816FC5000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/5460-953-0x0000000140000000-0x0000000140040000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      256KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/5832-952-0x00007FF8166E0000-0x00007FF81679E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      760KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/5832-950-0x00000270FA3E0000-0x00000270FA41E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      248KB

                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                    • memory/5832-951-0x00007FF816DD0000-0x00007FF816FC5000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      Download