Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    269s
  • max time network
    271s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/11/2024, 19:39

General

  • Target

    https://fullcrypters.net/luxury-shield-crypter-7-1-cracked/

Malware Config

Extracted

Family

xworm

Version

3.1

C2

society-painted.at.ply.gg:17251

Attributes
  • Install_directory

    %Public%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot5817418329:AAGYtFww9eAGl3ZTuqrCmSNxu_TJJiAWkzA/sendMessage?chat_id=1860651440

Signatures

  • Detect Xworm Payload 2 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 33 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 42 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://fullcrypters.net/luxury-shield-crypter-7-1-cracked/
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe66e046f8,0x7ffe66e04708,0x7ffe66e04718
      2⤵
        PID:3412
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
        2⤵
          PID:4720
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2456 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1036
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
          2⤵
            PID:3188
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
            2⤵
              PID:948
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
              2⤵
                PID:880
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
                2⤵
                  PID:3828
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5028 /prefetch:8
                  2⤵
                    PID:2372
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
                    2⤵
                      PID:4052
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
                      2⤵
                        PID:2560
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
                        2⤵
                          PID:1808
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6392 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:5252
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                          2⤵
                            PID:5384
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
                            2⤵
                              PID:5392
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
                              2⤵
                                PID:5572
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
                                2⤵
                                  PID:5580
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                                  2⤵
                                    PID:5848
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
                                    2⤵
                                      PID:5488
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3032 /prefetch:1
                                      2⤵
                                        PID:5220
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6928 /prefetch:1
                                        2⤵
                                          PID:4400
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1176 /prefetch:1
                                          2⤵
                                            PID:2964
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
                                            2⤵
                                              PID:4284
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
                                              2⤵
                                                PID:5900
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
                                                2⤵
                                                  PID:5984
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6872 /prefetch:1
                                                  2⤵
                                                    PID:6112
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
                                                    2⤵
                                                      PID:5468
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
                                                      2⤵
                                                        PID:5896
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7388 /prefetch:8
                                                        2⤵
                                                          PID:6008
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:1
                                                          2⤵
                                                            PID:6012
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
                                                            2⤵
                                                              PID:5872
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:1
                                                              2⤵
                                                                PID:4236
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7860 /prefetch:1
                                                                2⤵
                                                                  PID:812
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8084 /prefetch:1
                                                                  2⤵
                                                                    PID:5812
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
                                                                    2⤵
                                                                      PID:5496
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8520 /prefetch:1
                                                                      2⤵
                                                                        PID:4056
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:1
                                                                        2⤵
                                                                          PID:5920
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7700 /prefetch:1
                                                                          2⤵
                                                                            PID:4400
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
                                                                            2⤵
                                                                              PID:4012
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:1
                                                                              2⤵
                                                                                PID:2500
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6768 /prefetch:8
                                                                                2⤵
                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                PID:4940
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8560 /prefetch:1
                                                                                2⤵
                                                                                  PID:2028
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8604 /prefetch:1
                                                                                  2⤵
                                                                                    PID:5336
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8480 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2340
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:1
                                                                                      2⤵
                                                                                        PID:3572
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7732 /prefetch:1
                                                                                        2⤵
                                                                                          PID:5492
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5996 /prefetch:8
                                                                                          2⤵
                                                                                            PID:3084
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:8
                                                                                            2⤵
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:2260
                                                                                          • C:\Users\Admin\Downloads\winrar-x64-701.exe
                                                                                            "C:\Users\Admin\Downloads\winrar-x64-701.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:6084
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7952 /prefetch:1
                                                                                            2⤵
                                                                                              PID:5336
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8416 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4940
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5412
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 /prefetch:2
                                                                                                  2⤵
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:1628
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:2524
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8364 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2408
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8420 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:4256
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7500 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:5272
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8432 /prefetch:8
                                                                                                          2⤵
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:5384
                                                                                                        • C:\Users\Admin\Downloads\winrar-x64-701 (1).exe
                                                                                                          "C:\Users\Admin\Downloads\winrar-x64-701 (1).exe"
                                                                                                          2⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:5732
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2056,2487818287328325742,17195783913257411048,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6332 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:2136
                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:3920
                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:4256
                                                                                                            • C:\Windows\System32\CompPkgSrv.exe
                                                                                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                              1⤵
                                                                                                                PID:2764
                                                                                                              • C:\Windows\system32\AUDIODG.EXE
                                                                                                                C:\Windows\system32\AUDIODG.EXE 0x474 0x2f4
                                                                                                                1⤵
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1900
                                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                1⤵
                                                                                                                  PID:5536
                                                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                  1⤵
                                                                                                                  • Modifies registry class
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:3260
                                                                                                                • C:\Users\Admin\Downloads\winrar-x64-701 (1).exe
                                                                                                                  "C:\Users\Admin\Downloads\winrar-x64-701 (1).exe"
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:5140
                                                                                                                • C:\Program Files\7-Zip\7zG.exe
                                                                                                                  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Luxury_Shield_7.1\" -ad -an -ai#7zMap12970:96:7zEvent32532
                                                                                                                  1⤵
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:2028
                                                                                                                • C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
                                                                                                                  "C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
                                                                                                                  1⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:6080
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
                                                                                                                    2⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:3452
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:5532
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
                                                                                                                    2⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:4688
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
                                                                                                                    2⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Drops startup file
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Adds Run key to start application
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:6020
                                                                                                                    • C:\Windows\System32\schtasks.exe
                                                                                                                      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "WinRAR" /tr "C:\Users\Public\WinRAR.exe"
                                                                                                                      3⤵
                                                                                                                      • Scheduled Task/Job: Scheduled Task
                                                                                                                      PID:4216
                                                                                                                • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Pass to use.txt
                                                                                                                  1⤵
                                                                                                                  • Opens file in notepad (likely ransom note)
                                                                                                                  PID:5004
                                                                                                                • C:\Users\Public\WinRAR.exe
                                                                                                                  C:\Users\Public\WinRAR.exe
                                                                                                                  1⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:1916
                                                                                                                • C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe
                                                                                                                  "C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe"
                                                                                                                  1⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  PID:4940
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe'
                                                                                                                    2⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1960
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:2492
                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WinRAR.exe'
                                                                                                                    2⤵
                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:1992
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WinRAR.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\WinRAR.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    PID:2104

                                                                                                                Network

                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                Replay Monitor

                                                                                                                Loading Replay Monitor...

                                                                                                                Downloads

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                  Filesize

                                                                                                                  152B

                                                                                                                  MD5

                                                                                                                  8749e21d9d0a17dac32d5aa2027f7a75

                                                                                                                  SHA1

                                                                                                                  a5d555f8b035c7938a4a864e89218c0402ab7cde

                                                                                                                  SHA256

                                                                                                                  915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

                                                                                                                  SHA512

                                                                                                                  c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                  Filesize

                                                                                                                  152B

                                                                                                                  MD5

                                                                                                                  34d2c4f40f47672ecdf6f66fea242f4a

                                                                                                                  SHA1

                                                                                                                  4bcad62542aeb44cae38a907d8b5a8604115ada2

                                                                                                                  SHA256

                                                                                                                  b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

                                                                                                                  SHA512

                                                                                                                  50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                                                                  Filesize

                                                                                                                  215KB

                                                                                                                  MD5

                                                                                                                  e579aca9a74ae76669750d8879e16bf3

                                                                                                                  SHA1

                                                                                                                  0b8f462b46ec2b2dbaa728bea79d611411bae752

                                                                                                                  SHA256

                                                                                                                  6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

                                                                                                                  SHA512

                                                                                                                  df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

                                                                                                                  Filesize

                                                                                                                  19KB

                                                                                                                  MD5

                                                                                                                  cc91acbdb8796cb031d0f8396b732e58

                                                                                                                  SHA1

                                                                                                                  93532092d02442069fd178f72f892e868cba20ca

                                                                                                                  SHA256

                                                                                                                  1166a5fc3b78ca97563dde576fe8ce70d829bb25e6549516c779c49a6c929d87

                                                                                                                  SHA512

                                                                                                                  f0ad89cbf331540e1246738dd8d56cf0b1eb6b1c43572d89b217f2caa1c8f2fa50569c290c2ef7e3e5a9c0d813bcb8243eb5012c0642ec64602770196d22b849

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

                                                                                                                  Filesize

                                                                                                                  133KB

                                                                                                                  MD5

                                                                                                                  cb88b6b74e3a36d37c3fcb6a6b2ecf01

                                                                                                                  SHA1

                                                                                                                  e4c0dca86a19ced6587d9922c682de1b6e81e338

                                                                                                                  SHA256

                                                                                                                  c446508fa8bf9d9bf0c8d050d278dc35fe4c48994fb6111526f9c2ab8f7d40e6

                                                                                                                  SHA512

                                                                                                                  21d5ff45e9165a6c206ed89df55d32e0df621b6b7d939cc4a11c9b82fa94b69a5bd42292bbb57bb58047c7022a0c011354a88b8276a5949c8e4cea3820198f1b

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

                                                                                                                  Filesize

                                                                                                                  78KB

                                                                                                                  MD5

                                                                                                                  6dceccec342d25e89c396ba0c9eec1bf

                                                                                                                  SHA1

                                                                                                                  f15ed7630eaf035a9ef0f6405ff39f04b062c68c

                                                                                                                  SHA256

                                                                                                                  1d6c31c21aab7bf215853cf6e5fcfd1c58da3316e927004f4816c3aa0f3c22ef

                                                                                                                  SHA512

                                                                                                                  ce85e85c69b710b833940207eeb883232d2b2aa92b0ca43ff33178f4ee191af78abe081f8bf61ce6c7f8b1dca4b2d5610bb0410ddabb426bac8fc9631ad3a4a2

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

                                                                                                                  Filesize

                                                                                                                  83KB

                                                                                                                  MD5

                                                                                                                  df016c4465c42265b40806ec28b4badf

                                                                                                                  SHA1

                                                                                                                  088dc704e5edd580c3fc4c01ffabf2521f83f9b7

                                                                                                                  SHA256

                                                                                                                  13189bdec9d59abeac1c9ac27376f2384571ef85bbe022746a16004a87d17bd1

                                                                                                                  SHA512

                                                                                                                  be7a58b7b03029bd67678c11ebdd3112ea0a201fdfc130f809bce23fa92982e6ec3cf05eb35fdb6f6a10d853e3f3123184eb5b56dd91be36f3f0c0d87b6e4a17

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

                                                                                                                  Filesize

                                                                                                                  20KB

                                                                                                                  MD5

                                                                                                                  87e8230a9ca3f0c5ccfa56f70276e2f2

                                                                                                                  SHA1

                                                                                                                  eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

                                                                                                                  SHA256

                                                                                                                  e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

                                                                                                                  SHA512

                                                                                                                  37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

                                                                                                                  Filesize

                                                                                                                  29KB

                                                                                                                  MD5

                                                                                                                  79ffcf947dd8385536d2cfcdd8fcce04

                                                                                                                  SHA1

                                                                                                                  a9a43ccbbb01d15a39fac57fa05290835d81468a

                                                                                                                  SHA256

                                                                                                                  ffc11b830ad653e7a9d4257c7cd7a8056db5e7d7e89439b8fd67d1207b1729bf

                                                                                                                  SHA512

                                                                                                                  3dc82ecb2abc8c567434666a9162cc188de669927c3dada6392d8bd97d5e746f1ed350e1a02ec016ee2b1dc8a9cc5c71c553f2ef1293d6793800c276560859a6

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

                                                                                                                  Filesize

                                                                                                                  108KB

                                                                                                                  MD5

                                                                                                                  ef9915d62e51d7e28dd154e6cf5a71d0

                                                                                                                  SHA1

                                                                                                                  57ce6106eda6f750da8f093ca1075d3823252524

                                                                                                                  SHA256

                                                                                                                  c4bb186261e8796042a76ed20902c788f547cf4e3ae7f24aba56f43baf6ce752

                                                                                                                  SHA512

                                                                                                                  52445e459dd13bbca3523b4fd811400e9fa7d9a4921c08f696d2701f97173957c9c12eeac6fa93c41450a5e2ce938202413851813a6c5c3b8ca6cd4d3d948d0b

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

                                                                                                                  Filesize

                                                                                                                  52KB

                                                                                                                  MD5

                                                                                                                  7e003b440d22ba70ed8016eab73eaaa1

                                                                                                                  SHA1

                                                                                                                  d6b2909a5d3491f74982db9ee8c52290ec30ecde

                                                                                                                  SHA256

                                                                                                                  2f29e315f59c096e8126597544637bb2e12936e696493ae52c85654f12e8f185

                                                                                                                  SHA512

                                                                                                                  f6023bddcf92e0238800fd0853ac6a716566326506ec59c92f5bd854acd697e9884840ab1488c7a08a2c6472ad119b07da6d0f01bb61f69017bd920e2b8b9047

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

                                                                                                                  Filesize

                                                                                                                  68KB

                                                                                                                  MD5

                                                                                                                  dee46781c0389eada0ac9faa177539b6

                                                                                                                  SHA1

                                                                                                                  d7641e3d25ac7ac66c2ea72ac7df77b242c909d3

                                                                                                                  SHA256

                                                                                                                  35f13cf2aef17a352007ab69222724397e0ec093871ff4bd162645f466425642

                                                                                                                  SHA512

                                                                                                                  049b3d8dcfb64510745c2d5f9e8046747337b1c19d4b2714835cc200dc4ba61acaa994fec7c3cd122ba99d688be6e08f97eb642745561d75b410a5589c304d7d

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

                                                                                                                  Filesize

                                                                                                                  62KB

                                                                                                                  MD5

                                                                                                                  6b04ab52540bdc8a646d6e42255a6c4b

                                                                                                                  SHA1

                                                                                                                  4cdfc59b5b62dafa3b20d23a165716b5218aa646

                                                                                                                  SHA256

                                                                                                                  33353d2328ea91f6abf5fb5c5f3899853dcc724a993b9086cab92d880da99f4d

                                                                                                                  SHA512

                                                                                                                  4f3b417c77c65936486388b618a7c047c84fb2e2dd8a470f7fe4ffec1ad6699d02fa9c1bbd551414eef0f2e6747a9ee59ca87198b20f9f4a9a01394ae69fa730

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000035

                                                                                                                  Filesize

                                                                                                                  31KB

                                                                                                                  MD5

                                                                                                                  c03ff64e7985603de96e7f84ec7dd438

                                                                                                                  SHA1

                                                                                                                  dfc067c6cb07b81281561fdfe995aca09c18d0e9

                                                                                                                  SHA256

                                                                                                                  0db8e9f0a185bd5dd2ec4259db0a0e89363afa953069f5238a0537671de6f526

                                                                                                                  SHA512

                                                                                                                  bb0fd94c5a8944a99f792f336bb8a840f23f6f0f1cb9661b156511a9984f0bb6c96baf05b7c1cf0efb83f43a224ecea52740432e3cfc85e0799428765eefb692

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

                                                                                                                  Filesize

                                                                                                                  20KB

                                                                                                                  MD5

                                                                                                                  bec2af13143a7771b0b89cec2ab92b27

                                                                                                                  SHA1

                                                                                                                  9cd25b2c17a630fd0d6dae4aa80ea510ef4b89b2

                                                                                                                  SHA256

                                                                                                                  52aa9c3bdb64b5d1c1fe6dbf456fc50da434916b6c7489f3c64a0ea9253408ab

                                                                                                                  SHA512

                                                                                                                  42d00250350982b0d3f26b84f33cc1365c8ab57f830f2f859cf3cdc8ba2879c09249264b1177c4b85de6a2461efe06620668c8d5bb036fde0b0030fa246075b6

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005c

                                                                                                                  Filesize

                                                                                                                  64KB

                                                                                                                  MD5

                                                                                                                  d6b36c7d4b06f140f860ddc91a4c659c

                                                                                                                  SHA1

                                                                                                                  ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                                                                  SHA256

                                                                                                                  34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                                                                  SHA512

                                                                                                                  2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005d

                                                                                                                  Filesize

                                                                                                                  67KB

                                                                                                                  MD5

                                                                                                                  fb2f02c107cee2b4f2286d528d23b94e

                                                                                                                  SHA1

                                                                                                                  d76d6b684b7cfbe340e61734a7c197cc672b1af3

                                                                                                                  SHA256

                                                                                                                  925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

                                                                                                                  SHA512

                                                                                                                  be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

                                                                                                                  Filesize

                                                                                                                  33KB

                                                                                                                  MD5

                                                                                                                  e4fb9b839186660b1f729b8df8c994b4

                                                                                                                  SHA1

                                                                                                                  931792cd70ced4ad586f6329c30c294ebea1548e

                                                                                                                  SHA256

                                                                                                                  6838611c8ab6539005e11c84ca308158f89a51db57a62caf21faab48bf576177

                                                                                                                  SHA512

                                                                                                                  625436bb52cbd7df7ed03be05fea52c5d54b6cc15037d70c268d9598e648a22246db902b9c6f097ba8b18bd924f6ab17120736285d54dce13773237f1669853a

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005f

                                                                                                                  Filesize

                                                                                                                  63KB

                                                                                                                  MD5

                                                                                                                  710d7637cc7e21b62fd3efe6aba1fd27

                                                                                                                  SHA1

                                                                                                                  8645d6b137064c7b38e10c736724e17787db6cf3

                                                                                                                  SHA256

                                                                                                                  c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                                                                                  SHA512

                                                                                                                  19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000060

                                                                                                                  Filesize

                                                                                                                  19KB

                                                                                                                  MD5

                                                                                                                  2e86a72f4e82614cd4842950d2e0a716

                                                                                                                  SHA1

                                                                                                                  d7b4ee0c9af735d098bff474632fc2c0113e0b9c

                                                                                                                  SHA256

                                                                                                                  c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

                                                                                                                  SHA512

                                                                                                                  7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  5KB

                                                                                                                  MD5

                                                                                                                  6cba37049931a104767e889c64202e43

                                                                                                                  SHA1

                                                                                                                  4c88033b110bf84641366523d8e3d9c3b05654d3

                                                                                                                  SHA256

                                                                                                                  12c30a6dba2685dd89caa675a152dcc45bed32d1cd2146dc9196cb3aac444127

                                                                                                                  SHA512

                                                                                                                  a16d8b73d65f3ab265a8ec1e20f572da281429bc98371c63db6938f1b026c9e33102fa98d64bedb68f4a21c1f9213f7f451a57c1a5e77ed2341f41601634d501

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                  Filesize

                                                                                                                  5KB

                                                                                                                  MD5

                                                                                                                  e3980a4ecedd669aea328339b48f5b89

                                                                                                                  SHA1

                                                                                                                  e1f69876e2dcb2a1989ef887d613477cf0cfbc47

                                                                                                                  SHA256

                                                                                                                  592ef13d264dec0cba3d2283560432a634800186d549693386c0f60c5ce5055a

                                                                                                                  SHA512

                                                                                                                  8e23719a3cdd59ec84f1da18de8a6adac3a8ce9037cde64a199a5d81db862f8201a4ea33838351a3e7493de60a77c635cb2a719e6db5cb8d86c78a9247574cbd

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                  MD5

                                                                                                                  6afaacb07faecfc277623753850e1111

                                                                                                                  SHA1

                                                                                                                  81c6db35e5d3dc15e4b8427272b12226b5f99f7d

                                                                                                                  SHA256

                                                                                                                  a65ac71d57273e9c07bf422826146548898c71c7b0738bbd3bff5c9787ac7b03

                                                                                                                  SHA512

                                                                                                                  8beae928145c577b56685d4e60a2020c47ef97f3d9f9444c7f1174dd67161e22a1b04b47f2d91b43810142ba50f81532871661fdd525d60a93582970410fa4ed

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                  MD5

                                                                                                                  9821b971cfdc538d82cf731a75dc7d2c

                                                                                                                  SHA1

                                                                                                                  e452d6d3a3ed75d672c196ee4e42bd698922b78b

                                                                                                                  SHA256

                                                                                                                  88f9ae275ae8d027e7a93f8e68c526bef2f2921f377b2aadc2bef944b43988f8

                                                                                                                  SHA512

                                                                                                                  ba1c447c7b390659b1b4aba7d0d8930ad44c20396d7810a84329c08685995b9dba5a472fd5acb2ab70fa5942b1d7d36dc34a21ecb413874de35122dcf162a56f

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  9KB

                                                                                                                  MD5

                                                                                                                  693d126523501b979c85e0066a4e0724

                                                                                                                  SHA1

                                                                                                                  96e16f3ee814b8ce12c799efd08afa5dc7b3a4ed

                                                                                                                  SHA256

                                                                                                                  368595cdce263ea606e318ecd4379469df2813850d886688518a10981aad1cb6

                                                                                                                  SHA512

                                                                                                                  291bc26b21881b19f62c93e09cfbfd144e7594820bbef4699045e83b3ff445765c2470dd0dd87ad1f10ea0a5d3df6c8fcd378a0f719e72db8baa88d4727980ae

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  9KB

                                                                                                                  MD5

                                                                                                                  e357d85c014e01a989be0ee233c87b24

                                                                                                                  SHA1

                                                                                                                  081a654b1c58382efb6c4aa193e0f5ec20e5e9de

                                                                                                                  SHA256

                                                                                                                  75fef8171605db017c132a62abde107dd4b01e9f6f09d3d63b6854a7f6762102

                                                                                                                  SHA512

                                                                                                                  7889032d6603414640ad2e1060639ac13f562886de226d6bf4c8109657f4bcde5a6b4d55aeff34cf6ad2163affef515e0591061414c7c8c7ba320fdaf4277d76

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  14KB

                                                                                                                  MD5

                                                                                                                  908537416866e71a58bf05694ac1adbd

                                                                                                                  SHA1

                                                                                                                  20259aa4386ab37ce034608db439463fd28cbd89

                                                                                                                  SHA256

                                                                                                                  ed4abd54ac5afb463f1eb79f709653021c97bf46117f67bd2485b799025e0848

                                                                                                                  SHA512

                                                                                                                  d7a156ba118c2b28bbef5dfad60de0d443386fbc3a4ce341425cd30e6363c1046fc994ed554a0c3283f1e503cbc304a353ba6556d41a474e3465c2380b7c7022

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  8KB

                                                                                                                  MD5

                                                                                                                  8fb6679bb536d2833e4ccd24416079c8

                                                                                                                  SHA1

                                                                                                                  a1548a20699a3d98cbd8f0c9ea19c8c1106002d1

                                                                                                                  SHA256

                                                                                                                  74233b564992c71f338ff98687c9b184d416934f917fea4820c4ab55238a6629

                                                                                                                  SHA512

                                                                                                                  51db46c456e753f629fb41023976aaccb554170b0d989e1e4951d8e9b3954213629f6a23ebd09d2b55a7712e0cbfcb4f0244c8edd8139b98681842f28813b05d

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  13KB

                                                                                                                  MD5

                                                                                                                  b55b617abf5ea857375ddd6caa6bfaa4

                                                                                                                  SHA1

                                                                                                                  0bca6c4ab1463adbde044ff0487e1dfa7e05da1f

                                                                                                                  SHA256

                                                                                                                  5bba0c4a7d5051b3f890e15144062b96b33ca749999560fec015c345a9e42fad

                                                                                                                  SHA512

                                                                                                                  60882e1f8e32292abef79288e2e5f3e4005d139cbed73cbd8a2fb252ce247df01264e5a26973810aa58ba49cca41ec8fbf308791ffcc7ffc7a2f2903704b6205

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  5KB

                                                                                                                  MD5

                                                                                                                  b8e5e677b9625a5f1b4e0e7c3378c1e5

                                                                                                                  SHA1

                                                                                                                  af31bccd5a3c7ffdbedb32591be9250b734bbeaa

                                                                                                                  SHA256

                                                                                                                  bf4e240d6c32f1795e900a6722d9a306eb24af33ca504e894c69b6135e1660f0

                                                                                                                  SHA512

                                                                                                                  4c8ec27d35de9b7a5fb436e7e0a5510345c641afc346395f43f037c77dc8f3b516a7211f73d6cab89be798c10f25504b5258b807c0a41d20034215b227775f07

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  f38ab557e609af1aff4d67effbf90751

                                                                                                                  SHA1

                                                                                                                  0270f95c35236aa431b1af40916660abd82707aa

                                                                                                                  SHA256

                                                                                                                  4fe81adb20f0c0ef32add5b6203d57b7194b6e427cb1769f6277a06235eb553e

                                                                                                                  SHA512

                                                                                                                  5be4a4242750794cb844386a6b2d21f2dd50018d47b23b555f487bdd6c046000828743f24074c7e9094ba55c520941e9a778efd3a7a96e3ba264542af65c682e

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  7KB

                                                                                                                  MD5

                                                                                                                  1b6a405b0f7fc6d63552fddc803d8b2c

                                                                                                                  SHA1

                                                                                                                  b19d395e62ee38c361ca4ddc55704291c3ebc0df

                                                                                                                  SHA256

                                                                                                                  b83045e0be414a99253afae85776e8a825a2abe28af8187ac9d6da80f3417a96

                                                                                                                  SHA512

                                                                                                                  e7d95bd01661a63df9d2eb037a978250c5b97a54ab92dea1c65f26506c4a1ad61dbb5d9a616e22cae7158f578b65fab579d23b6609ba9bd19be0a7f16458091c

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  14KB

                                                                                                                  MD5

                                                                                                                  b0995e04d2a51700f84ef99193d1d4f1

                                                                                                                  SHA1

                                                                                                                  de59d4a9d6fc7cae40a69debb27615672f0661ae

                                                                                                                  SHA256

                                                                                                                  d1f2529768c6109d0e600d9a75731daee32fe2d528f9766e2b0d7ec29a942aaf

                                                                                                                  SHA512

                                                                                                                  fb7c8686acca0150114f233f7e6e184b97c99746fbcd17ef3473a6b6cfd26ffc5d9bb3dc2ac2a2f617b41dfa60ab7034c459760d466c53de4cfb1a34b4c14761

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                  Filesize

                                                                                                                  14KB

                                                                                                                  MD5

                                                                                                                  e3d32efac5e818fbbccfb9a6d0478258

                                                                                                                  SHA1

                                                                                                                  d9843341a34740e1129ab03df066516914f61cdd

                                                                                                                  SHA256

                                                                                                                  96d8b6d013a3ce4105a2a0e7466425ef8779fecb95db9e7da3ba85e281a07cca

                                                                                                                  SHA512

                                                                                                                  bbc46c21bf962f8ada248af2032b3d775eeb45e38ec7b793790024a3dee3d29d00a4589e1c7802f1a43f410f5dff14f87b35dd1b5c72caa8d2c521044217b6cd

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  MD5

                                                                                                                  d8d456c0d93ebaf15cb111c6f957b303

                                                                                                                  SHA1

                                                                                                                  e99cabba415f5c82e1cbd8a0b5bc9f512d238711

                                                                                                                  SHA256

                                                                                                                  e6e719a4ed189ca17edda20b91908732b5afe4311bf1f44ac11eace1f033053f

                                                                                                                  SHA512

                                                                                                                  290686fa5741b0d1352d660fb5f033040dde5699577c1a4ce1b9c0f4821ce74de9bd8284239a172a8ff8919c340712eab05dd6a8ccdc1161dcfd66c95e8140c5

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  1KB

                                                                                                                  MD5

                                                                                                                  ba5c70df9dc74ea6cc1f6fbc75d45e74

                                                                                                                  SHA1

                                                                                                                  93ce04aef20c76290a1f4d08674803d2ab68f7dc

                                                                                                                  SHA256

                                                                                                                  ad5bbe9e609a8ff510fd7a6ea4eb6e34d5d16d4d7f5d5b760cb6c42b36f8a62f

                                                                                                                  SHA512

                                                                                                                  f522f3a3263ccd103509cbc3322f28031593073fe7de9415bc6424717c381dbe6b5857fb8ad783b781bae21eed6cb13b3bb9063df03664912f2e179d6110b7ae

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  3KB

                                                                                                                  MD5

                                                                                                                  44959862763e68178a81f81227a51dda

                                                                                                                  SHA1

                                                                                                                  b9036e8e88d28e8c2f51071d274cf085ec18e754

                                                                                                                  SHA256

                                                                                                                  634112735e623e5071dec330c12f8841888b4073f4821197bbfcb86b81866a90

                                                                                                                  SHA512

                                                                                                                  a27a933b7475166267943b516b0d5669ebfb89fe2db7fa70a36028063cf70c14bacf51bc5b0556c2cd52abeace6bc799e0c196a9d6c1cc0c71394592af35f38f

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  MD5

                                                                                                                  67ac5ac58f55553baec07d38b35c67ea

                                                                                                                  SHA1

                                                                                                                  e4464f8b6e9966c008ece08af6f38cb12953e0ed

                                                                                                                  SHA256

                                                                                                                  f4fb9a9847e5667f8f607d1e74ccd26314dc658f8d7f2ee0b9936aaf72e64936

                                                                                                                  SHA512

                                                                                                                  f9c1390997bfafdf09d500cf759cdbb366ab0fd9950beaa6f577a0ff1ba40da178fe2fb11770e0c7488211e7338ece512e32dc0f932500f76b5ad334e9531294

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  1KB

                                                                                                                  MD5

                                                                                                                  2a8cfc8eb5f767eb0cf3d7900b02f1e7

                                                                                                                  SHA1

                                                                                                                  d5fab94360569d3047003df3e3b64793257167f4

                                                                                                                  SHA256

                                                                                                                  8ab179fb719e62ed39bf041aeae59d72041b47990f11a84705d09b6597612ef5

                                                                                                                  SHA512

                                                                                                                  b0ec484ecdbb66aa185322a8800419af2afc27fd57d8aafb6cc7085922e1bb495bc6f8c7bcdefa595292c65022e2599857294ba07f5648b745bc8a8bb745dfce

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  MD5

                                                                                                                  f6da9e0b6ef8c0db03a3d2d8ab918aee

                                                                                                                  SHA1

                                                                                                                  000cd1c772dc612a96149acf3621e27720bf7d26

                                                                                                                  SHA256

                                                                                                                  905a9a64a377bd651413e31dac03f0c79d3533502d907bac4b4ab01525559e19

                                                                                                                  SHA512

                                                                                                                  b2ef6d0875f1346482d8419f6fc311811f7135b5b381ba56ebb45ddb7a2bbe3f4931e9ee2d8ca3197f5aad6ef8a76def575889a193766a7c0c6b1378f24c0abe

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  MD5

                                                                                                                  1b74387b5770cd930dfd3842a9d6144c

                                                                                                                  SHA1

                                                                                                                  4f0d9029146def459e5b103ef22aea7cc607b0f6

                                                                                                                  SHA256

                                                                                                                  91033ed33fd4764314dca358e29979c566af623d0149e09a4160c7a6c43329b9

                                                                                                                  SHA512

                                                                                                                  2f74938cd1fd73181fb8e19bf8b02f27655d8b9e4372521d4aa561a6dcf5b94a5be1d1a7ea273f7b2f3ad8bd7b3ad8d2d0f6874912eb65ca84b4aceea67b31ed

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                                  Filesize

                                                                                                                  4KB

                                                                                                                  MD5

                                                                                                                  89d9087c9458af3d9dbf104302d6515a

                                                                                                                  SHA1

                                                                                                                  1196a86a7dcf511743bac619151655897dfef206

                                                                                                                  SHA256

                                                                                                                  b2f1078cf0e58cf7e8ae0ff3f511117c7473a877dbcd491f5d5a938099fa9068

                                                                                                                  SHA512

                                                                                                                  74dcb6427b13f5817406f371eb4a0e159e1dbd04ceb25493d4857502fbf61143dfadb082572b3d1c8749f06afc8cb866cd48d280377e122fe83bee901abff09b

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581827.TMP

                                                                                                                  Filesize

                                                                                                                  702B

                                                                                                                  MD5

                                                                                                                  5f12a1008b415375752f505a4b85f40b

                                                                                                                  SHA1

                                                                                                                  0d1453a8a364d23b916e1840555a1feb72296360

                                                                                                                  SHA256

                                                                                                                  cc47a5eaf23df607808da914156e1775f356711a99aa7b43a1d1db103dc25f32

                                                                                                                  SHA512

                                                                                                                  2fb708a45f9324e3b72e9874166fe508dd61db1d6b972cd189d56ce1293ad4d36c6ad22041ef291dc64a33846fbfe0b0d23ac570913d1f4bffac90063e6ea656

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bc29dbb4-c9dc-4245-87df-8b9f7c7fb0e3.tmp

                                                                                                                  Filesize

                                                                                                                  14KB

                                                                                                                  MD5

                                                                                                                  d9315cefaefdd8347784627661083acd

                                                                                                                  SHA1

                                                                                                                  bac8d2031b4b401242608e7269973a315b5b6533

                                                                                                                  SHA256

                                                                                                                  0f200982d78a4f020f456d5a98a7d7b3bfb77d3be6e34f2670b710953201dff8

                                                                                                                  SHA512

                                                                                                                  47eab3943746455cce0da18731a85fc2ba2e07e1a35b34d538c7534e042b8619df4e66cfae9cb42d390b12c35397e4a1b71b74496d7941e631b72d050e94a883

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                  Filesize

                                                                                                                  16B

                                                                                                                  MD5

                                                                                                                  46295cac801e5d4857d09837238a6394

                                                                                                                  SHA1

                                                                                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                  SHA256

                                                                                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                  SHA512

                                                                                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                                  Filesize

                                                                                                                  16B

                                                                                                                  MD5

                                                                                                                  206702161f94c5cd39fadd03f4014d98

                                                                                                                  SHA1

                                                                                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                  SHA256

                                                                                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                  SHA512

                                                                                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                  MD5

                                                                                                                  ad45a8722321701579db92f3536a3313

                                                                                                                  SHA1

                                                                                                                  1f3c7f0b676e39443a53a7e73ad33ea7e020b769

                                                                                                                  SHA256

                                                                                                                  83ca5791d299937db692de96e45a4b14f3b8d912510e6cb24537243f1a74df37

                                                                                                                  SHA512

                                                                                                                  c495bdd5c173e208dce02af160f0cf964a449e71ef78b205026c97ede2cc257d16bfbcc3b44f4b8b499a52b4d5c007e93fe7143739cbb524994b8a2b6d9051b3

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                  MD5

                                                                                                                  e2c18acba21de1b3de0d3c655b72b688

                                                                                                                  SHA1

                                                                                                                  b1962c5acdbfffb9f3c84fa075ddc9427cc65801

                                                                                                                  SHA256

                                                                                                                  f6910ca7b37b06f9c8c7f1db6c980accd4331c646429fc12ea7905052254216a

                                                                                                                  SHA512

                                                                                                                  2bf7e5156ecf03bcfca87e75c6f2f7c8caf2f3e23035ec576cdcb933c06500b67f37212073f0bfaee004caf80b63404225eff00ac5eeb74992e5eeff8dca3505

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  10KB

                                                                                                                  MD5

                                                                                                                  8479bac0d42c7338b787c810350020eb

                                                                                                                  SHA1

                                                                                                                  bd207c342b5d9e29d0936f66fc76cfbd8984d8d5

                                                                                                                  SHA256

                                                                                                                  9fa4f82392628506ed3d9c556848c6325c7f710144893fdb1d7462e64966d7ae

                                                                                                                  SHA512

                                                                                                                  ad66a7c5b57174d66cacd833b90a81973e7411ec92bb0a317c5eade69bf3e7d0fc38e7e3c9ef83a9a7d54b438139da536bb1794f40294ceaed9b896a8b951a8f

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                  MD5

                                                                                                                  c69568c00cc905a5f678d2d405384813

                                                                                                                  SHA1

                                                                                                                  ceec665bb5f7f4761c285162581f3f5e84721458

                                                                                                                  SHA256

                                                                                                                  5ac19c75cf83728808159eb175f27de10944c8c09a22bfeb3b09bc3bf9257472

                                                                                                                  SHA512

                                                                                                                  57bd707b36ef34a16ac9877feaf8b8e725408cff45069a3a8b5e304591c45ef71d4d623a3f7aea1b6fc0273a303aa2bce44bd2e6c94f33d74fcedf84414d97a4

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                  MD5

                                                                                                                  54228ee5fda3ace67edad0c57199bc6a

                                                                                                                  SHA1

                                                                                                                  28df47f413a8548f1c47507b7e1c52d01efa2de7

                                                                                                                  SHA256

                                                                                                                  4584ff3955d199144637678912469adb1ca58b35aca0d577542215ba23b3cea6

                                                                                                                  SHA512

                                                                                                                  f3b54a1fefbdfc2ef79b11a94ccf9bc549953f81963ff1252cd9d69bdc911762801dd7469177fa7b695646a8ee2ff7883bc8d3869fe22d1e566c8d7b9e5dbba8

                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                  Filesize

                                                                                                                  12KB

                                                                                                                  MD5

                                                                                                                  6759c762c8292bd0f8c520c66fa3067c

                                                                                                                  SHA1

                                                                                                                  0733fc0ebd5018c71635ea86b25bf157a6b3020e

                                                                                                                  SHA256

                                                                                                                  4b4ae05317184691caa77afdf10387f02f5296455b2c803dcfee31130727b21c

                                                                                                                  SHA512

                                                                                                                  4d1c651b93726141a48241baa70cef7b3a6a61dd647fea52b277a90f1ffbd8c9e5d4add2035cfc42d653aa5ed00def8473f6ed347fae65cc44375beb501e8137

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\53b4dde3-ceef-4149-b63d-4b67cc36c3e9\GunaDotNetRT.dll

                                                                                                                  Filesize

                                                                                                                  136KB

                                                                                                                  MD5

                                                                                                                  9af5eb006bb0bab7f226272d82c896c7

                                                                                                                  SHA1

                                                                                                                  c2a5bb42a5f08f4dc821be374b700652262308f0

                                                                                                                  SHA256

                                                                                                                  77dc05a6bda90757f66552ee3f469b09f1e00732b4edca0f542872fb591ed9db

                                                                                                                  SHA512

                                                                                                                  7badd41be4c1039302fda9bba19d374ec9446ce24b7db33b66bee4ef38180d1abcd666d2aea468e7e452aa1e1565eedfefed582bf1c2fe477a4171d99d48772a

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Luxury Shield 7.1.exe

                                                                                                                  Filesize

                                                                                                                  7.5MB

                                                                                                                  MD5

                                                                                                                  9502776952e6900ae1f98934004b4293

                                                                                                                  SHA1

                                                                                                                  3905f80a539d37c648a5da1cc6dace16d3516c2c

                                                                                                                  SHA256

                                                                                                                  d8ca879cf734c21b84e3983a9245c4da2b38cfe23b1691e4ca265286c3782b1f

                                                                                                                  SHA512

                                                                                                                  cbef89e577c883283ce3e9bb48e2ba9eda010e40e6cb1a383d99e32b728a9553cdb83e0831c0bff961fd271cee4eab921f53c97d9412e87bec4d0498400b5fbb

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WinRAR.exe

                                                                                                                  Filesize

                                                                                                                  226KB

                                                                                                                  MD5

                                                                                                                  60219035e32ad00d4c691a1bdc6455fb

                                                                                                                  SHA1

                                                                                                                  5f3740fcf89a95437ce184cfe22f23ed8b5b9254

                                                                                                                  SHA256

                                                                                                                  e005f5c2e4fdd277ced1ae42272b864e47de334e0d2a1043f24c21253da18ae5

                                                                                                                  SHA512

                                                                                                                  b98eb125f7812ac5d2243bd0d6ee07e918af5d0a46d86a6b242a7d8f91dbaaa48fabb562c316abbbf93db0c5ffc3a16184233000b379bafcdb3104c470055fc7

                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iwgjvymj.5ld.ps1

                                                                                                                  Filesize

                                                                                                                  60B

                                                                                                                  MD5

                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                  SHA1

                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                  SHA256

                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                  SHA512

                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                • C:\Users\Admin\Downloads\Luxury_Shield_7.1.rar

                                                                                                                  Filesize

                                                                                                                  7.6MB

                                                                                                                  MD5

                                                                                                                  e807f84e4b7d13b129f885a8de6e7706

                                                                                                                  SHA1

                                                                                                                  cc11599037ba929b3c39a054d6c49ba59444aacd

                                                                                                                  SHA256

                                                                                                                  97815a8a4139795fc19b4cdb27e27b6eeee9a4c344846f2e44f46405778515d9

                                                                                                                  SHA512

                                                                                                                  a791ef8fed590b2e5af5d7b3b47ad0bfdb5334e41c0275bc8bd37ef7beab150befe69de1db41a3afcce49bf1e2abdfdc53f969d555406ed982949db76e254045

                                                                                                                • C:\Users\Admin\Downloads\Luxury_Shield_7.1\Luxury Shield 7.1\Luxury Sheild v7.1.exe

                                                                                                                  Filesize

                                                                                                                  7.6MB

                                                                                                                  MD5

                                                                                                                  f145671c3c65072a5a49f1d1d68a4a3a

                                                                                                                  SHA1

                                                                                                                  2453dddb4e6ebd48604fff3094f6a59dacdc3ad7

                                                                                                                  SHA256

                                                                                                                  d5dcde7ced43245641793538f847c55e3271f5ff8eb45fa5616a00634b7e64a1

                                                                                                                  SHA512

                                                                                                                  6f9bb2a1c9e4f90c22f7e0675c6d0ab06e0b7875c432d229739000c568a9a0fa5024cd36ec6b947b520704ad706b945371029c24766cac3fb2d509f478dc6902

                                                                                                                • C:\Users\Admin\Downloads\Unconfirmed 213613.crdownload

                                                                                                                  Filesize

                                                                                                                  3.8MB

                                                                                                                  MD5

                                                                                                                  46c17c999744470b689331f41eab7df1

                                                                                                                  SHA1

                                                                                                                  b8a63127df6a87d333061c622220d6d70ed80f7c

                                                                                                                  SHA256

                                                                                                                  c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

                                                                                                                  SHA512

                                                                                                                  4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6

                                                                                                                • C:\Users\Admin\Downloads\winrar-x64-701.exe

                                                                                                                  Filesize

                                                                                                                  3.7MB

                                                                                                                  MD5

                                                                                                                  3a2f16a044d8f6d2f9443dff6bd1c7d4

                                                                                                                  SHA1

                                                                                                                  48c6c0450af803b72a0caa7d5e3863c3f0240ef1

                                                                                                                  SHA256

                                                                                                                  31f7ba37180f820313b2d32e76252344598409cb932109dd84a071cd58b64aa6

                                                                                                                  SHA512

                                                                                                                  61daee2ce82c3b8e79f7598a79d72e337220ced7607e3ed878a3059ac03257542147dbd377e902cc95f04324e2fb7c5e07d1410f0a1815d5a05c5320e5715ef6

                                                                                                                • memory/2492-1472-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1464-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1486-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1491-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1435-0x0000000000DC0000-0x0000000002120000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  19.4MB

                                                                                                                • memory/2492-1446-0x0000000000DC0000-0x0000000002120000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  19.4MB

                                                                                                                • memory/2492-1447-0x000000000B4E0000-0x000000000B57C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  624KB

                                                                                                                • memory/2492-1448-0x000000000BD60000-0x000000000C304000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  5.6MB

                                                                                                                • memory/2492-1449-0x000000000B690000-0x000000000B722000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  584KB

                                                                                                                • memory/2492-1450-0x000000000B590000-0x000000000B59A000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  40KB

                                                                                                                • memory/2492-1451-0x000000000B730000-0x000000000B786000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  344KB

                                                                                                                • memory/2492-1452-0x000000000C310000-0x000000000CBF6000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  8.9MB

                                                                                                                • memory/2492-1453-0x000000000B9F0000-0x000000000BC3C000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1478-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1459-0x0000000070AA0000-0x0000000070AD7000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  220KB

                                                                                                                • memory/2492-1462-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1482-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1476-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1474-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1484-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1470-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1468-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1466-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1488-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1461-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1460-0x0000000072670000-0x00000000726F9000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  548KB

                                                                                                                • memory/2492-1480-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1504-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1518-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1522-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1520-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1516-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1514-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1512-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1510-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1508-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1507-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1502-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1500-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1498-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1496-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1494-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/2492-1492-0x000000000B9F0000-0x000000000BC38000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  2.3MB

                                                                                                                • memory/3452-1349-0x000002D077960000-0x000002D077982000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  136KB

                                                                                                                • memory/5532-1372-0x0000000000420000-0x0000000001780000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  19.4MB

                                                                                                                • memory/5532-1414-0x0000000000420000-0x0000000001780000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  19.4MB

                                                                                                                • memory/6020-1393-0x0000000000210000-0x000000000024E000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  248KB

                                                                                                                • memory/6080-1348-0x00000000007D0000-0x0000000000F76000-memory.dmp

                                                                                                                  Filesize

                                                                                                                  7.6MB