dharma | hxxps://google[.]com/

Resubmissions

10-11-2024 03:12

241110-dqpxfsydng 10

10-11-2024 03:07

241110-dmj7ssycrf 3

Analysis

max time kernel
1049s
max time network
1046s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
10-11-2024 03:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://google.com/

Score

10^/10

dharma credential_access defense_evasion discovery execution impact persistence phishing ransomware spyware stealer

Malware Config

Signatures

Dharma
Dharma is a ransomware that uses security software installation to hide malicious activities.
ransomware dharma
Dharma family
dharma
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (497) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000\Control Panel\International\Geo\Nation	CoronaVirus.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta	CoronaVirus.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CoronaVirus.exe	CoronaVirus.exe

Executes dropped EXE 2 IoCs

pid	Process
800	CoronaVirus.exe
21460	CoronaVirus.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoronaVirus.exe = "C:\\Windows\\System32\\CoronaVirus.exe"	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Windows\System32\Info.hta = "mshta.exe \"C:\\Windows\\System32\\Info.hta\""	CoronaVirus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\C:\Users\Admin\AppData\Roaming\Info.hta = "mshta.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Info.hta\""	CoronaVirus.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-4152190078-1497776152-96910572-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	CoronaVirus.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-4152190078-1497776152-96910572-1000\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	CoronaVirus.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	CoronaVirus.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	CoronaVirus.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
813	raw.githubusercontent.com
814	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CoronaVirus.exe	CoronaVirus.exe
File created	C:\Windows\System32\Info.hta	CoronaVirus.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Windows.Forms.Design.resources.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\STSUCRES.DLL.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Mu\Fingerprinting	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\de\UIAutomationProvider.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\System.Xaml.resources.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogoCanary.png	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Retail-pl.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WWLIB.DLL.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ComponentModel.EventBasedAsync.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\et.pak.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sbicuin58_64.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OWSSUPP.DLL.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\WindowsBase.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.boot.tree.dat	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\System.Security.Cryptography.ProtectedData.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\Locales\bn.pak.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.Compression.ZipFile.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\Default.dotx	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.CompilerServices.VisualC.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp5-ul-oob.xrm-ms.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\lt\msipc.dll.mui.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MINSBPROXY.DLL.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_KMS_Client-ul-oob.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\System.IO.Log.Resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe	CoronaVirus.exe
File opened for modification	C:\Program Files\Windows Defender\es-ES\shellext.dll.mui	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\ReachFramework.resources.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ul-oob.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\WindowsBase.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\Classification\mswb7.dll	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ta.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\libxslt.md.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\Microsoft.VisualBasic.Forms.resources.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms	CoronaVirus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TipRes.dll.mui	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Xaml.resources.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\System.Windows.Forms.Design.resources.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Redshift\lib\sbicuin53_64.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hans\PresentationFramework.resources.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\demux\libsid_plugin.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libswscale_plugin.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8en.dub.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\SpreadsheetIQ.ExcelAddin.Resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\es-ES\wordpad.exe.mui	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\System.Net.Resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\PresentationUI.resources.dll	CoronaVirus.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.MsoInterop.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\VideoLAN\VLC\lua\playlist\vimeo.luac.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-stdio-l1-1-0.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\WindowsBase.resources.dll.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\THMBNAIL.PNG.id-372A96B2.[[email protected]].ncov	CoronaVirus.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CoronaVirus.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
20732	vssadmin.exe
23056	vssadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4152190078-1497776152-96910572-1000\{2A009928-85D6-4F1F-8260-537520B3D5DE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4152190078-1497776152-96910572-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 191204.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
328	msedge.exe
328	msedge.exe
3804	identity_helper.exe
3804	identity_helper.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3876	msedge.exe
3876	msedge.exe
5000	msedge.exe
5000	msedge.exe
5020	msedge.exe
5020	msedge.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe
800	CoronaVirus.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	14628	vssvc.exe
Token: SeRestorePrivilege	14628	vssvc.exe
Token: SeAuditPrivilege	14628	vssvc.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious use of SendNotifyMessage 50 IoCs

pid	Process
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe
328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 328 wrote to memory of 1676	328	msedge.exe	81
PID 328 wrote to memory of 1676	328	msedge.exe	81
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 4532	328	msedge.exe	82
PID 328 wrote to memory of 3208	328	msedge.exe	83
PID 328 wrote to memory of 3208	328	msedge.exe	83
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84
PID 328 wrote to memory of 2200	328	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://google.com/
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffdfb7c46f8,0x7ffdfb7c4708,0x7ffdfb7c4718
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6d6df5460,0x7ff6d6df5470,0x7ff6d6df5480
    3⤵
    PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=992 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5536 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1180 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=992 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1312 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8176 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=1140 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2656 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8156 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8056 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7976 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7096 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7812 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8640 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,11390364563416525324,4197339132435707411,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3456
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:800
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:4668
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:6484
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:20732
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    PID:22684
  - - C:\Windows\system32\mode.com
      mode con cp select=1251
      4⤵
      PID:22912
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:23056
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:22848
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
    3⤵
    PID:22880
- C:\Users\Admin\Downloads\CoronaVirus.exe
  "C:\Users\Admin\Downloads\CoronaVirus.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:21460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3324

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x490 0x3c0
1⤵
PID:3340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:20740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:14628

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\09b9a4f38e4c47b78f0b4c3c079c73de /t 22852 /p 22848
1⤵
PID:23276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id-372A96B2.[[email protected]].ncov

Filesize
3.2MB

MD5
7a1dda9e1fb444ac7b311ab21b4053df

SHA1
0ffca8c44aca3f860ef194c51a2d2b4132be58e4

SHA256
b767e11b534968cc44bb88ff161537da8e53df49b6a18b2ba8608d064a7f360d

SHA512
7fd913b2ac09c13b86c58c4c2ac18b7435a5420e0fc3f0b08e4b632095c5b7e0fc2d68a95c5d9316d3a04581b5e2c5293253abe05c5bb183029763dade1c1996

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fc4ff0f41857065a8dedd08785d4ab3a

SHA1
a9d954724c58fd7fdacc8528270ac02e53fe02ff

SHA256
0c888ddd152a76b5b68b08162482a6508c783b2c9289d84d5888aaeae7fcebca

SHA512
92db77010e1f2a8304b2b33320624c440eebdf673aa226377c791a1983f9ef10ddb1a42d9d73280c6cfce87fbcd0503ff49b70761cb2ea61de6a12a46510649d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
467bc167b06cdf2998f79460b98fa8f6

SHA1
a66fc2b411b31cb853195013d4677f4a2e5b6d11

SHA256
3b19522cb9ce73332fa1c357c6138b97b928545d38d162733eba68c8c5e604bd

SHA512
0eb63e6cacbec78b434d976fa2fb6fb44b1f9bc31001857c9bcb68c041bb52df30fbc7e1353f81d336b8a716821876fcacf3b32a107b16cec217c3d5d9621286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cc10dc6ba36bad31b4268762731a6c81

SHA1
9694d2aa8b119d674c27a1cfcaaf14ade8704e63

SHA256
d0d1f405097849f8203095f0d591e113145b1ce99df0545770138d772df4997f

SHA512
0ed193fdcc3f625221293bfd6af3132a5ce7d87138cd7df5e4b89353c89e237c1ff81920a2b17b7e0047f2cc8b2a976f667c7f12b0dcc273ddc3b4c8323b1b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3fb67c20-fc82-45e7-b498-2dfe777071db.tmp

Filesize
6KB

MD5
726d986afea21c758aa9a01d53f68af3

SHA1
31532e321edad4dd468e3840b6a7f5c2b8ff44db

SHA256
97b8d9d6b126b0161770e09ae81dc4e9f63fc0305d6eac63514b4af61b07912c

SHA512
264a5bdfae0b96b38c6ff64cdc715e318e9329e001d51bb734952c773077fbf3305086c09ff2e74aa350d3126de898c2c5f967b05fd4e242f6dfdc8146b726c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9d55a8f3-b1a6-4a32-bd44-708283209310.tmp

Filesize
1KB

MD5
574608908fdf92a5f2d571452d55f550

SHA1
8ca6ae6a976a5d54df129661fc33f0ea8582625b

SHA256
bde3d8efe3d259867926b4cd912af7ed6108733b4819002daad9c61c48c28a5f

SHA512
0598a8929e10e8ff6dcb709a8649482b14ecc1c90093cb9472b42bf4c3c5c4a58262e4ab9908b01a9b2c7363df77be6bf3a3e07b0b085d17b74b2fd00c0a1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
d81d52a7a2de9189891eeb3753aac042

SHA1
057b7068214f3af00ecf73677798979175192062

SHA256
5d59969951587d02ccf8e5b8b08b16f8b8b3110e26dd195cfdbaaaae99674230

SHA512
62a5c49989be283cc69609bedeba3e1a6f5d3a02edfdfda9baaaae7d55edef2fa80fecb22e9f5545b858c308cfa83b21a25768ea3ec93e4d6bc5d74c968bf2a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
47KB

MD5
55a93dd8c17e1019c87980a74c65cb1b

SHA1
4b99f1784b2bb2b2cc0e78b88c5d25858ff01c5d

SHA256
4925dd477b8abf082cb81e636f8d2c76f34d7864947114fc9f1db0e68b5a9009

SHA512
f9ade542c593067dbcd13ed94da1ba17a84782575355396db8fd7c28aa70a3120d0c0a22d3ca3d2f0774c1dcb06b9319e243b36001c618c92e0af25cb9c8e46b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
67KB

MD5
fb2f02c107cee2b4f2286d528d23b94e

SHA1
d76d6b684b7cfbe340e61734a7c197cc672b1af3

SHA256
925dd883d5a2eb44cf1f75e8d71346b98f14c4412a0ea0c350672384a0e83e7a

SHA512
be51d371b79f4cc1f860706207d5978d18660bf1dc0ca6706d43ca0375843ec924aa4a8ed44867661a77e3ec85e278c559ab6f6946cba4f43daf3854b838bb82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
25KB

MD5
cd74fa4f0944963c0908611fed565d9b

SHA1
c18033d8679d742e2aab1d6c88c28bd8f8a9e10d

SHA256
e432edfafbd52fcdbd59ef74892aa2e2ab19df6647ae723b368fca529066a804

SHA512
b526216bdbc73a97db41edbec6fdfd09b7b4ae149d415fb5811dde03ad4b1b0247950abd78fef807ae47674ab1b56ff0b971fa5e305b26bc92dc07871313b750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
17KB

MD5
e1ef844fbf2475827f4fa7c7af5659b8

SHA1
2d1cd3d69fbb13da3c850a8323bdecb794788a30

SHA256
716e272407d008b7b2eb7a431b0c23db68091c45d642847af41873ee90a51199

SHA512
eb9981d55311c3bb224eb9446b01aea67db26d55a409c2e6cf2508e000ebc125553b94a76482f9e440205f84b0eccb8604c61bfa8ed0fe8034d5d3e24c32fad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
122KB

MD5
53026927a57662e3652ef95fc4085ce6

SHA1
8d895e647ec873138744858816a1c2d721e75fcd

SHA256
40abd373c30668fd82c6de0d105a9bd7bf230dbc17ed62976ab8c1841d1ea06a

SHA512
3ba8e57747fc3f8f474b561cd299a9226e04e26dc52dbf6a8c7744e6ce22685bb7d2e7056d204883040961cc369bc066a2c4eff395b222d3339e62b101f4dcae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000061

Filesize
16KB

MD5
9c6b5ce6b3452e98573e6409c34dd73c

SHA1
de607fadef62e36945a409a838eb8fc36d819b42

SHA256
cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc

SHA512
4cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000be

Filesize
60KB

MD5
f70baa579d763f4bc2df9911cd97f38d

SHA1
cb6ff1124c247215383843cb88bf36473aac769f

SHA256
69c6971720ae95f2ce455328db7afc3b142f1c2861abe1048a48c6efe72c1816

SHA512
2b320b07715c8326f870a649853aff109d1bc3fbd4b7e79363dcccb79a42d3ad6302e56ef95d769a3a37db7a5c606164cc2098f6d3e4354d04ba2b197dbdf775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000bf

Filesize
41KB

MD5
503766d5e5838b4fcadf8c3f72e43605

SHA1
6c8b2fa17150d77929b7dc183d8363f12ff81f59

SHA256
c53b8a39416067f4d70c21be02ca9c84724b1c525d34e7910482b64d8e301cf9

SHA512
5ead599ae1410a5c0e09ee73d0fdf8e8a75864ab6ce12f0777b2938fd54df62993767249f5121af97aa629d8f7c5eae182214b6f67117476e1e2b9a72f34e0b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000da

Filesize
137KB

MD5
3d1266d8ad482c9a84c35e0ac951488b

SHA1
59639f696eaaf4d135ec0e26912852607be0926e

SHA256
9524167b3c9fb36cc495e0a02320651082bb631e726191380694bc7ad40170e1

SHA512
cf221d5ddf5d77765452d54214ad2ac6096be26f26b3dad12a8755e023a757a9a47c0cd3809da244a79b944b9d460244397dd7545a7e8f4ccbea76adddcda2aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00010c

Filesize
45KB

MD5
5f641f7f081088a82749d2e785d2dc6b

SHA1
c64256398bcd65dfab1ddd9afed9a09c95bcbdf0

SHA256
06cf99bee9f87d5e5f35368ae71756af632afeba6a72861571d8181f868531e8

SHA512
73575cd02be6df4238afc55e32bdb287426350437336810dcd85741d175f84a999c8039ac188a21264c8f63a69c00fe324a7b3d952d858c13e4c4d61313b5759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00010d

Filesize
40KB

MD5
efedab56be5fa5e0487d0521219af25c

SHA1
71e04c4033c38970afd949d879e03641293f5a6a

SHA256
1682492bcb8defe661a1df9438b49c84b96dcbed42a316e564e9424f13c7ccec

SHA512
d92e22f58a7d72d3ae2803a47e40842f143c219b5e90f094b3087adaadc119aac10eb3666f2e3f2db95c54a756ff581cb69db60649534969001dce80c725b6d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00012a

Filesize
38KB

MD5
084a7c45c750134bc52120929e4adfa2

SHA1
7caa207a66cb97095da77cb26bc03c05e3e3e3ef

SHA256
d897e13540624694573d596496a442f317069973a8bd8f9464b2ee91406fb990

SHA512
6aac3796f0435096a86e81ef9bdcd0186ecf74d35a38dbcd9d5c08662fe707c50d015453bf7eef1cbdbade8fca2779aded56bf3a2407a5ae97fb2a6eb1092f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00012b

Filesize
37KB

MD5
908677684413f5278249c1b08127d6a0

SHA1
df54a142c7eb47537509a54a8519f1c6c82d0965

SHA256
49910739da15aef97cf1b1fab8a1c6817991542d296c3fe6619248258626330b

SHA512
d6458614c8cf209da33129d5672f4eee9923bb56e91692c87a0f82a0e00c0ed0c03bad913e3ebfae7dab32f76465e58289e15e579bc5f8af37845ab250301773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00012c

Filesize
20KB

MD5
4e786ef6de6d058a7ee21d714b5878f8

SHA1
a25cf3a4ef2c4208064a295fc00bf84be1557e8d

SHA256
fd7a0097dcdb4360e99e3131665aaf1cdddb65f638323d8dcd86832ac1c65b57

SHA512
79f32a2fe5204c324bcdfd5b11b3d7423cb8961e61350ef8b1a40390212bb1f2125be11aa9a8761edb2fd4c760a39c9f18394a8bd8bc55148ff2937b4ea67bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00012e

Filesize
18KB

MD5
2e23d6e099f830cf0b14356b3c3443ce

SHA1
027db4ff48118566db039d6b5f574a8ac73002bc

SHA256
7238196a5bf79e1b83cacb9ed4a82bf40b32cd789c30ef790e4eac0bbf438885

SHA512
165b1de091bfe0dd9deff0f8a3968268113d95edc9fd7a8081b525e0910f4442cfb3b4f5ac58ecfa41991d9dcabe5aa8b69f7f1c77e202cd17dd774931662717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000137

Filesize
19KB

MD5
46c65c348f90aa174bfc5f9dbacbc3a1

SHA1
f3f1cb408e89e48b14532730632dba27858d2676

SHA256
0b36587fac66193c3e84fc32c4edfecf3b9a8717aafea51178f5480239bfa008

SHA512
e18be3c74e039ff4297313b12abae8719e26eb852724a46f119121d008a7165e249bc17d17b3275a108e6de14b1bc443a7827589bc4fd46d616de699b8294ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\02735674612cbc52_0

Filesize
1KB

MD5
9b4294a207b99d829069c3d3329b7842

SHA1
4241c4e08515ef01ac65bf4f4b6d04a46f035efb

SHA256
ce9bac6a52883da1ad589587bfb9f2381dcad431c2af49e86f091b8ce45c7e68

SHA512
3c7073986b1bcde7162b33a133da083366cb65c584442a238472c8c1b5f2eedf6a2fc4743e85bde70fbf18905cdb98b16d21b65ef72ae74af239c87673f3069e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0373765715b33cb4_0

Filesize
294B

MD5
1af14ddfcbb4906ecc4a9e94446c94ef

SHA1
99b4467575386f77c56eff8e53b154811647cbec

SHA256
93117ae21c0a40b52ea5b9180c7d7aa47b7a52165715d6799e97d4d1646f0426

SHA512
df0c6b2c574c391e351bc80b143de4146a3d8053a7efce02bfe50c831d91c06f828e4028dff1c43fabc3e33fb546e9d55cc17d3fd17a6432f201470e11742d6a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
2KB

MD5
7756dd0fc8e4139b7710ca87c89fe94b

SHA1
efe4288f7e2c01e6995764a5c3eeee4d90c2c9d0

SHA256
17b92468b4c3b72b9e41c67c4594b2d679a451fd8442f961c6248945304a563f

SHA512
115a4fdfc7106ad2b465c2fa5a386e3c3b72c36ad52f77dc18b8d07868de5f54fc7f22340d0411d41d6d71629c653377cdeab3a7db961ab469784b2652c26598

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0d841345b724567c_0

Filesize
4KB

MD5
5f6c73952ed6b2112f5ddf4261656d9d

SHA1
734144e4a6e148658343ebebad8c8ff8291e8554

SHA256
a1ae85cab052c4e02775782c32032afc36db48e0ddfd4de62a44ef04ba9da29c

SHA512
b97a3bc784930bd3f46732b5513fbf68ed82d10b80cf161a39a4521fca45c628a7b73d483d001c227cbc2427ee9d3ae2bf4a6ce76f99f1a181a65aa63259f537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\10c6494adcdcc0b3_0

Filesize
2KB

MD5
d0e00c0af36d662aeb723bfaad8da306

SHA1
acd548f5c20bddc9e0c9a9dca18636c723c654f6

SHA256
13a40d30e4cd3492fcf6b421c8456840f56ed308b4d524c12e978f8ccf0b786c

SHA512
517ccd0690340c2f8638730dc94eaeb32827620f944670a78520049c2065e41c58f6a578d8beea22b9461f700e06427863b1460c74937c54ac7b3520e92f1c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
896a429107690058e80495037adca0a4

SHA1
5e60a4cb771fbec618e2015731ee67ff5bce8ebd

SHA256
bdbd888262188364cbb80206be0a6a31316dc97132b41c4525aaeb6621ad4419

SHA512
496825250875f98852edc30958e0f49274276f6dceed2b81f4edcd00e1d7d3fb4055829e631dafb2c68ffa802447cca1a650d041f7160cb7268546fcb7f52f0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
82b7029e370a4069c1375e42d89a085d

SHA1
287467af05a50e3bad235c85260dcc17d40d016c

SHA256
18a1c18bfb9ddd61de9c7925c1728d8d072e40d9b9c5a77343e99af7fd2849ac

SHA512
ff8f8fa7be33f4ed0805035d848f64f6d639d23848fb43097859e8c890e38fd8b1730bb43388e017694b2a55c8c0086d859278663029b486251ffef72c76794a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2b7ffcd51b01561f_0

Filesize
3KB

MD5
b2da48fc9584dddee1e2be689df75c30

SHA1
a5e20c963f39d48ad58e91020fe4fe9aa52e31d1

SHA256
c08d6719fee4677b8a2dc7dcd3fbc5e4a2cf84f5f33e0d6cfcafa0b82f1304d3

SHA512
f112f9db45e05128ff66668948a192a179b2ff92652570950076b6099b68e34b20cc2319562349a8f8eec0fbfc18cc20a819a745bd7837a0032bccd5170250af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3c21906ccfb9f208_0

Filesize
14KB

MD5
6068eab9bd0d3ad0d413ea94926bce53

SHA1
091adb343b79a0fd09355a73ebf745ff8ff9b5ac

SHA256
fbdba7c969b7dfb0dad2d403c1494af427810598bd62ce19f6f37dfb4f9fcb34

SHA512
58cc11e64b083e85fe2a9574e4889c993d01f8dab733bc386f28eda1c772e9529757dd78c732f55ca0a28fd48d6c41d6bf743083f97492a3c85bf410911056a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fd2be14abb3904c_0

Filesize
1KB

MD5
3913c148825d784da38243aeed1028f5

SHA1
2baf55c7d118a525dafd77b3efc2cf72b3d2b600

SHA256
a6650e3e6faa9a99ecae67bddb378350932df6644d6b9fa55b4e326a5926beaf

SHA512
d566a8d979afeb631adb584bf7e71c234d822ee717f8890403b3dbc46c18fd55e61c1e2f20c8994f1e41c656341db7a2b8b043efc797c899da829dccf3774ed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
f20bbfa01567a7b6b6c2987337e64d4c

SHA1
b24b0f391fcbeced023fe6d4f87f1b9bb13910ed

SHA256
6a1b143a66256e3f3761366c7815f460a72519c753df97b2bf2ac050992b9f69

SHA512
e24697ec02063a49fcf24249648a4a08dc6558ad68329b4fee492d49c84cd5046457153e7004741473e8cb59e7ade9604fa0edd595b557223d5f8e70ed0678bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\46d8591239c0d052_0

Filesize
2KB

MD5
02bc0ea999e0bf4af7a987679e0db4bd

SHA1
e09c5e8ab07fd19230f97a4fc68b77524c027c78

SHA256
62b27e7d31029ffc45c54486eaa65c7ed300343ca7c3fcbee6fddb4d692d3914

SHA512
35b329c990f96da6bcc548b60e6c870b4bfd33dfa247e2c9d525093b9fd58bfdb6683a04433099e176d8c328573aa1922159b5a8e08e5eb9686614cee624fea7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\48b1105b4c2874b5_0

Filesize
1KB

MD5
0aae6dab4bafa36c77abebfd8c0522f9

SHA1
4df1db34a0e5416335a42a60f40b498bc2467c4f

SHA256
cba4ee752aa61b70f9ec287e6e5dd21846147f5cfe98b8c37a00d2a26393d054

SHA512
f55a0c28269ddae784e26474e665efe28d749fada0396692bbec311e0d411532c42b220ebd22fbaa1ed7d6d624f990c49afe7d37055d10f7de05ed33a9d12f0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
28143e3b53feb347f00bfb7f86de7f9c

SHA1
81bfac81cd45ad616e97d3779c6a38d06fd8ba6e

SHA256
d4319308d825aa27ee567ddbd9e8a43c5ce68af26f887e6320e5632df4a8a8a3

SHA512
9afd89fd9073ead50b3717b8d091839bd6eb05da05e7c49aff6b5ccecb774eafdd277eb0aca653d1a61e053027e40a6c087df7a6b896e30db42731af302ff01b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\55f8738cd29603e4_0

Filesize
199KB

MD5
97eea5b02fed564eae57686b5fc65751

SHA1
a37763ec9328e45bcb4e134f031b4f63c9d0572c

SHA256
651e75d8a03a346f2720d38665d715c7eced40cd1dbe41788f246c85ce188736

SHA512
63effb7f2b11c290937516fbc0182468c387774bde443512a14a95031b29d9f78118631422b64e6a93c0ac264649c4f40bb9394b8d83b7de1e1ec3fbf217fa0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\580fd9376c2d4a3e_0

Filesize
5KB

MD5
7323a3e203d64453e55b2ff409088506

SHA1
ba1959aa3266f901d1d212f65730ee8e5bda0667

SHA256
c08b35114be2eac00272f78c9cf4dd7699b46a09d869ac502a54f506331f9262

SHA512
31266a2a6465fca9efcd2edb322c06f62021009276d0e34cc3a62b3892260503168a0c2e86b3ed18410dadddb61c0ce5bc46e5d54a749df034073ecc431de3a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5816c13a19af82f0_0

Filesize
73KB

MD5
bb40bf6836b1681a90365289b7a28e98

SHA1
8c759bb79cc1456b45a8cf7a04568be52c1b250d

SHA256
47d0a0dcb5ded3c72b701e209dceae32dabf7a134f7c697cffea7bc1c393d6ce

SHA512
ebd385268eb76ef69183bd2c58c71300911d9d8c07511d18f9038f1e7a176665c2e5c9c2a41bf7a3972e0fbea498fc114b6f40405559f6e52b3ed02e0a1df03a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5a994fe24b451732_0

Filesize
4KB

MD5
06c70677e805a3c9386c1387caffb57d

SHA1
81aa1bd58fc65ad89bf7873c866dd15f399fd90d

SHA256
68d9ad43812765301ce8b80ab813c5cc499b12b7d5ba93531a89133701a35339

SHA512
9d5fd31fd13991bfdbd14a612dfe3f3ad8e0931c47ea8900a28684df94cdd4bbe5b23fdf9086e363c256e02da156c3dd1a7c5ef2d128e768f04009320b67b788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5d0c04f9998369cd_0

Filesize
3KB

MD5
0998a763c03d29db1ebdafe88e0becfd

SHA1
60fd7488ebd3ce5f0a6b9d909347a963a56ea6e0

SHA256
32247856f42f67d2a1587d12b4a3309510ca827abd790d2c98f72e3a8d5f1ccf

SHA512
71c077d352c07646101e8ffc6a71e76afeadef954787a63acf864e1ccd7075266d6bbe710a065a459805db81b38ee5205f0a3983ff75dc3bfc9e2da108bc1379

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
2eb0d122c456c6f732f4d90d6c5ebcbf

SHA1
33ff24e60824960a22b13694d7cad4e147459295

SHA256
14f0aa3f9d2731e9a30bae7ef078868bc55d5f03b8fc8df2f526d312d8b29d53

SHA512
d3c79ef5880855f8e274eef1f38a3a71ecbce27417f37bf28bfb79fa47f89c38bc7f57becdc8a879d811195edb7ada7f8a93169995f86068533addd210149de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5f2f7215c4577808_0

Filesize
175KB

MD5
f0be7eff32f4d90c5738846c13bff424

SHA1
f3b1df8f0e6f13b0ea41c8e3c626e0506617de02

SHA256
a70e76a78c1fdb693e28396ce51678e4b40d0446627ee256a7cbb87615ab6429

SHA512
75ec37a2b77b2e26de66374d32da143a24dfba05dc323934c66f730ccab9a98571db671e129b9abc5bca969e4d45d1af494340b1e744657c1e5e09df1e5d8a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\605167868572c6c4_0

Filesize
27KB

MD5
e7f17785d3f42e2e1e9763235a135387

SHA1
ee2a23ab26116b9b6cb462e8f218c90ea5aae327

SHA256
c10aea41640a6341d3fc45907efee3e7d0d39a52aab536eb16cb48b895a9ff0c

SHA512
224e82c446b88d5ed28e91eb2a1fe803d54fd02baa1446be78ad844f9550c452a79f110bd92a9979d5d6b26e1eb08ff17aed9367baa4d215adcff8f48362d498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63bab61298dfac24_0

Filesize
26KB

MD5
408952749be1d92b13a743d6a61c1dc0

SHA1
d8cfce08e4df0d7eb67dce4504201754d42399f9

SHA256
ee91ab633f9dad399a6020e91f6d86ece0dfd34de8b3e2cf5a8d58df2ed3df58

SHA512
6ae965f9f84772fc9bfa14d2d27e116db3186c72c7c140c3dbb5db8964d7b265e2f85edecb5d7fd709b2c567dcc2e7b9dd4e55e20956d856d2d0c40568c9010b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a26de030ab5c02f_0

Filesize
21KB

MD5
6d8a16c7d971e6b0594200264a2270aa

SHA1
4456332862daad0beb591c32348eefeb60faad54

SHA256
3a16e00a01f19ec2db2156cb103fbb3b6499da7e7578b28cbc7f860250d6138d

SHA512
f65d9a652121c4d6f993ec385e72ddaaaf00584509e88beaebaccb22052fd42e8fb38129e2b669a4b4171a64a2c321e7621c565e239b9d83c6a6e1d99fd2a071

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6d3b0ad57bdf7db9_0

Filesize
1KB

MD5
0685d2c7a2e7d6e59133ac4dc198c495

SHA1
be7366cef75f3b531e4aa383adda4f35a3ab3e21

SHA256
f0bc8f41e3de287ae38f09fea08f760c0c7796b7410eba9e76e86fe62e48e4a1

SHA512
098f59b308255a8ec7ec66fa263cd2d37097b1d75da2d0ae227e92ef5d424f59516d196d7a497be8bf9d3d3b6fc6004382b97d215740b81cc521f89811360281

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6dd39ffb80e4ce30_0

Filesize
28KB

MD5
94ba274dc726eab902d07413f6e79f36

SHA1
aa79c09cca8a7b15514fede59a796de45b43d7f7

SHA256
b0a7a24072195e1a34162401442f5c90ab2d693c818e994986d0bec4a183be5f

SHA512
8bb9236cff487990ffcda49d8584bfc5f0ebd80d8a61e3507e7a24ce47d8b4904064e0321f261f7cd30901818230114d3be72d05e50bdddd4ff2a7e5e04659de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e1427d19ff38087_0

Filesize
3KB

MD5
bfdb1a2fe5c291b05cff932d56075fb7

SHA1
7f22d3d707ec7ec344b826c18bcc28ca36befa7b

SHA256
cc8b58eadaf07388a916d32ecd5916f597eed63b5df1f080becd29216f859533

SHA512
adbe0b24a8faf0eedf1b5b62fabff840a40b198564a91e882722850a11fd91e09cda4d674678a8c17e0044a4e511d3bc160de3aba84ebfc00c385491bbd38ba7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
7e921805175c8092bec853673b1125ee

SHA1
82ebc5ffbf51ea9d5ded2909b4d58432f33e8783

SHA256
cf1f7b12213ac777d6df9d0efc3a3e6d8ee44f01b18e7742038b737f6082309a

SHA512
1bf093e1fe395a6b1c74669389de78565f03e31ffe33316cda41e42518c74899823c9d144fd16834f77dd56f1b8604bf19ab9a87084374759bc6262a5f9adeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7899d2b49a9daab3_0

Filesize
262B

MD5
60976b4cc14c6cabc6afe545b71b139d

SHA1
cc30ddc2a048895ce09151fa26b6576953fa9e73

SHA256
024d3cc246d5f07402cc7567ea3c6c72b5885d1b247cc991acc4835ae08941e2

SHA512
363dcba781e9bac741d2250764c58eccc3b6f2eb0394908a1cb365f807c4ae30100d444d3be534f4cfbf9071bdcaa014e6c3df6424e0cf526dc1a94f3cc559fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a66a1246c4f29f4_0

Filesize
9KB

MD5
0b541b506ead7fbd2a6210c02cfbb4c6

SHA1
d2002bcfe9a4b78aa6cd9de1010184966451112a

SHA256
f900a7caf80ceb84d85045b20c114c10daa2decef3ac1a761fc172bbaf85f5f5

SHA512
4a37c1e101de22805fb8a008033cfb809f5db9535ea5ddc030bfb7fb5050a9d2e73d14f3c77efb2ae539be536e9d38eaba44c5e9f52b6da871a2ef453b5d51d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\81764cdb356c9506_0

Filesize
6KB

MD5
2b0809b51f63488abcf76c41819b849a

SHA1
c7df79e47b30e5959e2f57266e7bcc8d68683783

SHA256
f75e1b1f1f05ed0699243217c7fb4e55f1b5f138d16469600cfd5146da488aa1

SHA512
71714de4b2942eb93f63e7c4790f43532ae4eda14d57264250e392b195d0e6e9aa0a07170e2c1a80c3da79c77f637604abd12176a279fee06a948b73abc54233

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\83d6d3a772bbc707_0

Filesize
6KB

MD5
5ec05d856ac0d96ec15938c952b30be0

SHA1
281f5ee4b15e71fe2c2b5d2290085429e247505f

SHA256
02526737569efe3b96ea1275fcdd0fff161eedd5d9c6c835e9abbee0ae0b92d8

SHA512
5d82779be111e16fc21d8c067cf4a9f8d46ab28387bb49d29966397ca8c8ef600cb22509b529daa382a0dc2c29c31042ef34b093b9337680f73fb41737da599f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
c712e6510b876c944ea77d447d71d51f

SHA1
3ac991113b140b1a528f65d10b175d2abcf776b5

SHA256
4f10e4afb40801bad0963ca6df81aecfaa502ff20aa8533e1fe7fdd360c571ed

SHA512
9fa31d065c78604d748c98f673618398948dc76874d4517299b3781d0708ee07af44342190a4031e1325cab77bb6ffaf30b7c6baa6204f9bb52f7328e8582921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ee73a31bd0cce7d_0

Filesize
6KB

MD5
038a48f407fffe6278b84a67c69041e8

SHA1
a77fafd21ede20e81cb98086d58fc9530998ae8d

SHA256
d147ef55de76be79f9c96cf3c7a0c924c27278e42d54c8b78fcfc183c1c5f6e4

SHA512
29b1cb4d9922364010f492f794fb38d1ea69894d1a11626c1f53e187fc8b0ca97f679570cafa949e47c100e640a13c2378acbf086e6c068f77a0c3bd509c8556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9412c8b664751f90_0

Filesize
1KB

MD5
5e7d76ee772189ee1b3d838373572771

SHA1
a21f4ff127844d01e3ef0deafa03f0d29f912360

SHA256
7b77a80b088ef7ea2951930529f9c1df502e23f7eeaa76a9c33e1724186be28c

SHA512
b412376d5ddf64b76f1c94ec6542089ee5aed5c646f68426ee8f58772b777d46833fff3bc94713e635cf68365d511a1e9a1a9b1c8fdb14883abb7ab23f1fab0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a267665648440b9_0

Filesize
6KB

MD5
23ae9b77ae38da4dffd6b771cb5d201f

SHA1
8c2458449f5d405a01681482f92cb580e4e306b8

SHA256
9d3a583361af421ceab25c64dedd81e4d15d99f5b4b28d436555cd3d40195f54

SHA512
75b8ee0b699a53074068d07ba67e797f1163e185480f4c7616604e4f56ba3090dfc5276700cfe5c4fe1ee7cb1af092d823d9dbd0048852e49a9647a2618bc431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9a93a5af80c0c9ac_0

Filesize
1KB

MD5
8d82278a5ef899be444a4072f091191b

SHA1
1a0e8075868ed6480d9941ff7923dcc762a79f37

SHA256
0e591b97c0873fccb5aafde90fc4482cf5dae6545450d23e72414f5d4e275e53

SHA512
ef179dc7abb24a31eee2392293b153656c8edf635bd37eac5432e3b57dc9f1e7622b92678dd4f98f955902b92412a456f172090509d6e2de89bb0538746a8721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9d5693ea0ce7387f_0

Filesize
289KB

MD5
24b6a5bd0b15dfad7b90785b7003afca

SHA1
86be8dd488c56db61afe1816e1a91c2df4a62dd5

SHA256
b26a17de11817bdf5177f0f98f2597d7e9759086da7fd42b2114dcceeba64d8b

SHA512
7ef1c3e212b50ab347d3fccb0d755d22c80b81a77eca98a6d396ba337fe8e2f1e6a7b56b5a5a748d2df3811d857be7ea2b652928c9b654277cb7f1f886c5eadc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
b5637d3087c3fb2d4cbddeb3b8eab1a7

SHA1
a7b453ac7871591a4e0babd93acb8547db532be7

SHA256
533f608a997be2fa9c771bf8c8dd64b79cfbd4c4ac6bec9c6e5e7ea01d0f7279

SHA512
a5f75f04286b2309edc3299766b72844621609c4a2e6c0d6827353fac16857b354149db473ab52cd38b6acd36544a65ec65944b46b9108844f7c81ec0597ad0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a09f6271ad0c4092_0

Filesize
47KB

MD5
77c90ef312cfedcc48578c943b86fdfa

SHA1
3acbb9c88e8738822396fd3038508b824a67b1df

SHA256
ed2a9e2c2e4b1ec94359d2c979f1d77a652d76a7339285ec8f322978e38bac84

SHA512
b4beefb4b79d3ce8949378de44d822a1e9625c5280807fb10aaec80e2007ececa1e8ee15976d049e8aa17b42d21e466f239da051f40375e8f0bd545f4da8c72a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a267b7c21d8b8c9c_0

Filesize
9KB

MD5
b96de20d322602c3ef1a3e056a84575c

SHA1
fc3172a753b003ab5ce44d51206ddebc4a52cceb

SHA256
fae90be31618d5e457349a5dfb2986d2da094a28c1bc0a7dea944e5871b873e6

SHA512
f457e9e3c688211eb089360df398c26db0b820fb53664d8d693202dce3afe8e5c44dd04f4234b8474c18331ccbab6f991704b6754ae3d8e3a55c691053cc47bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a67769912ffcf13f_0

Filesize
7KB

MD5
e62664e5c53208a11f5106296d379767

SHA1
b04e7b06320f490bb5262546778562b3090f30fa

SHA256
1a0eaba18c9bfcdfe7929c9d10b98adc6311a843ad36ae7b3da1fa990a23ecdc

SHA512
f40da0b940b16fdeda21dbe4a36f100e82377c49e98fdb50681d40f8629bac8f55ff12d28d4c5b8918debf9d06b338161889034e1973176e7ccb3a59bb99a551

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\aa5fe3b36e22e31b_0

Filesize
3KB

MD5
422c25bb8760cebb387295579cd36120

SHA1
c303d78485198f9db425abaf20d03682c634ecd3

SHA256
db0340213e15dd2cba84c8379c9bdf2a6a331b01592f270eb6c49aee27c5ed39

SHA512
8deebd21628f87d4a57ffa75347d3cbec98436647fc63ade8575faae914a8967883436f46e4ee4d7e66642fd02888742fed39a2b2462a78bdc06c94a941d782e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b3e82669a81c981d_0

Filesize
2KB

MD5
26239f70253b68c08625b15747a25f05

SHA1
58fb569510f788de59a1d6644129cdbcf4b1337a

SHA256
19963fa4e5fd1a096e8b295d786e71d68539d2364c9f2a7a904e5d527b15c088

SHA512
c99f9810d64bd461a5ce92ab6d4757086eec7985851444ab8df3178c28e2ee721499d946f29705c6b3f4e89a2b20722e6c2bcc969f5ec371f41e51cd1aa4cbd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b9c1eb04784ce0c1_0

Filesize
3KB

MD5
4a3d39a0a4445d430127bf6860a6c844

SHA1
32cd21658ec580561da0e584c2d67a28b768daf2

SHA256
22aae1eda9163395e55161c6d430bf5db2ce7dbca0cc4930ba203a31d9176526

SHA512
f9a71581c076f810080c8da27fca649f1685301748d116d2dcc0cc2c10f441b88b4fa9d84fc2850c62e4e91345d3e454a12f1a83f099d025b8ac5118bdbb3139

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be06b2b8f2f859c1_0

Filesize
18KB

MD5
50c29a7ed27946643037d714809d0dad

SHA1
2c7abb9b674de4899b8bb5d00d352e85eedd4f0f

SHA256
b6f3db5fc883968c6c3cf1d26bca68a3ab1a320079cf64fbe20b154c7f03a597

SHA512
9e27721dc257e39b99d34cb430e841f052fe358fee95896c2c575e5aab80686654267f3342e5a6e0b4b858eda16e5cc26c7c7ef4bd35d7e1cbe77ba9460e6683

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cc2f0fedd3e9608a_0

Filesize
1KB

MD5
93bb78828fdfdeb99b0d35a34094f9a4

SHA1
f12d89ce319e3764bd40d3ef40ad3b7f4f6b8704

SHA256
7bc7d8528a8e19bddb0e0d3110112235ddcc4e98502c812c40a8904d298a645d

SHA512
66a34fe6f257e1f66b26091ab78a2d1fa6a679d318ebc980e76025a57bd03b9885cf0590a95e47e8de49d4ac1c509b009a189f7390beca942712233c24c8dd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d3dbb3008455b523_0

Filesize
262B

MD5
5b15050d2ba0987040576d6c3acc8594

SHA1
77f8cd706a0f3b6d191ec7a3c16f5bc409995435

SHA256
362fa1723ffad184fe4349ffecd2fad87d5fbabde554a290e6b0230ecc1bdb64

SHA512
f225be88d7fcc251960ea11a634fcc7654ca2601c449a050b53a14d774aa81b3dadddadf52fdb66b4b77ceba29927e2953733a4d8742eead3d0965561d53bda4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7a29efad91a1117_0

Filesize
262B

MD5
a8a0db37036fe1cb616e851a66d938ae

SHA1
c6c007167b94d0c72f1409e16c7ca7eeca072006

SHA256
e948d18e5bb1cb373bcd6d9f5b6a205d50c71afe0e3a949fd04337775be2895b

SHA512
06cac8bfb1a96091aa4df21d249ca035b092d569e91b1a1ebc2b2d8c5883ae1860ef020a6b0e1411463e2257cc789f2387d265905eff1840b5cdf0d74666f162

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\daea348421cbc209_0

Filesize
2KB

MD5
8cbfdabd0ae8746b65bcadd25e3a97bb

SHA1
0c9437bf272261fd7d20ba14399d8e566cb62815

SHA256
69d7767c9c10cd91da159431740a95cd9a3004ed6d5ec84accc12c8f60847cf8

SHA512
4f0b6c4a2f1056c2f7dd99d9ce5ee69f48cf3e4887775b3cb2fa4202c51dc48ff6909fa9b717851fc00808c6b5535de32dd6f31c9170f787efdaaea89881423f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e4f85019800026a2_0

Filesize
8KB

MD5
3aaff494fb6f424a3298763ec234a37b

SHA1
0f4fe6d055a2753afe6d486311c1f1e9d7ff80d1

SHA256
1c657338edddc0a2cad48a8f6f12d96b53dd74ecd1589363f2683ab1c9b21bc0

SHA512
3216e4ea3ae61f9bf07e42b4822802d6f762a568b08f703b2489ca004a9ed9f55b4908f21a6d99cea2423b0729692691fafb5d7b323e8ce5af8672fda183a843

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
ba749b35fc70950eac50f5af8ba4ccfa

SHA1
91397c66d8ea689718a6f82174cd3a45c12a8704

SHA256
e223acaac4fd6e466911eaeed35a94c1e269a83350e7af57549d78eb930e3fbe

SHA512
84b37a5d0b3fa6546d128bcd9b69f1b0bbafff07d7351896ca37611d15f2d625c4a508bcc6289d114a0e44c53b48083dc4d412fcb8a28b7341538013117bc051

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
c16e38cb8beff20bd4da9a91da57ae70

SHA1
b9ddcf7fe630ea116bd1ab092404964e94796833

SHA256
27f198e5048ab24dff582813da5db0c9d2c8d40994ce6bfac9591cf133eb0ae7

SHA512
a41793b8e1dde46962898a2e1db4e8713fddd886e73088a91ff46a4cb9701ebf77cf51471bfd4793ae5381b9f6e1e36e8fa460e07d50ac1c7168f93a7baef862

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
85a9c612fff94f67a97487b94a3025a2

SHA1
74c3b50808d11314710eff3cec8fee0953adc030

SHA256
be999d275052cdd10cad45de9bf007022d31e8fc3b8ae46b48c7e6864eca85d8

SHA512
e64921d2660b49f6883abb6091ebc9e24d98d2e25de3a047240f449becccd007a23b5fe68d8060ff12496c1b4c3181dc09ee6d4f8a94ffd1f7615ad1690d1936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
d183d3e6ee589f0545def842050a5d74

SHA1
01e3a4ac698b22d86b93911a1d40f582530d7b61

SHA256
585a9887ee68b83990825e6de0ab6c5768c9e98b9b893ce129fc2f7a3be443f7

SHA512
d9e5ed3f0151e49198b2dddd8861fcec7a96d338a92e0c3a92799a3a5d313dbf67434ac9c424df2bc55d4a7c2418b1e6de84ccd719f712a1b56d2c5031a67560

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
62af3976121f9caa391832c53abf6add

SHA1
4c9e87ad461b916132e82487c28d0915c4a30e09

SHA256
13a30fa786ebac57e8495a459080e00aa67d12f559736e1e8db3a24d7a02982f

SHA512
d901abffd016942c2217e8d8d184c3da49751c566135fa5029fe8560121731aa26019ab2d61871bb18417024927ec441ad615f2cbf429045a74b26e296adbc3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
a890d4ea9997605f33ece7aeda44f8e8

SHA1
7fb4b40a4bb7692555363e1acd45505b997132b5

SHA256
ba483ea491b5807acea1ad7e36d15925df3b4061d3436cbbc9949792cf9e7d0b

SHA512
618b8fdc88defc12ba12082d77dc53be4147df762f114dadaecfe5d8f3197b178735a6e9173e7d87e0a81765de81dd3acb32a300df0b5150dc00373d678cd63e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ff090daf11bfd58cf4794565463eb8c5

SHA1
141fa3ec9a49bbbfc965e4f70d97f9657edf624a

SHA256
069d2c020190c11076a4891c18a76ab2b738dea500fe9c5ac890d535d97c1040

SHA512
b497256fa7ad0f267776fcf9a1769eeadb7952b1a59b4bc1f3aacf4463124f3b2269374a579ee911b8efe50d58a78f80d70b2d756d5edda0c3bebff0d5c4a89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
00ca426f8d30ec029cd50ffc293d590d

SHA1
a23b6f82691da9484feff34264c890d4a5273123

SHA256
66e5ac5ed2ff8bde61854e5d2841945665c9e332830d5382bd017c55c06f7258

SHA512
f574797809c2bc0da218813f14f652c7715b1b6309147967abab19a8bd08c45924cfc92ed77017225213e78bf3a598df50f321126d33a7e56e173df67b35cc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
01ed675d62deaa70a035e6944d994f99

SHA1
e864f5a713f18f632114342ffd2d4330bffd5559

SHA256
568c84a386a549d62a286ee6c069e19f9430e681c918f399c84c7169dfa65eef

SHA512
e8be413331a273ec135948ea38e669605c6e6e7bd358037baf1c1c7ce8eb41041deb8a17f192c625ba6d32bbde036099ee4dbcfccdd91a7aa060f6688ccaa09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
1bd76efec0856e058f5567d3d0d68dc5

SHA1
8b7cfb1b2e11c22e16ac3396a61043ba6aeaef86

SHA256
13ac9fce3440ea0792de0e72be075e4c54e6fbe7f7d6d3f8ff4b5cd399fb00a4

SHA512
f3bfcb56bec4902332da536e8a68d8eef66efd40fc585a29659a776fd9cdf667507767a305cd336c8cdcd61f3b5d5f0bb23c08c83c934e6804cea824bc043f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
84476f6b7f49998f90b741dc39c93a66

SHA1
141e88d49f4ada8ae8c155c72c87044acf90f5aa

SHA256
1e59d419fdd945e7fed165588a5ae3bcd87639451a04018f61a42fb6bbc3d5f2

SHA512
2b238306b9def4e1897d1ab6846ddd132dc93244feb569332659d24dfecddcaf19ad7e8bae5d49ddf47b79ceadf63dd05b7325d821cd8d650857931b9e5ac043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
88a3282ad3d8d3b0bbee5f7cb4a03ee3

SHA1
c7372a90e6d5c21345143eeac94bafd19459b688

SHA256
c074612d20a6ebb01973cdcce9a771cff828a89bc6a080f0067ea07140ee20ab

SHA512
68c8cf8c7738e9fad14627b5e87748ce108dcb84f7053a9779ac3e2e3d208e7dfd8d08f7cc69d7b9fba00a0e321a6f9a65f310fefc76503e18806fcf29ba7a4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
5d9539609cf209822603f140132118f0

SHA1
c518191bb834d652cbcb3e648424bdf96f142f78

SHA256
21ee5a90e2046dcb358d4daffa5516a896d0ef4f547c0c299926be8d814a26d8

SHA512
3e95bc6d5863bd7a363a459a6da6f548310a073cd84aee2eae51849ea0eed52b4993030f89e1feb811b45ed99dc8084ae26a00acdc6aa3976cf5dffb4ccf4838

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
e18a198d5e0369f2fdd3927ddfb0c236

SHA1
5463c4c1b0409a3b33fadc9287f7967efdca0466

SHA256
770ed934fb7dbeabd5f9a91c883b9f7f4ce179a2fe5e5facd3b06c6c9ea58f9a

SHA512
096b6888f8155b3d13708786653eaaeb9bff5aff6de316df1e65220dab1aab94e2d1322c5aece0e869a2c13758d534e216c9216a6c89a7cc6dfca1560090234f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
ee8ab386642956be60281f811a8bdf19

SHA1
8cdfd368ff8f59aa52570cb4705b66280f4388da

SHA256
18a66da695e89fc4292bc71d2754a7cad9b88907b5f5ed5248a9ca4a3ae90661

SHA512
d8c81e6655bd6e8218825cd5476b573a123b3108c18419871dc06c9dde2e5e2edc4540f4641ec524d679ea742d5bd9ca2dd38f655d990245786823d417152669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
642c231acae74402c07230a1358bbbe2

SHA1
d0b66eb883d06a2f6bec68e0cdb2802d40b7d30e

SHA256
364746f6d09416ee54fb08cc937081770ddeef4403b16e2d378afcdf8013841d

SHA512
5b3ac9e35a9fc858cf2033b11da333bb55594ac4f942a0be5656c5b9b1e4a86d3ef0addb2ef63e34665f4ef82640e8aab97e0bf698de890b0dd73c9421fa227a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
1da3830bf80c699e0c3ccae617ddbd2a

SHA1
8a9915f01b0e0ef49c6c149358f1a50abd965b31

SHA256
558c084c3de73318060a776ced80ac3fb51cf03915cbd4725e88318c0b9a496e

SHA512
811342bcee98b72a05cbb373858515b2e73ff4490364d467fb34fc55ad7d4b0c543d20dba604ed852b8efe844e73b199a41e49c3f5b2e7ffcbc8e9a0d6a4389f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
7KB

MD5
945588aeaa6d6498b20b0ddc0d2608db

SHA1
2fc83980d88bda9874f188930178ed52bd2bade5

SHA256
ec2d747dd8c0ed999079d6b68c10e6529148b01a513e0eb9da9a08c90e0ddbd1

SHA512
f39ed171fff35bcd3b410b13efd2805142c00f1f300d7da2a0aa0d170c2a209ed4589cb88a7eaec9c6e44b392374dad16874a6cca4502a684ebb8c2625d0e729

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9a09809e746bf6707777040edbd7d914

SHA1
cc06bb432e2bbdff3263016353efcc208e2bb3eb

SHA256
c7576cead1e9431db16b8bfa2b4513178a469a09c01bedc37c1daa15fc178564

SHA512
689d81ec5c5629795a90b3807834ae58a2c96b2443abd90b89cec7361a6d50ab79b8d94a222018bef806391c36d15dd989fb97883c157549493bb30a1620a803

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
258442ccfcde11807e4a77a1135b8555

SHA1
06964dec1641828a925e8feec966b66869b2f8ed

SHA256
d5a759a3b9c29022cb5a495ff663b3f350be1e8b5ad6a9304b9c7656386bebee

SHA512
9bb85629ef3962029f9182c9c99843bbdc5b96387b84e48ceccc549757d275f24266b5cb161c14309508aa4b07725161ff04f0d6d9ac0e2d7dd74cfd4fa7e9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
a4e402d7a28f68ae9fad2f74478c83bb

SHA1
0fb3ff2c8c02c4b9de91f9f7414bd1b3902a6e3c

SHA256
57792d2887e04ce6efb4787ca4dc115bdbf216e9b96e9eb97387acbc8904e153

SHA512
0cd821673da3121b302da79f4aeb0beb24c3a56de8f285acfa5caa16a8b9e465d879e54a37de54a31412ed8be37c6d9731b12ae0fa9f8fb6a5533b388c7ff1df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
78c4cd61f559f6d279d6cd0768b87995

SHA1
2e96b9bdf4bcd67aa513aa993503839fef78b237

SHA256
c3366c4dd9337b6ece780d32a81293cbc12286ff0cc96de40940d4b46892df0e

SHA512
9028e3a57e4d5f563799894b8c37348f8cea29e9dd25c5bf7ee3593c0efb3b3ce330b62db7eb65ab52acc76b730d1b62b0c6a2f2a0b4d61844928f658631293d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
11KB

MD5
5e0f7b213c7db3897262dc2f31eadc12

SHA1
af18d9013542be7cf7c9ed52c43c5141f451459b

SHA256
4478c8eb0ef3d41b74e1acdbf27fa6c6abde5561402da2df37309a6074a31795

SHA512
136a6cd76dbe53ee155f1f055c13201013e529a32a053987d3d030b65e403481165a66161abe0cf18d1604870ce7958d78bb4a584c21be8a43ea6a85be54ac60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe589f29.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
209fb07ad8a8cc621c6c57549786ee3c

SHA1
5761d896834086df8eb3efefd3a59ab76f0368b5

SHA256
3f5465104f7a1113df869bdf59bc7e8ae41680ca16af1c0fdfdd47d787e27514

SHA512
497c875f791543aa6b9108e301e535f2ce14d015fab2771588aa5c21a79c0faa29377fba1a5ee296f46f38947ea68e82de5d4166a126d14e7fbf127cebea309d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
362b91367cf59a3885992fc09f00be73

SHA1
9c480dbaf127aecab315216706459dc8b58c23b1

SHA256
46f6bf087a967a7b5616407f04dbc9c2c20fd02ff28f8b3121e284ce7a2dab1d

SHA512
5f4140b37f119e6e7b8fdd3eacfe0e4cef60115aaad46fb38fe5bb304a23218c46e89789c0881072963550e3d1f8ea891114782e225d4b3add66efb6e18a6791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
72a11fddf7b3b349086ae1477afe266b

SHA1
6b7985330912cf47b794fe392122a292f2cb8191

SHA256
e181ab4b876ed30151fae0f74ad2e213bb788ee5a07aba697a88fc1217d13457

SHA512
325a5e500dfa1fb49bbdfdf2bb8d3d6aa9ef7ebabe13af04e0cb9058d5e6fc328672d8c1c8e272b22b1295737dea74f908389de1203289c752da1c4db330bca4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
a51b28e0f9f0731af8749f1c33902466

SHA1
a02885a4dad6b19c15f98efbc400ac9f5443dcee

SHA256
09aff17ba0810531b7f8d3d69e816653776a42c8cfbc182b564709ddb55f48f6

SHA512
f5a4f5e16984a7ba4ad995fa5d9f131b912712b4fd01ae96064aac2a2b28aa58efffff28a9bd186f8cef6de7ce64acb6976e1f216814a42480125441028e66d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
6e9061a9c0e1b5ce08769e99d3973bb5

SHA1
bc20b075d13cb384e43394c0516bc31508ebc7dd

SHA256
19d1b535510a803cb0ed7b3dc5763aaa2b11e18794313c8205c66c54f93af25c

SHA512
8efca984b9d41369e4e667c32613a4a1ec05bb2b50d172563486feccf26024775b83ef8887280b75eb1ddff36dc50a71aae1b6e4e57671abe7ce7ef365d3077e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
0f4c652b868b484904623a8dbc0382db

SHA1
991a6a29962e96014ca660726b3231a8d3ecf05a

SHA256
ad3ec70522c945a19567aad10b21ad03a9ae0531273a72f2c876bec9ae281425

SHA512
22c8461b814433b3b1becba8dd1e50d334357e4a47ef769edbf9445f56ac5790fe8693f2b2f16f7790bf13c4ec31f99de85776eba8a959a96707637f5bcf5dc9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
95b5fb7592d6c9312994f13142d37b56

SHA1
774a84e0fce1b24e21938551e694e6c5cd4cfed0

SHA256
f01a42e5562a7dce5e02136ab99fe8a9180ea678401a747a7354365a94a14960

SHA512
5de0d0b0ff168cac363bb009879c6591e6174854196f1abef7bb3d9747a1c6888a1e45ee2ee9696a89f7f3f52786c0b37d80f329c5643091698d861a3507fbeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0bfc11ed06549dd962a615a4a8142ed

SHA1
2033799f1459c26595f554cc83c01495689d2fad

SHA256
c714e55b798443667368296af85645f4482d61c451f421fe51eec56d47dce97a

SHA512
68c8725fb3b9bf037a59d71cc2f7c6209ca8bc1f0cd7d75b3960462857f654cd5b440111125d9319f5e5d9e8ad2f18a5828962fbb345305f802324793ba749eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f5d5898afc70c7c5afc1e1076f6e2147

SHA1
c8a2fc0ed7f53ed390853db55a763ef4e70cf36a

SHA256
f1a7106202de32021123ba6acf3dc90d31e799df9dc5f790f0be2fad98ae84eb

SHA512
50f119b3c2bbc8937bd476a51827e1ad07eb16844e9fe3750c9bbbb729e2b7cfc7a2971d143d335d641feea90f073401f8de4bb2c6fbded266ee4dbcb7a09ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
1886e9fa372de17e2ef24a2be328d612

SHA1
53e43fbda19bd3dcbc2d0a8e45b77c7dbe27f09f

SHA256
7eb3c551d6c44da8e49fde704fe0be6aa714544fdabaf4e121be8326bee54070

SHA512
58148d1e3d9665ce7e7d094bcbe4b326a9925e4d46cab986c3a74e2d238b0d80ea343907cc4a4f3597d155d8550249a56916a99304bf1a11cd6f3c49e016ec1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
cc93da8eeb40fe3d4376f9b49f50cdd1

SHA1
e833a637e886b6df2b5bd04af29b6c75988c1753

SHA256
ae3ba60bb5ae031be48f1fbfefda8f387f93b2b7a4e2500a8e6a667b4d4e15e6

SHA512
20c31d57a1a654b654c43fcffe308dbff9ffaee226de55ab5940dc0d1c99090c5dcd098ec286642f0191e8c2b8c328190986975518bbba863ad91af15b618ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
45134110fb13c07ff647326df770a0a9

SHA1
d3b17d838fa45b956dbbfbac1f12b195106cbab7

SHA256
a41534c1bc4674c516f4a9b499d7480e1114db36405369f501941975770045c5

SHA512
34638f4cb6ab811ecfafcce6204ca9fab58a19cf0c317f653631213b7e5f3cea476aef57c7d3152b88acdc6d4e0df831e12943c7e4bd232557faa370735b3c07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
38a36ffd08bab68715565d076dae7ed5

SHA1
32e4bd20e365f34e2d52a2dc425d1bcf10b3039f

SHA256
08cca62e9a68ec86e3fe4f65d8372a81a9f287cb71c3cd07872ab3d126080848

SHA512
8923b6d96fb49ddcbfebd0f41af58e8065cb5ab108883d9dbd8e12f9017205b8313aee536c3bdca3a0c6f475676c9587737830ff13151b883c7326f8308cf698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
f9b65d8ba65bbe4b1ae2f42ac32819ea

SHA1
6658d60731ee9d20c2bd91773f54f153b89f4904

SHA256
ae579de8825946f15da443d5ac60974b34a6f6052c09bfe74e41e92179dc46df

SHA512
3a2fc6f16ebb5377e062af725cc719deeded592f7cc2b9c9139ac974393ec4a326e8223ba5311d149ff0df580c3080db8c4644b27a076b836d9aa16bf4f6c792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
d8076bdf5fd08e1ef6b82add55752e7b

SHA1
1c4a3f26f6db2eede8c518f83c35ac162d7d2db4

SHA256
b268469bf16e4660ff4a1138d6319be55279b40f46f42359fd0d6288970ac3c6

SHA512
14d6b985493b4548d20ca8866193488b5286a467b4d696ed99ab4210264484d15479a39a260bccc0ad9b6635c02b43a192127dbfda5761609b0475fcbad6dcde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
60430f91c23198f5be0e07d414534aa1

SHA1
bbb31675bfe8140088b194b8ee3cd45dfb755c19

SHA256
8efb4e92eb7d9fc55f75a3c790c400c4b0580087b8983923f1368ecd7ad10be1

SHA512
605597696671f54fb46124ea3960d35f850ec4b4d0067229d60a629f74b0153abb5ec8b8c19c7bde39abc582874fbd17a359910fd4ebe175f1d876825381572b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
5aed6530fbf841557ca154d0895cbe83

SHA1
d8ef278a7f2d77e4a9a8de34d218b2018e2f02e4

SHA256
d6f7507e2480df884d4b7b8d8e21f6e7aaadabf107bf835aad7cfa05aa0309bc

SHA512
3b5f75a0efa59a2a70cc68ebac47ac8ed2fb97a3bbf68ce52eddf6f14652279151df16900b93a1a396f9eb9c53908d36d8be5122525c5f7390d94ee42030bdb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f8854dab9ac0f380ff1aa23ed235d0be

SHA1
64c74109175d29a1ed5f40ea16bb3a01da4eebea

SHA256
760d734ad505bc259be70cc5d8299288f0020d46d1a6d6943e96bf16b1f1bbee

SHA512
212081a437f24a7b193413002001a5368aed2027a61cb05408b233ebd0c68f8d2ba4004d69648591d66ddd8b27a9ccdd8fd4878bb6c341865f2a6fe9be0181e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
f7dc54b3034f2587e91f0b2234a3c9bf

SHA1
1a795be84f232036426f2957579f583447ac8ad3

SHA256
947c7efa54522c588978fee45ebfc4cc3de1f56788d90523872c90ce07094459

SHA512
c30d916e50971fed8766f9cb0cf49d4bcb21dc787b94b72fa87b8ec61fe9bbc1f99334d1c698b982617be0350ea75540760b6b17795820b346ed5b894450fc4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
fdf4bee75293e4f62bcefbb2211ac6ab

SHA1
8e7e81eee90b158a9526784df19aca24a8706eb1

SHA256
4e0bbc765bc11d80ec3c2ea1e30b91e0652f3157a788493cec50107f802011fd

SHA512
b569078b2b3a2f5786bf6bdb013f3e98e2b508bd2e3609f0d960a34df56c9a94a8d9ea8c2125186095cae32d077bd5fd0b3e7953fac3bcbc9b0856b19d30324c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
777bb8c5e6833ac49af410b66c75553a

SHA1
b179a6470d7df326eb5d83aaf144e8efecc18b6d

SHA256
858475b493505a93837f352c93ad60e156673613a1423e2266ff0b1573c8af6b

SHA512
6fa2add5748258b2d190ce1bf212c14a8cd30781d2c5f339040a18a586a5497819af12a2db3d804d3ac162569701a5bf973b47a1f0b8192435264b3f8029c70d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
b25d294ecf0c89861b75b4ae52ab423f

SHA1
6e2600edf0b75207fd80ae8ea695e9322a0482d3

SHA256
b39aad39d46fa5c1dbc260b441aa413b783d3d7d4db5a1b44856f267ec08f3cf

SHA512
37eb1b82fcae8b80b24b7a72aeb658e08c45c3d75227519db1ac8355ae08b1406ef4e208e6355bb0b275acd0feabfb5997054681545630b00d805ab899024543

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a17a323673c2e15539df6b5c0438bfaf

SHA1
3f4c3f5b10e7efc471b5f320cf38ebba0b0a5d9e

SHA256
e31beefea61fcdecf5d8617e9f7c9ddbc4a40660a9d9b2a8744c9a1aea25d222

SHA512
5f020b661c346013822982d4d6294421a29c98468970fa26bbfe5cdfd37c87f871e484359d5cc94d78a7bbb5f201f34d32218ffab2ebcd84edc2e2ac1b025642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
e7cd728616f076ca2f5201faa1668441

SHA1
417f4f9a8153e5fa7d7226b54521d5ea34722a18

SHA256
3f250c1feee3be1a4cf89aa8d2ce4510943cb9411ed2b2c0471bda937e8c0cc5

SHA512
14ec3a2e93e4f1e0e8a5a8f8e80f70bf37cb7e75eb633721cace3863921d24349309cb38ac7c1025e69090b7d7e959368001a7010a67ce200c683f1e1a60a042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3b964859deef3a6f470b8021df49b34d

SHA1
62023dacf1e4019c9f204297c6be7e760f71a65d

SHA256
087debdcfba4666c03a5ea699e9bb31cf22ef4e0fad7c961cb0b500e5d262fb5

SHA512
c30b7e1b28820a5815b52634b46cb210c241704e33e41304400cb3ed29e82ec547a1068fc819350b368456bcabd27034afade5add3251dc74e4174f51b6c7adf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
5c2d5c900312f44e72209416d45723cb

SHA1
68fb8909308589149399c3fb74605600833fbbc1

SHA256
56f7a77549e5fc45bd4b1f7c2db3e8b4bd1dd9234545207613a80342cee8e7d8

SHA512
07c2920cff7c1125e3a2fe66bf21d8606a1f2a3d36be2d8e136da0d2a21130242ac8324f18cedfb0040304cf804815861767c969a6923d8db851312bf9b4348b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
2ed5df6126a319ec69804292c532d5f4

SHA1
e69da4959ef3297f5edd428bde794a07e9ecb35d

SHA256
d780f61e1cee4b7a3feb056a1e2f8e3ade0b6fecabf7279e99d2a74284e7a443

SHA512
e43534bea89ffa8173717ed2bba75c279e2f65a4be35891c4e029d05ae2be34dd2f8677aaa1ed90ec81a07af406df60c7d86f3cba768c3d6813419d9f80bca3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
b015e9b4aec3a13f5425bcab5e838ff8

SHA1
cc9259b6dc0c86876f8240c0289574a28aafdd7b

SHA256
e8767435cdda739d87c4ddd05e590291d0d7037f0b7db4378030045df9677442

SHA512
5a5b52323683746ebf645b60735b7c1813013d71df2809079b2d22fde99cbd57233fe059dadc26f28d33f22e0bdac863cfaa71ce75078d3f29e11cdc281a6583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5cfc3a.TMP

Filesize
48B

MD5
bdc794c55856609a0aee74e5887507fd

SHA1
0f707d315666b00e1247170e03bbbdef90707f22

SHA256
a54325ba2ebc941a2b90bba73a3113216fdabfffbb81bbebf25397b6d6492a95

SHA512
6ab29250259647e62ba58c9993612d30cbd95570d09e894a9e908c87724c6f17d07586757120a67a7355c63be83d3a91466345a6fe66205e0241f031cfd9f129

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
b175cead73f737d7195b2504f82dad68

SHA1
e650e7f21f9dc2577f3570cbc22fb899e6c91629

SHA256
b024b4dcb6cea599a3082fd2fb3563b4e325b15db736a007c7d727356db0658d

SHA512
a43e4109c24a38a6452b53dcd3ea8650f0f2158b5c924f7280afc5d77bde8a637efd2c8bb29e1fade19449ea2b9964f72194a72586cac47d342753d155b55097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
37356a2c3564d480c177e0be2a93251b

SHA1
31945dab68f925859df3fc1a4f1869e40c120c48

SHA256
1d0f96c4dafb870f0d08a5e9d88d86df2a3c9d8d4454d2c2f3c207257ba28dc6

SHA512
3708be4278e9f98eea1f4ee9716773df6251d4b1c00c809a8d19dc12eec1b9180c91e8d3813ac8d398bdf934abc69f4e6a4108db919930589e04ea3b35dc9151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
2c3d877766d261f97d38292001c2c876

SHA1
180aaf3f0a3eb789039e28c531967a88fb43136d

SHA256
e1bf62b827b7b006acdd0153372e77b13034dc08adb6e197c9ee62863195039e

SHA512
ad130b11fc7c2c20a8f917242e095d3512ad922e9f562854883aedb58f249610e3a803913b3a041fba07583fee7301416419ba69fffc8a461f703a2378305b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
361761459b61f86a748caf7af0676340

SHA1
641957143cac128385cf1013051bb3632dd7c100

SHA256
a0ef5f82d1c72d9dbd422f145b1e577e3fc0a811c4bd9dde508c35aebfef6984

SHA512
2530fbb67127372ea340a29bf35ad0bfe937edc63bc90608e49e6f091b67f18457ce449481fbbbe9dd90e60299b3c4f331aba3533d64fd7a5f66d9d50f1f360a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
22869a4113e14ed833ce23d519304415

SHA1
5ce4d55c6d507b8945c096f00db3c6a2b9b7f102

SHA256
169c5e3b32fe0f1395b1ff191b1ccee26c2c202705d74e4a838fe22224369501

SHA512
bd3a097c19e1490788b1003dbdb8082c864f8c80154254db23644fcfec238ca032c60d3aed3be7eec0ba4a55c5f162b0e36a2b37e6450faef5a80efa04efe4b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
b865e6ff3e1c6ffe547e2897b3fc71e6

SHA1
f15ca5407ce3470da1c9b0249ec14591e8231d46

SHA256
57655e744596f086ee1f0806421de60a1913f1bce4f835d8785e2102af43644e

SHA512
4232da6f75bd2c4583f9fd95025c928e88009cf0aa6719bc0f1d811f433fa090954de96b5f3234675a6f1d7720448387a667614f6867ff4194eab3bd8fb95b14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
14f68c483dc59e717882c6fdcde5e988

SHA1
1981c669e3920a81178893ca90fcde7b15af6ffe

SHA256
1f5b90a929ad8d477e8160a8e9f280c69502ef56b86176df59640479890c40a7

SHA512
4bd96ad9ec77689c488e123092ac7193550f195c3539bfc5f11c2f356edc8bedd0204c9a345f4630cde5f1ca669098550dc9c73c9c362f639509cdd3a8370afd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
b7c3c57a4406028d9d4cb00621e89c1a

SHA1
e657f8a18c1d2e8133c29d68e70d779681ba7fc9

SHA256
aef93cca303b0883b1c2e8fd4549e3caa1a3779150305655406d6bc93b51c216

SHA512
8c1f2c610e549fabc5a1878b34c47df7e35946371055d16987ecfd917dd8856c2a86460188b7de0b6a60a52fe267e79eff9a00d5fb8c8e885447f061079f394a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
873B

MD5
2b1b89d9d9dc362587e31e9dad9c99ce

SHA1
5641ce6e7645fdfc8faba894c13cb0d1bfd6892d

SHA256
96dde6d96f1216c2d403d676a721459b349debd42c5c7b43405738e7be92d464

SHA512
3f263948c3d784cba489eb61d380e74f264da9b1b05da107860ddfb68de88e9529f2364810c39387b4c5336404dd800e98b9f9b1a7428da3364a3d5bdbfe8416

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7404ae6d33fee3710713d48e209edca1

SHA1
6c1afd11709a722096153b58665332789b012355

SHA256
57efd4dea7c14993918525007858be48ce14171beb94778e19ee2d40de494a7f

SHA512
ed2f3611c6c4797f43653e65a8d568c715a117b44bbcb8e5d4eaa1938b7c43d4e77f398c24de774765a9795b821dae51b72dc0558b045825171727399041ba0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
83bd4d96404169d6d04fe50aa6bb4a2c

SHA1
534e4eea76ba1fc6ed81a74beb5180439ab0192f

SHA256
f9b1cb9379038c3c6b86f5a0dae9daa9aaa10838c6add65d1b0669c19d53532d

SHA512
247cf09b1171a30a156a92b6f6c3db59880d57a367a51ecd5de48e4e1e61dd1c9562f95fda6d1aee48d5925447c180a198c72951920e90efcf9a59f5dc97e4fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
544ea5e6dc2614ecb9035ac20d115a89

SHA1
2d55f90ad3aefe00e2a80bcb3e5042f28c9b73cf

SHA256
f9abad01a74029217860201395ee0ae43b3fc0dccc0bfbef1bcfd2a8c7366d0c

SHA512
5a5608759f1d720b5971c6af0b04dae7ab2dbad412ed2135526da21be406d3f9ae71ce321f738d3102409e1e13a38a991f8c48f7b1f296bb92b71b2b6516d6f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
ce525caa05f09b94b5cdcf18fd91de24

SHA1
19a80b611d7d61e28e7426aab2ffa124cb5202f6

SHA256
c2d02130cecefe17cb0b32a4ae54c163f9b3f5d0a1d93810e43a8069fb46f95c

SHA512
257c895ae4337fdb7f42ac53219c35a4e4ab1580bdbbed8ca62f9e78afbc3e1bdd64d994825dc08ca8e890966aa47f9dfe04aa775d5421ff5b1c63512562a74d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
d0ba442008329288f9d28bb0b3640942

SHA1
43f557de33790993b0ebb1748e82a64b724d9492

SHA256
3871d7a0c46797ba9f031569ce93eaa2830eb18d756a1d6a1eba0b221c30c157

SHA512
88679af5cb564463055dfb2b5c4cdc4bd95760b146f0c45d4bcd90187ee685b529aed49cf0aec2b55aaf55667ebc289aa396935654e507bf154a378e7eb12db0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9160b6d201a4f1c720653a4b394fde40

SHA1
19eebfa8ad480f1d52a1f59b45ac9f28cf6444d8

SHA256
2f1eddcb504275112acb68e9c4cab6870449b6c68fb620657f833a7a0f3654f4

SHA512
e3986785079727af2acd06b8c5b211caa7ddf15d609d614b1250ee7780245d178910dabfd05f770d8f1a58c0779eef29a92bb738a43be1cec9d60e805b1c3a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
fa802c5abddfaf2d6390107f1efdcb1d

SHA1
648ac40bd3d2eccae005e325bbe6e3c8203cb4ec

SHA256
7aafa89f200a82c498927534470274ba5b59e76e9a28e6b90d79abc18882f295

SHA512
fa912351bc55aba192a7231b38224b1ba478edd8e89498975e56746655f31d9e52d501296f2c73bc0f52f1823bb6b3db8f2e42cbb231a5764a31747fa81f6147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
548faca1c5f2b6a2745eb3279951d951

SHA1
4540a02f116a506ff9edc023bdfe9e24687cae8a

SHA256
b7d48e7ca39a6dc8e97ce9a5a3b23e288e96c03413d2d9191d96e840f8096800

SHA512
e093f57661a320273e66a7584ec79a9089cd446e0425c0e892cd68e2ee610b1ebbb7af9d559af53ba16ee97761f5c918cfafc46b0ed4a6a8805fefe01102c0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
6789a9efc154428b4b0fffc4ee97edad

SHA1
8e35957ffaa5735f59e736eeab300453db353d36

SHA256
9983e1b9d1f2895fbc279d5f3c99a800e0cba9b8bf0b37f8b73dc696099b3722

SHA512
93da81f563b895f626348a84fca561f96c3109339dffd3f92c622f5852a233850a1e0efc1bfc8b3e5e7b0916737b51aeef47bdce5208de693a628d2f1d8fd171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c93cefa14f3b757286e1824fd28edf58

SHA1
dfbc3e7717f30e2165af2a8b5a0ea57f49caf812

SHA256
bb887cf8fc6078b67f6d7976bdf40d6ef868fece8590d34b6104ef080d910fb6

SHA512
6930328c1c332851f550cf7483ae3b7e3edf1357da25190f2dfb63b6da0d343fdf2bc25d8f9f92e1ddbf4802bb740eb51696b6fda5ca874d9be26841209443c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
9695d711a85672702ef788953fcf7a56

SHA1
a70b4baf52bc478a2487e60b0c6fc1e7fb766bb3

SHA256
00f1521f59378780a6287804dd946c6bfe5d4ed6bc8fb992bcf01a2629327a30

SHA512
90406af179be77e418ec7eecbd025a2b4586873223c7e286ad7df8b1da36348cbbfeca7eddf2b11ba4b54eac4376036fd03d65178574dedcf60e7974e0bd2936

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58117f.TMP

Filesize
204B

MD5
80f1d708c905b82b7db1ea95d203b473

SHA1
d30e6257b2d1d4374669e9ce6666f3f48e227efc

SHA256
c29310dd53103d84d1eca2846b0fbe3f2c0b39ba1a65668dd2c9bd0de28d8e6f

SHA512
3ee596f11bb43c3307231d745c9ff9c73f5ca6af85f6cc801c62e423c1bd07ebac319bd6488f21b5a606f1e03584b8ddcfdfea3009e8cd480c7351f092b22737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000022

Filesize
17KB

MD5
913728da90cf90d8e78af59c60b47c3d

SHA1
f42f2a545d4fcaf4f76d0f060f52e33a47df7f1e

SHA256
b0b478f9aa6aaf8d5811e296047ae1f8ee07f4c4998fe9d7b960755ea1fafb82

SHA512
3af86e053dd56aef03e6f967a49b1a0d492616a71e2e49090e0c8e5cbe58ff37ccc55e91f06bf34096059a49f3de84b0bca587f3f17c366f97c0f7a0fd17c974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
4d1e1c11695259f1bcca94edc9dd89e1

SHA1
c99a4e40cdf4f71e0a5c2b61f06f6734d0f571bd

SHA256
5edeba4c155a8ba4f78acfea53ddc94801872a86a65e4ae250b2e019d436c592

SHA512
1c8d96f3e4dd6f31cce30d4c7dbba3204e812256bab0a89a4dfb165c7898ce6cd7d7adada986c63d2b1d5da9b16a12e183307a8ba81f306a361a532172466e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
19cf3fe35722a00085753f0b504a9b5f

SHA1
40fe6875ea899c2277149a0c19e307e694360f23

SHA256
a3d5a857c46c3f88a02605dd424c76acbe15d85eb496c4cac7096c66228b41f5

SHA512
ad5597103ddb77ca2cd091f5464e6f8b29ec32a1c68ad7edf3582288e149d67f90affdc0cd297e1d3cc62b6e1b203aa3d77e28872b41c771ba6a26df46532757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d5602b23318e7ac562ca8ce1c1c48e21

SHA1
1d91288ee1fe491427d84037c8e636bff096b9b4

SHA256
523f3379edf47c016628637c10d6bf195dbbe7e49a2e4af968ce9816855209e0

SHA512
ebcd82abf9230dfa4d945e779de1792bf02e40c37f67813691e7833900dc7c270c7e5666be2e59f73f8823516d885112b2df15b8268c2eb75e1a62da8129cdc4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
f591950f058fda118db803bc97d15d92

SHA1
019a16c556f65a0378e93479b09a805ca36d3ba0

SHA256
bce37f92a7946a8520a9f8a0ee47fd64637a7a714d59975dde60684d6f1e490c

SHA512
4270080e1744e100e26ec1b00d83b47fc50c2bb0d292e89911936c52cda3d771baadd6c5b72357ab5e079da8a6316a5c2a94d6c358350099df280df33242fbd5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
1c60c3e5fef42c0d8e2981eb65bb74af

SHA1
b04076af37e9d882e7650a200b2a1be730b3f9a7

SHA256
4c66a125bebbf9e218f4f7ce8fa2b449b9a123a5d191f606c97d5a12b1286a33

SHA512
56159c9e9cdf06283bf9529dace32af1622a0ba09cdbc21ac7f472b221a6979cd764ebc8e07b959f770d6b6d7c9b55cf53bba71949a08d2e8f326c7eb1e6b58c

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 80516.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit
memory/800-3993-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/800-4003-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/800-7364-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/21460-8604-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/21460-16945-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/21460-17843-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download