93537a3e7b05f9a7873be00d310c278969de796cfd3693c5e4677898bc638021

Resubmissions

01-12-2024 20:16

241201-y2hmqs1jbx 8

01-12-2024 20:02

241201-ysgn3szqay 10

01-12-2024 19:58

241201-yp8ndszpc1 8

01-12-2024 19:45

241201-ygcwrazlhy 8

Analysis

max time kernel
485s
max time network
622s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-12-2024 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DONOTOPENINWEB.txt
Size

449B
MD5

b905963e0bb2d2d4f9a0b6a88bb5d04c
SHA1

182a1ab984d6a7c0359135de45765b41b7c542a3
SHA256

93537a3e7b05f9a7873be00d310c278969de796cfd3693c5e4677898bc638021
SHA512

ef0343f83e33cecb95bd5f1d91210e916aa43fa7897175d5b40e0e2722ad50adef28f9dcd58e33961fbea94be8ec886e4a09d1ba167ca41be73d50c30ee2d5bc

Score

8^/10

bootkit discovery motw persistence phishing privilege_escalation spyware stealer

Malware Config

Signatures

Downloads MZ/PE file
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: portal@~2.37
phishing
A potential corporate email address has been identified in the URL: sodo-search@~1.1
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	PAssist_Std_20241202.15405480.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	PAssist_Std_20241202.15405480.tmp

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 14 IoCs

pid	Process
5160	Baidu_Cleaner_Setup_Mini_GL702.exe
6052	PCF832B.exe
408	PAssist_Std_20241202.15405480.exe
5748	PAssist_Std_20241202.15405480.tmp
5148	aman.exe
2908	Adaware_PC_Cleaner_Installer.exe
4292	Adaware_PC_Cleaner_Installer.exe
2124	PAssist_Std_20241202.15405480.exe
1600	PAssist_Std_20241202.15405480.tmp
4896	aman.exe
6384	adawarecleaner.exe
6416	adawarecleaner.tmp
6884	AdawarePCCleaner.exe
6912	AdawarePCCleaner.exe

Loads dropped DLL 32 IoCs

pid	Process
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
5148	aman.exe
5148	aman.exe
5148	aman.exe
5148	aman.exe
5148	aman.exe
5148	aman.exe
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
4896	aman.exe
4896	aman.exe
4896	aman.exe
4896	aman.exe
4896	aman.exe
4896	aman.exe
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
6884	AdawarePCCleaner.exe
6912	AdawarePCCleaner.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
295	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	PCF832B.exe

Drops file in Program Files directory 25 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-D67LU.tmp	adawarecleaner.tmp
File opened for modification	C:\Program Files (x86)\Adaware PC Cleaner\ADCNotifications.exe	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-NC71Q.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-1EBCO.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-376LN.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-QJA5A.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-01TO6.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-CFFL7.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-3B96S.tmp	adawarecleaner.tmp
File opened for modification	C:\Program Files (x86)\Adaware PC Cleaner\sqlite3.dll	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\unins000.dat	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-JB26L.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-9MQUF.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-3M632.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-PHFII.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-8M88R.tmp	adawarecleaner.tmp
File opened for modification	C:\Program Files (x86)\Adaware PC Cleaner\AdawarePCCleaner.exe	adawarecleaner.tmp
File opened for modification	C:\Program Files (x86)\Adaware PC Cleaner\unins000.dat	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-NV7AJ.tmp	adawarecleaner.tmp
File opened for modification	C:\Program Files (x86)\Adaware PC Cleaner\AdawarePCCleaner.chm	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-5TK8D.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-JUNP8.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-POP0Q.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-0NA2P.tmp	adawarecleaner.tmp
File created	C:\Program Files (x86)\Adaware PC Cleaner\is-DAQQK.tmp	adawarecleaner.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\is-CR0KT.tmp	adawarecleaner.tmp
File created	C:\Windows\Fonts\is-K2JSG.tmp	adawarecleaner.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdawarePCCleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCF832B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAssist_Std_20241202.15405480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adawarecleaner.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdawarePCCleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adaware_PC_Cleaner_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAssist_Std_20241202.15405480.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aman.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAssist_Std_20241202.15405480.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Baidu_Cleaner_Setup_Mini_GL702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adaware_PC_Cleaner_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adawarecleaner.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PAssist_Std_20241202.15405480.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AdawarePCCleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AdawarePCCleaner.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AdawarePCCleaner.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AdawarePCCleaner.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\IESettingSync	PAssist_Std_20241202.15405480.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	PAssist_Std_20241202.15405480.tmp
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	PAssist_Std_20241202.15405480.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	PAssist_Std_20241202.15405480.tmp
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\IESettingSync	PAssist_Std_20241202.15405480.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	PAssist_Std_20241202.15405480.tmp
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	PAssist_Std_20241202.15405480.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	PAssist_Std_20241202.15405480.tmp

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2d3468c1-36a7-43b6-ac24-d3f02fd9607a}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8C38232E-3A45-4A27-92B0-1A16A975F669}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4D36777-EAED-4cc5-9FE7-827BE5190B20}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0E9847B3-13E8-44E6-9659-2B60A140A573}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1AD699A6-31F7-4EF0-93E9-FFD576F35D30}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{89A0CBA3-F995-48BA-A751-F27D64BEE9E7}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8c537469-1ea9-4c85-9947-7e418500cdd4}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0208-ABCDEFFEDCBB}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{023A36FC-E9D5-419E-824A-CDC66A116E84}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62CE7E72-4C71-4D20-B15D-452831A87D9D}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{125B0F61-0EC3-4f07-9A49-AFB340D9E57F}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3DD82D10-E6F1-11D2-B139-00105A1F77A1}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{94FBC195-CB86-4142-9A6A-8E9CCF0D4F4D}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0112-ABCDEFFEDCBB}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0155-ABCDEFFEDCBB}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0317-ABCDEFFEDCBA}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F27A4830-81C1-4D00-B6BD-0A7F44CE2D86}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0CD069CF-AC9B-41F4-9571-3A95A62C36A1}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7013943A-E2EC-11D2-A086-00C04F8EF9B5}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{79eac9f2-baf9-11ce-8c82-00aa004ba90b}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFC880F1-7484-11d0-8309-00AA00B6015C}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5DC41691-C6A6-11d1-9D35-006008B0E5CA}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8580ca99-925D-4537-959B-B7C9EA45FC01}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{90F1A06E-7712-4762-86B5-7A5EBA6BDB01}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ecabafae-7f19-11d2-978e-0000f8757e2a}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{15EABA99-0ED7-48E5-80B6-19635B525CC2}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3734FF83-6764-44B7-A1B9-55F56183CDB0}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4000C97B-791B-425F-9AD6-5046210503B1}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4B0A2997-E555-4F84-B45B-68AB8BC57635}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{63e17c10-2d43-4c42-8fe3-8d8b63e46a6a}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C1AEB5-10F2-48cb-A182-F7EF79C51B19}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{15E16AEC-F2F0-4E52-B0DF-029D11E58E4B}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3F052B8E-512B-419D-9E06-9B9ADDC7118C}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{884e201e-217d-11da-b2a4-000e7bbb2b09}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98FF6D4B-6387-4b0a-8FBD-C5C4BB17B4F8}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AF2440F6-8AFC-47d0-9A7F-396A0ACFB43D}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0053-ABCDEFFEDCBB}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0087-ABCDEFFEDCBC}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1BDF02A4-23B7-4173-8107-A56C23124493}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{473AA80B-4577-11D1-81A8-0000F87557DB}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB49EAD1-0DC5-41FA-AFE0-8EFBDEAA4AF6}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0147-ABCDEFFEDCBC}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0152-ABCDEFFEDCBB}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BDCD51FB-55A0-4486-908C-5240F23698AC}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20b1cb23-6968-4eb9-b7d4-a66d00d07cee}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7071ECBF-663B-4bc1-A1FA-B97F3B917C55}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7A63E5C-3877-4840-8727-C1EA9D7A4D50}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9A14CDA-C339-460B-9078-D4DEBCFABE91}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020423-0000-0000-C000-000000000046}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0700F42F-EEE3-443a-9899-166F16286796}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62079164-233b-41f8-a80f-f01705f514a8}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69546697-5b53-43c5-8391-9e227b54957b}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F7D49DF-F271-4913-8A85-F73ACCE31138}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ae4bbad2-f56a-4dfd-af17-79c03af451d0}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FCC74B77-EC3E-4dd8-A80B-008A702075A9}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{734AC5AE-68E1-4FB5-B8DA-1D92F7FC6661}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9B9501E9-A3F8-4F29-98BA-8FBB9504D5F8}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0300-ABCDEFFEDCBC}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0018-0000-0374-ABCDEFFEDCBC}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F42F750A-64A8-4190-951D-C6F7EF4E4BA1}	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{366F6FDF-839D-4ED5-BFC6-7301A42A2F20}\InprocServer32	AdawarePCCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A89003D7-25F1-47fd-B504-6B35E7A63A27}\InprocServer32	AdawarePCCleaner.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 839694.crdownload:SmartScreen	msedge.exe
File created	C:\ProgramData\Adaware PC Cleaner\Installation\Adaware_PC_Cleaner_Installer.exe\:SmartScreen:$DATA	Adaware_PC_Cleaner_Installer.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 128701.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 354557.crdownload:SmartScreen	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4016	NOTEPAD.EXE

Runs regedit.exe 64 IoCs

pid	Process
5516	regedit.exe
5012	regedit.exe
3472	regedit.exe
4600	regedit.exe
6864	regedit.exe
648	regedit.exe
4032	regedit.exe
4108	regedit.exe
6892	regedit.exe
3152	regedit.exe
6352	regedit.exe
5256	regedit.exe
2688	regedit.exe
5956	regedit.exe
3684	regedit.exe
7096	regedit.exe
4656	regedit.exe
60	regedit.exe
7152	regedit.exe
3172	regedit.exe
3040	regedit.exe
5096	regedit.exe
4024	regedit.exe
1616	regedit.exe
4048	regedit.exe
2628	regedit.exe
3080	regedit.exe
1708	regedit.exe
7056	regedit.exe
5784	regedit.exe
5588	regedit.exe
5212	regedit.exe
6948	regedit.exe
3368	regedit.exe
5472	regedit.exe
5448	regedit.exe
980	regedit.exe
1100	regedit.exe
4368	regedit.exe
3856	regedit.exe
6216	regedit.exe
6392	regedit.exe
6776	regedit.exe
3944	regedit.exe
6560	regedit.exe
6868	regedit.exe
5656	regedit.exe
6176	regedit.exe
3464	regedit.exe
4632	regedit.exe
6588	regedit.exe
3124	regedit.exe
3032	regedit.exe
892	regedit.exe
2624	regedit.exe
5980	regedit.exe
7080	regedit.exe
6280	regedit.exe
820	regedit.exe
3260	regedit.exe
3380	regedit.exe
1868	regedit.exe
1388	regedit.exe
6160	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
3532	msedge.exe
3532	msedge.exe
876	identity_helper.exe
876	identity_helper.exe
5320	msedge.exe
5320	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
812	msedge.exe
812	msedge.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
2988	msedge.exe
2988	msedge.exe
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
2756	msedge.exe
2756	msedge.exe
2908	Adaware_PC_Cleaner_Installer.exe
2908	Adaware_PC_Cleaner_Installer.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
4668	taskmgr.exe
6416	adawarecleaner.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeTcbPrivilege	6052	PCF832B.exe
Token: SeDebugPrivilege	6052	PCF832B.exe
Token: SeDebugPrivilege	4668	taskmgr.exe
Token: SeSystemProfilePrivilege	4668	taskmgr.exe
Token: SeCreateGlobalPrivilege	4668	taskmgr.exe
Token: SeBackupPrivilege	2908	Adaware_PC_Cleaner_Installer.exe
Token: SeRestorePrivilege	2908	Adaware_PC_Cleaner_Installer.exe
Token: SeBackupPrivilege	2908	Adaware_PC_Cleaner_Installer.exe
Token: SeRestorePrivilege	2908	Adaware_PC_Cleaner_Installer.exe
Token: SeBackupPrivilege	2908	Adaware_PC_Cleaner_Installer.exe
Token: SeRestorePrivilege	2908	Adaware_PC_Cleaner_Installer.exe
Token: SeBackupPrivilege	2908	Adaware_PC_Cleaner_Installer.exe
Token: SeRestorePrivilege	2908	Adaware_PC_Cleaner_Installer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
3532	msedge.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe
6052	PCF832B.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
3900	OpenWith.exe
5160	Baidu_Cleaner_Setup_Mini_GL702.exe
6052	PCF832B.exe
408	PAssist_Std_20241202.15405480.exe
5748	PAssist_Std_20241202.15405480.tmp
5148	aman.exe
5748	PAssist_Std_20241202.15405480.tmp
5748	PAssist_Std_20241202.15405480.tmp
2908	Adaware_PC_Cleaner_Installer.exe
4292	Adaware_PC_Cleaner_Installer.exe
2908	Adaware_PC_Cleaner_Installer.exe
2124	PAssist_Std_20241202.15405480.exe
1600	PAssist_Std_20241202.15405480.tmp
4896	aman.exe
1600	PAssist_Std_20241202.15405480.tmp
1600	PAssist_Std_20241202.15405480.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 1424	3532	msedge.exe	85
PID 3532 wrote to memory of 1424	3532	msedge.exe	85
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 2652	3532	msedge.exe	86
PID 3532 wrote to memory of 4632	3532	msedge.exe	87
PID 3532 wrote to memory of 4632	3532	msedge.exe	87
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88
PID 3532 wrote to memory of 3752	3532	msedge.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\DONOTOPENINWEB.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff8260446f8,0x7ff826044708,0x7ff826044718
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1872 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7852 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8264 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8468 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7940 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8108 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8832 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9148 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9340 /prefetch:1
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9036 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8744 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7968 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9016 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9152 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6992 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9428 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9540 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9544 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8156 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9360 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7372 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9444 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8828 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:5292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9836 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9912 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10032 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8040 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9580 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7608 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8364 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8396 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9468 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9256 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9692 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9104 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9488 /prefetch:8
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8844 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8308 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8124 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9148 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=9240 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9532 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7280 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8772 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7612 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8368 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8460 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10376 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=154 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=156 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10844 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=10976 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1364 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=160 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11204 /prefetch:1
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10808 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=162 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10528 /prefetch:1
  2⤵
  PID:6936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,7108357539412208659,14937408419754624255,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=163 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11096 /prefetch:1
  2⤵
  PID:6652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2092

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3900

C:\Users\Admin\Downloads\Baidu_Cleaner_Setup_Mini_GL702.exe
"C:\Users\Admin\Downloads\Baidu_Cleaner_Setup_Mini_GL702.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5160
- C:\Users\Admin\AppData\Local\Temp\PCF832B.exe
  "C:\Users\Admin\AppData\Local\Temp\PCF832B.exe" /UrlIni=PCF835B.tmp /REPORT_CLASS_TYPE=0 "/sid=GL702"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:6052

C:\Users\Admin\Downloads\PAssist_Std_20241202.15405480.exe
"C:\Users\Admin\Downloads\PAssist_Std_20241202.15405480.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:408
- C:\Users\Admin\AppData\Local\Temp\is-6C9PS.tmp\PAssist_Std_20241202.15405480.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6C9PS.tmp\PAssist_Std_20241202.15405480.tmp" /SL5="$1202DA,81229102,619008,C:\Users\Admin\Downloads\PAssist_Std_20241202.15405480.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5748
- - C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\aman.exe
    "C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\aman.exe" -Cookies
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5148

C:\Users\Admin\Downloads\Adaware_PC_Cleaner_Installer.exe
"C:\Users\Admin\Downloads\Adaware_PC_Cleaner_Installer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2908
- C:\ProgramData\Adaware PC Cleaner\Installation\Adaware_PC_Cleaner_Installer.exe
  "C:\ProgramData\Adaware PC Cleaner\Installation\Adaware_PC_Cleaner_Installer.exe" /RegServer
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4292
- C:\Users\Admin\AppData\Local\Temp\d1b7820d-c2e2-4e2d-bc98-f68a03e6ca9c\adawarecleaner.exe
  C:\Users\Admin\AppData\Local\Temp\d1b7820d-c2e2-4e2d-bc98-f68a03e6ca9c\adawarecleaner.exe /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /ALLUSERS /DIR="C:\Program Files (x86)\Adaware PC Cleaner"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6384
- - C:\Users\Admin\AppData\Local\Temp\is-L9IR4.tmp\adawarecleaner.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-L9IR4.tmp\adawarecleaner.tmp" /SL5="$360346,5104624,831488,C:\Users\Admin\AppData\Local\Temp\d1b7820d-c2e2-4e2d-bc98-f68a03e6ca9c\adawarecleaner.exe" /VERYSILENT /SUPPRESSMSGBOXES /NOCANCEL /NORESTART /ALLUSERS /DIR="C:\Program Files (x86)\Adaware PC Cleaner"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6416
- C:\Program Files (x86)\Adaware PC Cleaner\AdawarePCCleaner.exe
  "C:\Program Files (x86)\Adaware PC Cleaner\AdawarePCCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://paygw.adaware.com/redirect/custom/adawarepccleaner/?customValue=buy&lang=en&time=115&version=7.2.0&uid=1019613&key1=bing.com&mkey1=adaware.com/free-pc-cleaner&mkey4=b77992a0-36eb-40c8-be7a-0742d0048e98&mkey7=direct&cmp=adaw_fre_o_en_a_a_pccleaner&wid=8066&ref=adaware.com/free-pc-cleaner&key2=default&qti=628d95e4-473a-fb38-49bd-6f2fd6b5e954_2024-12-01&mkey6=628d95e4-473a-fb38-49bd-6f2fd6b5e954_2024-12-01&gtm=gtm-ts85dt8&visitorid=b77992a0-36eb-40c8-be7a-0742d0048e98&culture=en&mkey2=94564C72-85AB-4D91-8C6B-5DEB6AF0A9A7&mkey8=2024-12-01&license=free
    3⤵
    PID:6548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8260446f8,0x7ff826044708,0x7ff826044718
      4⤵
      PID:6564
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\264864" "HKEY_CLASSES_ROOT\.7z"
    3⤵
    - Runs regedit.exe
    PID:6160
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648137" "HKEY_CLASSES_ROOT\.appinstaller"
    3⤵
    - Runs regedit.exe
    PID:4600
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648162" "HKEY_CLASSES_ROOT\.appx"
    3⤵
    - Runs regedit.exe
    PID:5656
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648195" "HKEY_CLASSES_ROOT\.appxbundle"
    3⤵
    - Runs regedit.exe
    PID:6892
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648222" "HKEY_CLASSES_ROOT\.bz2"
    3⤵
    - Runs regedit.exe
    PID:820
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648253" "HKEY_CLASSES_ROOT\.bzip2"
    3⤵
    PID:4392
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648278" "HKEY_CLASSES_ROOT\.fbx"
    3⤵
    - Runs regedit.exe
    PID:4024
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648306" "HKEY_CLASSES_ROOT\.fh"
    3⤵
    PID:7104
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648334" "HKEY_CLASSES_ROOT\.glb"
    3⤵
    - Runs regedit.exe
    PID:5212
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648380" "HKEY_CLASSES_ROOT\.gltf"
    3⤵
    - Runs regedit.exe
    PID:7096
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648468" "HKEY_CLASSES_ROOT\.m4r"
    3⤵
    - Runs regedit.exe
    PID:3124
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648503" "HKEY_CLASSES_ROOT\.mdc"
    3⤵
    - Runs regedit.exe
    PID:3684
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648557" "HKEY_CLASSES_ROOT\.msix"
    3⤵
    - Runs regedit.exe
    PID:3152
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648612" "HKEY_CLASSES_ROOT\.msixbundle"
    3⤵
    - Runs regedit.exe
    PID:3032
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648658" "HKEY_CLASSES_ROOT\.ms-lockscreencomponent-primary"
    3⤵
    - Runs regedit.exe
    PID:892
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648761" "HKEY_CLASSES_ROOT\.oxps"
    3⤵
    - Runs regedit.exe
    PID:3856
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648787" "HKEY_CLASSES_ROOT\.ply"
    3⤵
    PID:5452
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648803" "HKEY_CLASSES_ROOT\.R3D"
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648817" "HKEY_CLASSES_ROOT\.rar"
    3⤵
    PID:620
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648846" "HKEY_CLASSES_ROOT\.rwz"
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648865" "HKEY_CLASSES_ROOT\.stl"
    3⤵
    - Runs regedit.exe
    PID:980
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648896" "HKEY_CLASSES_ROOT\.thumb"
    3⤵
    - Runs regedit.exe
    PID:6216
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648928" "HKEY_CLASSES_ROOT\.wsb"
    3⤵
    - Runs regedit.exe
    PID:2624
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2648972" "HKEY_CLASSES_ROOT\.xps"
    3⤵
    - Runs regedit.exe
    PID:6392
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\26490" "HKEY_CLASSES_ROOT\.xvid"
    3⤵
    PID:6356
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\264917" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.all"
    3⤵
    - Runs regedit.exe
    PID:5516
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\264952" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bak"
    3⤵
    PID:6656
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649101" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bin"
    3⤵
    PID:6648
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649149" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cfg"
    3⤵
    - Runs regedit.exe
    PID:5980
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649183" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.cs"
    3⤵
    - Runs regedit.exe
    PID:7080
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649228" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dat"
    3⤵
    - Runs regedit.exe
    PID:6352
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649284" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dng"
    3⤵
    - Runs regedit.exe
    PID:4656
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649310" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.idx"
    3⤵
    PID:6404
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649376" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ipa"
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649413" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.itc2"
    3⤵
    - Runs regedit.exe
    PID:6776
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649446" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.itdb"
    3⤵
    - Runs regedit.exe
    PID:5256
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649481" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.itl"
    3⤵
    - Runs regedit.exe
    PID:3944
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649518" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jps"
    3⤵
    - Runs regedit.exe
    PID:3080
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649575" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.json"
    3⤵
    - Runs regedit.exe
    PID:60
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649654" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.map"
    3⤵
    - Runs regedit.exe
    PID:7152
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649681" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mdb"
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649712" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.odc"
    3⤵
    - Runs regedit.exe
    PID:6280
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649754" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.one"
    3⤵
    - Runs regedit.exe
    PID:6948
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649809" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.onetoc2"
    3⤵
    PID:2860
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649827" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pls"
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649846" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.psd"
    3⤵
    PID:1856
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649862" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pst"
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649879" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar"
    3⤵
    PID:6492
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649895" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.swf"
    3⤵
    PID:5368
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649911" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tmp"
    3⤵
    - Runs regedit.exe
    PID:4368
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649969" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vssettings"
    3⤵
    - Runs regedit.exe
    PID:6560
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2649992" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.webp"
    3⤵
    - Runs regedit.exe
    PID:3172
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\265025" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht"
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\265066" "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml"
    3⤵
    - Runs regedit.exe
    PID:6868
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\265088" "HKEY_CLASSES_ROOT\.fluid\shell\open\command"
    3⤵
    - Runs regedit.exe
    PID:6588
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650105" "HKEY_CLASSES_ROOT\.loop\shell\open\command"
    3⤵
    - Runs regedit.exe
    PID:6864
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650120" "HKEY_CLASSES_ROOT\.note\shell\open\command"
    3⤵
    - Runs regedit.exe
    PID:3368
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650151" "HKEY_CLASSES_ROOT\.whiteboard\shell\open\command"
    3⤵
    - Runs regedit.exe
    PID:6176
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650240" "HKEY_CLASSES_ROOT\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\LocalServer32"
    3⤵
    - Runs regedit.exe
    PID:5012
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650280" "HKEY_CLASSES_ROOT\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32"
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650355" "HKEY_CLASSES_ROOT\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:1388
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650397" "HKEY_CLASSES_ROOT\CLSID\{42089D2D-912D-4018-9087-2B87803E93FB}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:2688
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650424" "HKEY_CLASSES_ROOT\CLSID\{506F4668-F13E-4AA1-BB04-B43203AB3CC0}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:3472
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650570" "HKEY_CLASSES_ROOT\CLSID\{5504BE45-A83B-4808-900A-3A5C36E7F77A}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:3464
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650597" "HKEY_CLASSES_ROOT\CLSID\{6CF90891-3E04-4092-B96C-28E071EEEACB}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:3040
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650632" "HKEY_CLASSES_ROOT\CLSID\{73720013-33A0-11E4-9B9A-00155D152105}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:5096
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650657" "HKEY_CLASSES_ROOT\CLSID\{83C25742-A9F7-49FB-9138-434302C88D07}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:648
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650711" "HKEY_CLASSES_ROOT\CLSID\{9203C2CB-1DC1-482D-967E-597AFF270F0D}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:4632
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650759" "HKEY_CLASSES_ROOT\CLSID\{A394DCA9-3727-11D4-BD85-00C04F6B93A4}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:4032
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650787" "HKEY_CLASSES_ROOT\CLSID\{D66DC78C-4F61-447F-942B-3FB6980118CF}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:1708
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650823" "HKEY_CLASSES_ROOT\CLSID\{E18FEC31-2EA1-49A2-A7A6-902DC0D1FF05}\TypeLib"
    3⤵
    - Runs regedit.exe
    PID:7056
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650845" "HKEY_CLASSES_ROOT\Typelib\{00025E01-0000-0000-C000-000000000046}\5.0\0\win32"
    3⤵
    - Runs regedit.exe
    PID:1868
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650865" "HKEY_CLASSES_ROOT\Typelib\{F904F88C-E60D-4327-9FA2-865AD075B400}\1.0\0\win32"
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650882" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
    3⤵
    - Runs regedit.exe
    PID:5784
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650898" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
    3⤵
    PID:5508
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650916" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2650936" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
    3⤵
    - Runs regedit.exe
    PID:4108
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\26518" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
    3⤵
    - Runs regedit.exe
    PID:5956
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\265132" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
    3⤵
    PID:3928
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\265162" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651109" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
    3⤵
    - Runs regedit.exe
    PID:1100
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651143" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651174" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
    3⤵
    - Runs regedit.exe
    PID:2628
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651220" "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
    3⤵
    PID:1144
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651253" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook"
    3⤵
    PID:4872
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651315" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx"
    3⤵
    - Runs regedit.exe
    PID:3260
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651363" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime"
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651390" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore"
    3⤵
    - Runs regedit.exe
    PID:1616
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651427" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE40"
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651451" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data"
    3⤵
    - Runs regedit.exe
    PID:3380
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651494" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX"
    3⤵
    PID:748
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651525" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IEData"
    3⤵
    - Runs regedit.exe
    PID:5472
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651566" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack"
    3⤵
    - Runs regedit.exe
    PID:5448
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651610" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2"
    3⤵
    - Runs regedit.exe
    PID:4048
- - C:\Windows\SysWOW64\regedit.exe
    /s /e "C:\Users\Admin\AppData\Roaming\Adaware PC Cleaner\Undo\2651647" "HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent"
    3⤵
    - Runs regedit.exe
    PID:5588
- C:\Program Files (x86)\Adaware PC Cleaner\AdawarePCCleaner.exe
  "C:\Program Files (x86)\Adaware PC Cleaner\AdawarePCCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  PID:6912

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Users\Admin\Downloads\PAssist_Std_20241202.15405480.exe
"C:\Users\Admin\Downloads\PAssist_Std_20241202.15405480.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2124
- C:\Users\Admin\AppData\Local\Temp\is-A7S02.tmp\PAssist_Std_20241202.15405480.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-A7S02.tmp\PAssist_Std_20241202.15405480.tmp" /SL5="$90360,81229102,619008,C:\Users\Admin\Downloads\PAssist_Std_20241202.15405480.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1600
- - C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\aman.exe
    "C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\aman.exe" -Cookies
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://paygw.adaware.com/redirect/install/adaware%20pc%20cleaner/?lang=en&version=7.2.0.1&configId=5DF5A805-079A-42BE-85E2-53E93727B3AC&uid=1019613&key1=bing.com&mkey1=adaware.com/free-pc-cleaner&mkey4=b77992a0-36eb-40c8-be7a-0742d0048e98&mkey7=direct&cmp=adaw_fre_o_en_a_a_pccleaner&wid=8066&ref=adaware.com/free-pc-cleaner&key2=default&qti=628d95e4-473a-fb38-49bd-6f2fd6b5e954_2024-12-01&mkey6=628d95e4-473a-fb38-49bd-6f2fd6b5e954_2024-12-01&gtm=gtm-ts85dt8&visitorid=b77992a0-36eb-40c8-be7a-0742d0048e98&culture=en&mkey2=94564C72-85AB-4D91-8C6B-5DEB6AF0A9A7&mkey8=2024-12-01&guid=94564C72-85AB-4D91-8C6B-5DEB6AF0A9A7&eventTime=2024-12-01T20:24:15
1⤵
PID:6804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8260446f8,0x7ff826044708,0x7ff826044718
  2⤵
  PID:6828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adaware PC Cleaner\AdawarePCCleaner.exe

Filesize
7.2MB

MD5
e0e9514a72f7a3171553d0d11648e254

SHA1
3c92c8b996d9987bc6a4acff25c122b375d4d2f1

SHA256
13048b07f63898013c8d5cf9523219a4feb889c018c7d4235343ef5d63f73a48

SHA512
0863fd111dbaf7fba98b6d8dfcfd5ea640083776090598dc001f898a4e9a41e6988ba6552b5a210ee755e5c666f01e8c4b02d77f53827522b999c8950c84cfa3

Download Submit
C:\ProgramData\Baidu Cleaner\RpData\rpFile-PCF832B-2024-12-01 12-20-04-0172-[32109].dat

Filesize
986B

MD5
b85f7725f1d63ddacf88450cbbaaae46

SHA1
85b27e15afc1c4195ff8c8382d6bab3ea212ca4e

SHA256
042855c8fc7fe1af0ad287db8578c2fa49abef495be07ddaf40cd1d0aeb5129d

SHA512
3617ab852d5d1c7b09412c65ad4f130906b0aca68cc8a9427199fedf230a3daf6c4a79f188d2bb03e26813e212dc5e9406405c077c56029c9f6b98b1af9f1a6d

Download Submit
C:\ProgramData\Baidu Cleaner\RpData\rpFile-PCF832B-2024-12-01 12-21-03-0957-[32301].dat

Filesize
789B

MD5
ca94e25b2dafd118f65e803b7db45a00

SHA1
0127df489a0127f44685bcc6356c9337baf74682

SHA256
70661b4236fbc7c53c91091929581f166402719ad11719ddc0d862c0f5dfde76

SHA512
59c6c9a6c4420fa5ef74b9bc350286427ed95212d31b4a3f09befac99a26e3a4ca709de25d24338f89afcdbb953b6a3e8fa5e4937b11375390d0cac99c6ac1ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b8880802fc2bb880a7a869faa01315b0

SHA1
51d1a3fa2c272f094515675d82150bfce08ee8d3

SHA256
467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

SHA512
e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ba6ef346187b40694d493da98d5da979

SHA1
643c15bec043f8673943885199bb06cd1652ee37

SHA256
d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

SHA512
2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f33ceaa-09b9-43cb-8439-d1f1b3db743e.tmp

Filesize
4KB

MD5
074b14f19f066a721aa1977312930169

SHA1
602f26cd32b2d5feef004d8161308e45d8548955

SHA256
fbdd3ff60389019a6784abb2f8567790690fc80b9778e8d450444f5713411699

SHA512
65250b0296cf83d801867e16c45d7d92427dd9514c5dbd1d1be5b18796ec975fa7d845fd0b7000830e09438556c6e807b1bb48ed460ded97653fb6d4b38d3096

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
b275fa8d2d2d768231289d114f48e35f

SHA1
bb96003ff86bd9dedbd2976b1916d87ac6402073

SHA256
1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

SHA512
d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
25KB

MD5
e29b448723134a2db688bf1a3bf70b37

SHA1
3c8eba27ac947808101fa09bfe83723f2ab8d6b0

SHA256
349cc041df29f65fd7ffe2944a8872f66b62653bbfbd1f38ce8e6b7947f99a69

SHA512
4ce801111cb1144cfd903a94fb9630354bf91a5d46bbbe46e820c98949f57d96ec243b655f2edeb252a4ec6a80167be106d71a4b56b402be264c13cc208f3e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
16KB

MD5
bd17d16b6e95e4eb8911300c70d546f7

SHA1
847036a00e4e390b67f5c22bf7b531179be344d7

SHA256
9f9613a0569536593e3e2f944d220ce9c0f3b5cab393b2785a12d2354227c352

SHA512
f9647d2d7452ce30cf100aeb753e32203a18a1aaef7b45a4bc558397b2a38f63bfcfe174e26300317b7df176155ae4ebaee6bdf0d4289061860eff68236fe1bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
19KB

MD5
1ff4e07e8379deec5ef64c722f86eb1c

SHA1
acc5a21472a0d23365d87e16f51842b750cc8130

SHA256
fd884f8c7cbee586a41e93e5f085b4615198f068901f736142bb3acc9114d06c

SHA512
4c76ce9d4c9d2a5df3640673724132fef3bee2c89f60d663ff369b5c99baa7040933b48c49adff56a91f87ad7d57cb02acc6ea24009f86ae2884b0fa324fe080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
17KB

MD5
9f2385157e4637a0426a9bf25312627a

SHA1
395b7c1428ee59ebd152d6917494ae39edc460ad

SHA256
6b20ede33b01a5b351c42913c5478fd87bda02c26c07782ba22a1112e16b896b

SHA512
e220fc5181801c0f02bfae8784057f0800ff31ff05e1233bea9d6f95f94b501c2f1215e38590bec76ba00d3ddee29ef41158d60d3bca0613dcc73ea7b58c5e4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
42KB

MD5
23d5f558755a9d58eef69b2bfc9a5d99

SHA1
fa43092cb330dff8dc6c572cb8703b92286219f6

SHA256
6e5bec69b1c6424972a7f5481ac57049811f0f196535b707613126c11292c5cf

SHA512
9c56c94d059a27dab9f69c9dfd718382a8eb192b8c0ce91cd6db6ec0769b8756acf9c0956a35561474b87d6278b13fbe88a6e4df6260c278b1ae06e9be55dd6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
32KB

MD5
9a3c08b7a4c3df734d4dc24f761c2b6c

SHA1
9201c07cfc2a2895ab9078c46a700beb1e72d44e

SHA256
042f0fd2b3129980bf535f00174bb86b7597bf6c05fda4bb68b866dfd7a4b4d4

SHA512
e1a1f82f10d3c018897cf9d6abf991188bb43e5c022387fdca93cf072b5c79583efbe3147bb6b2f36e04af3d35708c8507bd679ac3d38c706f918419da9f5834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
29KB

MD5
e45b44e75efd7f3cc8ab991c5e57d83d

SHA1
8369303b0da6874fb928f4b6fb63b0fb79f7a8d0

SHA256
80e9d2780848efac1bd9f41a13733ec92b87ee490b91c9a106aefa78a11cb954

SHA512
344aee715ecfae564d151626bc22e4f3cb7eb1c617fe01372aff0445e2a4d95c48047903c4d2008bd6818a74b15513b054d4884ef86b6c637acc3bc832cc04c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
103KB

MD5
c12602b8ebdfd5ea5113f42ee978d526

SHA1
1159db5c354e5c9a73b2e072b3c0c5d02f3ff07b

SHA256
412aad14e7b55e51c4c56a88949c8f5ac81e06bd1d9b23da4378b1d9711a0794

SHA512
00ba76a1f0f08c969a96f4418c158d482eba611fa5984cec234ded9c7a1aa2e9e4dc2a69816c2940783289767212ac729cb7b3ae4cd002f772a5dc5d45bce3db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
141KB

MD5
e9d23c6571bc96e2f021c6787e7481a0

SHA1
7099f90a7fcdc2fd13d01db72b41e7287bc25170

SHA256
d6596dbf7f3e8b69a1754296be09888df32ba02e0eb4bc9222a3ee79e9d93e18

SHA512
7c6638c7068ca409dd6269c6f14d9f90a46a103176ee0cbe6d8fd5f77a1ba67048246bfd983e7b21cab629285f531111aff7b5751b46ac4d084a537f5ac7a650

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
95KB

MD5
06bb316b77914de358cf156b5f870a17

SHA1
d0152faa63ec62f97b2f5d1eecc766acb344b50b

SHA256
4f9494980364a5408c5de5c95de8a8e668e0ce2cd0431fb89dff7f7a3d14198b

SHA512
ebefaf2a02ed3e0bcf1a8d714ff56c43f26da6940c6126e63e1a4188a9d587c941a23fa3836932854324f720a07919cb9f95ea3156fe83480a4266f7684d7269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
21KB

MD5
a5f61885ebd8b757ad42607c24a7fa56

SHA1
16fdd52325ee4e059aec6284e78e287102de0fb4

SHA256
7ca05e2a5280e44c9e1108f8d21a96d4a1f42f927965f081803ac58fdd0b4de4

SHA512
4c4e508a3d73472ee7faf81cf6340303f96ec2bcafb4f3c187ffb86f6c90cc4d9b512a2b60a87ff7d0e47523f99a754a04fa1b4e5846232a13f3860239f3811b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
27KB

MD5
dc654d5da1a531fdb3b1bedb619b0182

SHA1
49d3de45bea7c279cf0ffe4cbc43c24779d1877a

SHA256
b395c195a5854253500b3b210e585ec801a47b49ce7b90fa5a9717df387598fa

SHA512
38952929cbf8e103cad50007cb492c93a7feb8d9d1853773883e2771cc97e50d6a514cb6347c912e7945d126a35677cca854ce8542e2210d7e59799238bae8fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
136KB

MD5
0e018082bf74fe30ada7a8715f87d92b

SHA1
6f0a9105fe6935b9bf8d000000b0e1bedfe87269

SHA256
59c718136215009681b24815620040957ee23edb896b76e7be42e0144af6c23f

SHA512
40b02badf852ba1a997710a99b59a0755d8353ac47f64f6152678610fe5f86f230f07c4288cfeaf6cba5d9b817d8231ccc3cab7f063a1005ba078800dc7d0cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
152KB

MD5
4521b6fb0d76ba6fbde6dacf5a6a2a51

SHA1
8ffdc57f21502f0164760f9e2bf4dc10bb3fb43b

SHA256
4f9e8f4c4e21819683335f73bd1e7d2b3afaa30d3449508472294885afe8f0d4

SHA512
13819a3a6357cd44717fe768154f8117115b22043e9ddf024b5b7ebc5ca427d733261e0a0aa0237be54dda49fd3010853b1692dfb74fe42695d201cfddeff552

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
88KB

MD5
aeea5081ea1b5e70aa85ac8f1e3acb30

SHA1
b5dec54c02c0be776988190fa5603b77be1a29ea

SHA256
55997e5dd9a28845e371e7a760b78cce88822cc7329b82d11ecd5ebbb789e870

SHA512
0289fa8372bf2ef85faf3a3e7af70570fe7282096653ce68890cc27ebc84ea7f234cd846aefd729436b3a9c32136e28e041e2d9cb018d158f18149c0e4288c7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
84KB

MD5
bcf16acbb24ff4686078db1770de005a

SHA1
c128ce550c478db283ca3de2c2247ba1262fbd52

SHA256
442bff059625fef9a0f77b1f484bf697665aa2400c70853b3706ab16957bddbe

SHA512
7716f3a1a466cc862d2bc7ba51b4f30f6a256e378d9a8ee04ec196a2c006b9a7a57806b8c42c2957c43b149c58f234db8e2d2427785d7469b1a5b1ebbc180dbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
02f47815318fbaf97240d37ff1f176ea

SHA1
099a875874a50c898851f03b6d20c0ce1660c438

SHA256
d17ff5faf30401d59dd584bd63c8f904405e295de6ee89b0025c010eb62c5d91

SHA512
9c22d3c3ebd160db1555ad18c0245473ce439c28c5a5d35d9230e394fd9aff299a483782ffd72c75f06a56432c6b96f3f5a175193bd79261797d8ab6bc058d65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
88KB

MD5
7e0f0bcba102dd73ae27bbb829f9ed22

SHA1
f2ddad22da9315e80452552dd65c4038abd176af

SHA256
a98fb01b9c278dacec84a66bf7b9a041e39e185ff7477ceaa57e061c4e3e1ccb

SHA512
6e82374eae9f0604900ed22b7901feb7e93f5858b14a351653b432e5a6bf16170ce7e2ebfc08dd3618ee20bb9a691a69c0a2a1ead6f3b6f80b61b524a6f95ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
28KB

MD5
4b8bc7dbb3c8676f717839b838295d36

SHA1
52516ed283ff5baf3b28ff2d1773a354e17a3a32

SHA256
c284a654994d1033e95c8b412904989cea28fd08568af97e29a9aee11507cb76

SHA512
3d943a9d7ff1a02d79531e2db1b295a39244052b69d0aae6dceab38fb98f05dc77e91937db1bd93c00e9d2268f3d102e8c721146fb3628cfcabb19c1913acdd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
43KB

MD5
27b6e59fbc0f388ab4f89f6bd674d852

SHA1
efbb2c4bcb89d119b1c0431a22680aeec1e22816

SHA256
f4017b833a825d9126f5795caff21eb6bc31d0856fd5b4d70455ddb73312f14f

SHA512
9c4efaa97bbc993970d5c6009d53b758cabec35ee736287b2dc01ff0c2d1031bb23ecbcd165bf2d475288bf6f26793bb6f9ffac028f0d3d20cb07070d996579a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
123KB

MD5
0a99a7a628d58781665f37b89c9201dd

SHA1
be387341278aff9395b66861e6a511f06d4d3ff8

SHA256
00ac3c5adea6c611e94b5868cb46669a6b495cc2ede87a2b8b807dec3a449f60

SHA512
38c7832b4309039945393ce7aca27b6c901d90718a96cc675b62bcb9f7ed4b3dd643c12bca9df744036a7b5bc397506a5626ba24e5313ae643bed1e39440dfd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
20KB

MD5
d0d74c9f5f71a8c1944f599486b7c8e4

SHA1
d264684445e2fe6e1afc48b868afd63df13d698b

SHA256
454939e9149527b92db720a29e9b10cff0d729b618931d59acdb3f87aaf8f354

SHA512
8875d755e453de71360e938b3ba34c5d1ddb0dbafdde8886358555fd0c3dff9827239aa120df01c81ad78a28f40157fe54e9683885403c067474ac6403de1e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
67KB

MD5
ce58019b091dbdb1895be63d765b1177

SHA1
37a38458a92835c43b270069c0629c6975b2ba69

SHA256
8defb86fd585d1e578370bac22698f0de49d509d7398a0e83fbae7a9d11e0fcf

SHA512
36be843dd5630cf0c76219459b2ff946fa91ab90be31e3ac62452642a79a062b9d7aaae14a0ad8fd92b1a6d468394f1aa8bfe45f262f33e34048b46e046a1b27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
62KB

MD5
c610514e5756020cfb3c727b77b2c83e

SHA1
4083cc96db7af4deac95b32329baa78b7a584f49

SHA256
0148f8f91e2ef35d38ba66c9e01f3deeab27bfedcddc77cd782908c401ac9ca8

SHA512
039625607b59612a9eefa3bd00a07be62cb531aa201d1413da190ecc9ff33e35a8c7a4d095615dc3d08856de1c0ff6c4e080bee8b7ca53174f78d349a2fc6572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002c

Filesize
54KB

MD5
2e450436c615bd552d2f70245c66259f

SHA1
1063533e8c7da37302a7998f26020cbf32d22d7a

SHA256
905d3e553e4422c5222b8c1280ae28aa047aabb4c71fd4cf8b8517c45e87e9bf

SHA512
c9db525c1a5a3d848aba5306a4b5feb50f0dc284a09e4c55ec2abe9a1a2be30a428ec5bd14101b05e465142597059f002f4ce23885677305706199c30a7562ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d

Filesize
18KB

MD5
8eff0b8045fd1959e117f85654ae7770

SHA1
227fee13ceb7c410b5c0bb8000258b6643cb6255

SHA256
89978e658e840b927dddb5cb3a835c7d8526ece79933bd9f3096b301fe1a8571

SHA512
2e4fb65caab06f02e341e9ba4fb217d682338881daba3518a0df8df724e0496e1af613db8e2f65b42b9e82703ba58916b5f5abb68c807c78a88577030a6c2058

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
62KB

MD5
fdd3922edde39c73dc37b568650e47d2

SHA1
1566ef03ec365d9d7e4ac9fc9cbb4e5609b9b976

SHA256
d464beb2c15b29d24af42a7cf74db9539652dba74de861feb169145b5589a3ad

SHA512
b3c7e48d1bdf62d8436ff428af14155a5c2e834ffec8003e9457fc1458cd77b7474210edbb5f57eb838723844f6139b3c523d3a9d1d4f525aa067bbccb9e146a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000030

Filesize
31KB

MD5
a4da976dde535a4f11ff4c9d57a8a56c

SHA1
fc4c29049db6d81135507dc3736cb638340f55aa

SHA256
6b85680498d0061e6b748f0fd9c904c74eb9f265f7d6ff6b33a37a0656164bf9

SHA512
e3db7eb080a2c927ec3a223d16d818cc76f9da51525a91b8eb3cc9e15106e2939ef6d550121b8cdf76d38c001971662d833d70a269ccf35d36278d25cf42aa18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
52KB

MD5
54568f7993fc70f78313d9d874119101

SHA1
d1eb4bee70986be1511f4a35c388612952defc08

SHA256
1e5a991d4bc6638e22acf60fd0941b2830ec3e8efc2e118f09a4768ee028e640

SHA512
3f0102d917716d95db947c9f7bffc43b290ed35789bc3a6b13881543cf64bd5a7e6ffd7e7aa1cd97079baff8f0b7c5eb760604cd06565d9e7d0f770b003d7a91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000032

Filesize
60KB

MD5
b100307705c311e8ae4d31d8b2a4a93c

SHA1
3b1ec50ed6b09f7b3c14f6e8e201f2a2b1c98975

SHA256
4a9f5d41f5ac4c03f7772f676247d201dadf15f9ac01a31ac26685d2f559c2fc

SHA512
213f7dbe76418eaf912a232d0650215b481674943ed689ed8ea4716caa6f5293b4495597040822a62ed9372f3703245a9498e28b852f00a2256fd28a54899ea0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c

Filesize
215KB

MD5
2be38925751dc3580e84c3af3a87f98d

SHA1
8a390d24e6588bef5da1d3db713784c11ca58921

SHA256
1412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b

SHA512
1341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003d

Filesize
41KB

MD5
e319c7af7370ac080fbc66374603ed3a

SHA1
4f0cd3c48c2e82a167384d967c210bdacc6904f9

SHA256
5ad4c276af3ac5349ee9280f8a8144a30d33217542e065864c8b424a08365132

SHA512
4681a68a428e15d09010e2b2edba61e22808da1b77856f3ff842ebd022a1b801dfbb7cbb2eb8c1b6c39ae397d20892a3b7af054650f2899d0d16fc12d3d1a011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003f

Filesize
20KB

MD5
fa4cc25f0f72ac052e9413b46705327a

SHA1
72127f17a73fdeaf1d867ff721f8115e90d82e8b

SHA256
62215bb3463a1bdbeab484739c056495d60f9e6feab8e3974cde6bf69504f05e

SHA512
b33ebe5aad7802e7aadf31bc490bb697a7a941c4ec9a03c211b42bf54403f05dba02fdbe42bd7c28a27e309c868f4d74c060840a4aefdff57ac9c5c2cb66921c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000040

Filesize
20KB

MD5
b52b188fd917cee86e8532bc1ce3d933

SHA1
0167f4cc43ab4c6def512e5ef7c7f6a3b576feea

SHA256
18f6bfc6293f7b041e3bcbaa933c70f569453ba111dd56f0b559ff9ce92614c5

SHA512
497b478e337708091ac07d1712bb10d40e519f40ee85e4d32fb8ff949e900773638b3165ca03e1a02608725f6f741fe5395dc7f850959fab325775b2aa025c63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000043

Filesize
21KB

MD5
47ce2d83c35fd76a6d6f7b8b3413a85c

SHA1
9924f62dee99cda84d48d7bbc60b0d8e57357bdb

SHA256
e4426cca4dc4dd6cb5fbbb0d9182aa0f7fae061709e58f014df910d19a74c828

SHA512
819a17ba1f4d4bcf0152acd0932d6852d72cd51cafbe2009eee7e609e5ce0761b19087d5959f90fdf69e26a1a1851bf7fb0aeb688181c94a24cd096e3522e11c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000049

Filesize
20KB

MD5
c17d979e7235bb561ed29901d6194c99

SHA1
9e45cd580c13da25c696497b12f1b971e3a5f46b

SHA256
ea4bf0d75ebff8b2764f07f99bffb759fcab359f023eb5697d498b6873e02c24

SHA512
ee1a596b8749cfe44d04081e56da7491840e0ee7d7d1a4388bc3d74ce21abc5ca23462addcf28a4aec156ded56247014a954f4826340159e165a27c06acfd94e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000051

Filesize
34KB

MD5
fecc866e3d9538e98f1244316fdf19ff

SHA1
b56615a6ff515093bcd5df8d030e69c7eadb75db

SHA256
52814aa3ce04f9381c6ecfed93804b4e1c2fed39a4da9c4179eb8e567af3e5e1

SHA512
584949332e726db70e387caef84e3e0a88c161438829013e72cbb998ee5895f0d5f65b94191380e8ac0d6aab0a72174d83a9d26c6ff411828961b5da3b642f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00005e

Filesize
16KB

MD5
6dc568f8aecc0246e6b8dcf8a600e188

SHA1
866f6894a7c51439ff3a7216fa01b2839a36a077

SHA256
8c3b2325cd3d30a7625d51d434ce010cd34ac2d6f7ba3a827b2bab727218f215

SHA512
81c4a945aa9af38b8126a3d7692547dee9efe7a58909ba6e02417964afd5177ffe17cbcb00b988de33c48a1119db4ab4ba3f6197815d63d3ab28de3708105498

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000079

Filesize
27KB

MD5
6b5c5bc3ac6e12eaa80c654e675f72df

SHA1
9e7124ce24650bc44dc734b5dc4356a245763845

SHA256
d1d3f1ebec67cc7dc38ae8a3d46a48f76f39755bf7d78eb1d5f20e0608c40b81

SHA512
66bd618ca40261040b17d36e6ad6611d8180984fd7120ccda0dfe26d18b786dbf018a93576ebafe00d3ce86d1476589c7af314d1d608b843e502cb481a561348

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c5

Filesize
109KB

MD5
6eda9c4c61b12b37c9d4aa16cce03dbd

SHA1
61bf85d92987df7a639d9acacd94cb6a36a7c515

SHA256
65aa52bcac42500ccd2048b39588f0190a18d5df77b36370fd7fbdbb1ea3e8e1

SHA512
58cf49b44fa819f502b93eac1ff1bc2d6465653a82d0a413e9f08e609b48cc762e70cc987366fec52bf8afa0e6afb6287d0cf5f4a5b82efc5d482e6d3ecd9a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\00e92bd465fe068d_0

Filesize
413KB

MD5
d01fa0ffbb262c412b6639c57010f5b5

SHA1
7ce58c737be2519c2720c9fda05bd71b60adcc4a

SHA256
5ecc787ddc40249611c596cbb1393d01843a0506038fc5a07cad63f167afe2eb

SHA512
8c0ae77da9e1ec3223f5f88001f91fd0cd15f46131a6a6a74d805084c10b8dc03c8869d735de82f1c6973fdc9edab9cc6b149698fcbaae53c85b376f9475e193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\058fa0bd8677d853_0

Filesize
341KB

MD5
cb8f70cf840aa5eed30b27774488d06c

SHA1
d894f94f976be94f3773c629957854d6e228f7a6

SHA256
35e4cca51ab5d26c19b8b86c23bba5559f5450908e5a8c66d337064d319775dc

SHA512
79c4806c697d5e6f24e11ffdf68318e082d32ddfa6f01e806f52d485eee7c482891231e437c069a81707f0506e0d25d6490f172a0424d988d2fdcb079b412eb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0720badf6795a0b6_0

Filesize
3KB

MD5
02c968b126c6b71bc157d94f4cdd7b8c

SHA1
3baa5d988c6a91cd260962fff65b61ae6d2ec9f4

SHA256
a9b6cff49a4e9cd51c80e425d3906925533626dc760ea5fbd6a021c826309d95

SHA512
67f7cb9a74efc67b91d26f4f403af7bed5d92412fe72d78456ed1419676bacbad0d3cf7a308561e29452e619e65c1532cbe3427655f61a6ae01a447962a4bb77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\09228f998f6fd150_0

Filesize
929KB

MD5
46d8117ece8ebad856007ab719a852f2

SHA1
5f05374a9659659ac67f1ab339d3777a228776e4

SHA256
04591d982ee5be4dc8757f45b3a0a6546afcda8b30fb5d92ac08c9ada36a314c

SHA512
80250b446c41ac419a5b4bde62cd46da1537e16da4bbd9b276067d6d330e2406631f96893673144a05542cce0c4f10a3b38322ebf72352bafc5fd7927a4762b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
2KB

MD5
32374b6ff531d9b0a071808e517187d3

SHA1
29437a9f20a7e62619386ee40ff750fcb7eb8a3a

SHA256
6fafb2c13f84632fe543a46ee4fb98bb74ed7debac2ebb686fbcf27f3d554976

SHA512
5b291659c0d8c000a82787d0a9e166ba61505c26f0cdc2688147860b487292d89c91e1f2d45672cae977990b51109adb0f95fadb1474e743a75334622dbdab9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\10e7f09a1dadfa79_0

Filesize
252B

MD5
fb35d691d6844a7cd958d248335bdfb5

SHA1
c411f80c1879e16272c7cb6c8bb383a6da1c880d

SHA256
78f749ba1490d24eccf8892c9b20e113152dc786a3fef1db196bfe06818522da

SHA512
ee1f6e838f4024d100ea1a1b6e616f037164cbf3e4ae6feebe6db8c766e26d21ba88a4872e981ab7e17a00e212e4840db2d92eff24722a6162839f334f94e63c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\118c7f3c9055a906_0

Filesize
21KB

MD5
ef956cce710191c1f9f872f3c868084e

SHA1
e29e9019143cb714f72380ccd0c7101caad5952f

SHA256
d0d9c31865204715b2dbb8a69790c11ef42b09a66ab01f98baccddfc3f255e14

SHA512
c6727a4323593b1bf61ce574e7b518380444291c3f614342555c7b3f322e145c09fea62915d96c46ea1fc0a08dc2ce22fefbb3212c34e502ca5169d78038c3f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\14ff8116b518ca2d_0

Filesize
2KB

MD5
b6b1c05b8d7da6abb6ce4c0ed6054e08

SHA1
548f570d2dab2e0c8a5a577df02045af37a2d935

SHA256
1f443446ef3e4517fe1f09a51f39b44f58f640296c205c36c95e71ed923c60b8

SHA512
4aeca7bef09d614d3ff38abdacbf3f7dd16a0f3774e9cdf54e5a9968bcf6b467b1fc394e6a08611217fe3f9b6cfdc80f3a3cd0e07b9d9ea0264578ffa21ac431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15008b327caa7137_0

Filesize
32KB

MD5
1c4931af262aa5751dc6a49f19aefe06

SHA1
430a730c7644d6c8a6f129850a0d8c3b694cc3c9

SHA256
d71f3e500cd22f1bd3c59560f288789c04e608d5beab51c9192284ac5b818201

SHA512
8d4cb9b4f293df9c09639c1a4eceedd85128b206546a2725d6651814024e2fb682e830a385a64e4b74fc4281070f5e6c1a3ea49947b2807709816d08b6123fa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1836ce308ea9b733_0

Filesize
296B

MD5
ccf5842e8ce6d57fafbde5ac4682b2f3

SHA1
a7bcb167545f3915bd6cbd739fffd85b70936863

SHA256
c307cda73276b07edb82c000de061e16ded1c8cb42497f659c98a6f721dbdb95

SHA512
ecb0344e04677e55a7322c89a53bd1dd280e840525f2eae9fa6a6df61abb2ee8f70c818e9d1bd10d3da21c392e6108a3db11d6b44482fe2903d2e79feb96978c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a29c5989d22056f_0

Filesize
3KB

MD5
ecb0af630768d6bbd7e340b2009df196

SHA1
4e0263c1d265af333f0ed5ff522b80b8aa4cc803

SHA256
6bc4510c3c602fb0d49fc13fb03b977fae91270fb2f7fef41c27009b7a0558a4

SHA512
7d19a394d4ef1321bd90ceb4893d652cf11b80aa4f2d5a83f1ff9a4df4511edaae3e742b0a3449473cd22f2b49afae9b4e3256479ca635d66b1a141bb7540e5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2146928176ec77c0_0

Filesize
119KB

MD5
7b9e5326c753ab0adfcba1732ef54158

SHA1
d9f28c911d16fb4a9b254fd3d84e53b0aa46e9a4

SHA256
3f0a67fcc692e07225c8c61dde6bd7b908b2ecd1b2a7450ed9ace19abc2b5e36

SHA512
b0c09a311da18b48c00775fdb314fcf6f0dc591ba20f9f56fef161377035b00ee53b37949c4b0695b49f93033890b3bd67f94bee85d603bd12206242f7c32d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\24029b20a1b39be0_0

Filesize
263B

MD5
12c71c48e7b109431921e7b801e8a40c

SHA1
86bd4162baf294b9504e659b97369e444fda17c9

SHA256
ce6b0856ed12ac0c88e7a85ddce68e10a1b1de71204c94efa36ac51ccdb67dca

SHA512
c2dc259efed65e74c7f589c90b288f9655bab32fcfcc75c210ebb178678d12a53263942f9bad526af4d0080ac9fc66ce2a081fdf7abade007a57a4a957476d05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2452536b75924538_0

Filesize
14KB

MD5
6a201b8cd00817d53731533d99226c3e

SHA1
2f7c6b66e7f9a26ec7ea4e5212e293e4e5049c87

SHA256
31fe57ce8adfdddea90a0f48ea77f5afbb6b18bdb26ce5341a8d9a577ea7db56

SHA512
667826cea983d61707b02ba5ec3daf37d412d1ebddf9dd13488c30e269120425c755902598d3e54ade736e26bda778af7b055816d6bcf7c793fd487a88874ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
5257f241a0e4d3075cc5b09a7e9c9ffa

SHA1
4460aa739de849b7f56ebe09a51680e2ccf4784d

SHA256
b00a6f89db34051d186068546163931194ffd4991fb38231e221601629e7ce8d

SHA512
aec389627e61081bb75b5abdb08b2427c41a50bbe479ae2537d8ff2e4a4c3bafd77e67dfd442d4f1a2c9e1966e1b8214e4fb09e0c15fe2407480e317af4d385c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2791695ac0b59349_0

Filesize
730KB

MD5
9f8e7099decad8d6d6a7c4953ddc4b7f

SHA1
6ad5d9862d3943823cc25089ba8f828162a329ea

SHA256
1d413bd7cacdf54a660c6904f026733627c85ea4a3ac71bbdf6b07ea0d701a7d

SHA512
8d34977ec219f8e4cc2cb2829e41d6eaa76feac19436ef6e1e78e3068cbeb0360ad0e34043d9ebffe2640c459e05cf909d530f90bd8e3f6e25065c89458796de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
9KB

MD5
ba9215c47b019c58b779e6c6c244cb06

SHA1
a6aa722ff39148d1f65264962cfe8a87dc315526

SHA256
cb78365040e9930379d435319d57bc1c9916e31b182c2a3cbf4a6066ba331883

SHA512
6ade214191a7a052d47c022ab607d78c2cb8c13a660710fdb1a6c38f1d6a790c686f64a65d6c7d1194a1dbb4111f5daad262d860e1829aeb036a8ab1b3ae8cc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\30bf906e04c5b843_0

Filesize
249B

MD5
3634a87048372b9c2ab037c6eebe014d

SHA1
ec0c3f95093912aeee2ee14ab234fe257c035495

SHA256
fcf456059f379512ebc3238b72186223ae83c729a163b5d5f4d737c934e7c4a0

SHA512
cf3a9ba17de96a4a17c68fa9420414130bb61ed736b6155681c71b97a4faaf97a8db6b071ea62597b4084bfff426892b9ce21e9be5831f6bafd2ae0b0eda5a04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\336a68eaaf209f48_0

Filesize
309B

MD5
b1fb09267959e4a91fefc399388f0436

SHA1
5ccd4a6d76047df62fb1831aee5e654707d47cc9

SHA256
69e4b49e6b1addd48b5672cd8f3d63f94b4b722bc3d26616145a66573cd75872

SHA512
9a06248fcdb22f6f4357a6a66fa76a9a3aa927859c33ce09139ba5eed8b24220fc7ddefc6a38bbffdebb2ac6dc6d1e5575d8f3ac369e9b23de74856cbb102791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\34b04e394e937316_0

Filesize
394KB

MD5
07868cbff7411d32a2971c850de80e83

SHA1
c196a56f23ed17e5c7fbd0a80f23e57451651a9d

SHA256
0d9cedff81255117a9661397f63130b4436d2573ad7f1f204d0a3cbb8b5cca8b

SHA512
6613ef9be2e42a189231aadb12dc70cec4a8a8b91eb032a6250b6e3584d95080209ddff376fdcefd2f76fa0f734b61d472491fea060b6b38bdab51d7bcf5f3e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3545a9e694a7a24c_0

Filesize
289B

MD5
261b18b73bf70d3708e4345b14c8d837

SHA1
821225f9df6d355bbac25d2f8f090086043c759f

SHA256
0b1d421656f06dc79e64712b159ae5a38410acd7a2244a6f52e8970a0643c421

SHA512
585e69e3959aa9af718678e9ea445907e8d2867801a0b5128e6f39b34d5108ada25d0a1364c5f5630e70ca1cd005094e6b503207c7e80684436beca7c2c01f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
6KB

MD5
9e3bb116659842563867539b6d4fda00

SHA1
4a1b9e51d2f8f0747b580ca27846c20c842f95c4

SHA256
aecbd10979d1d77d6835558fc3e48ebd973ed81fd636615bdcdc6a4fc8d1b442

SHA512
7af17d2404f32ba7b1778cb657316aabc20e90e327a58b4a896ca8d5d22ec43763d5bf85af510302231bda7fbe464ddb690c1ba2da7cafa22696157e90aaceed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f139f229e6f0497_0

Filesize
5KB

MD5
52c237b227da1f8c7c952df6bba6584a

SHA1
aa7314a2be57cfc4f440c0466876e3fcb180634e

SHA256
1c624da75f1da3b82de259cb868b4dfa82c4180d914ac37173384ea45ef3d96c

SHA512
b8ae5b0eb3dee9c3122a753bf36d1ee80cda0279408132a2c7328c515f25708ba3870c7f990c83131c2645d9debdf35ae82dca307020ba963e7bd51ca748b10d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3fd2be14abb3904c_0

Filesize
1KB

MD5
facc821d37086c5844c650dfd6577382

SHA1
c01de0190358f0a2dcaf30041d2979fe4cde3210

SHA256
114d6162ba0cd90ed69b9d37b0f9111c55ec9922f3c0b1434cdf580d333262c1

SHA512
60fc9dc314700fd8b9bcea85baf0ff7ababfa9dbca55f42ee54bdf8d74206d66c4c32270feb820f6738cec2ee9e713325b442a7fbb0f833d26db6177e1fa870f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
d755e2fa7d667d72ffe4b574927f8f21

SHA1
c38b6615c936d6c52dbe8ba917355dc85c93bd08

SHA256
ea8ee8a34e5dc66cc64c7c6ad3ab67ce56c9da3941ff19c2e97d4c5687d86215

SHA512
000e2f2c3f323dab6d251652076d14a9dca5a121665bb966695cf7e47f1dcc7d1ebfa493e9ef1175af185ee9ae31f24f24f828f74b6a34229c45b122f6d8ff02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c307b02b4dcc58c_0

Filesize
23KB

MD5
08b3bdd991645fa6e54d2c2bd1040f97

SHA1
887d94d0952525e4f52f47112d7d5095feb4392f

SHA256
a04841060b37691d01542e470e8a62e508c6d41995ee4e82dac5e299f604f89a

SHA512
83826cdd22828c4a8819218bb8637ac808f28360c5c687bbed8be4c36079576d73cc1a12977f2ab09e344e8a056770890c562f066a16303acaea8fab43b541da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
a881c69e6f6c5014b145ee8a6f3ad295

SHA1
68654caf3950d137c00a3b1cb15aef0cd0e020f8

SHA256
aee3b3b13b563805f55e59e96e669915eb892eaf26a8cdd123ea8715754f5bd3

SHA512
2e8ec1e0c8941dcfc35ea5fcf6e7140bfb65bf235bd1a845cd307a7b83c4923da026be9f8126311d53e17714a20eabd6f6ca5f8aac3cf0403c9cec2875b5eba4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
b25732d6ad0364433fc6609ca01d42a4

SHA1
990a5a11f502c3de2fc3d6a4274a481e0e601422

SHA256
b60baabee44c8725e99845c7b6c5cbc9c071cb9ba5dc7ab9c2cd55112d8e088a

SHA512
c715669fdedb6db2dcdc2db1ee6b8b9e417cedee3bf7d600aa66b8954c1dbe0b4bea2aa1d3a3abd491181c224ac7a55b85f9167061ecd9b190f7e836530bb0b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\56b9e24c5041858d_0

Filesize
158KB

MD5
c96c44f3219991d19d4a8175067d17da

SHA1
361c5f838361c5b1a2497e3c19950275107820dd

SHA256
70ba7b66106b4f8e728d76e97ee8ae0ac4fff66007e569ecd875be5d5d9032e1

SHA512
ce36a6a0fbcd489505dd791b861290bc371f94b56cc7b2548e6cfbc705f8287d2c0ea148a8f09bde6258b170542a471fdd6bd0d99350a6527bca455003e9cd6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5c9de20013be1f9a_0

Filesize
610KB

MD5
138d6d638a5a64aeddda62f5a9b57e7a

SHA1
bd6114e0a73ae6998f2ee0e28d2fd28c9a0f1779

SHA256
f3f6d5ac5316161a0adaa22a2b3d08d7176a0bfca0624137af3ceda3f74e3f5f

SHA512
0d037862c5d4f7a81b3c199b993cb5af5b22549c492bbc6ebd1f4dd9ea50e71ae396387200d2ecb8bdab64fc8167ec6f5d7d90567845b3a22441c192c0fd655b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\5dd1e579c9681f95_0

Filesize
2KB

MD5
8992f35bf362c1ff4b1a20b3e8715fef

SHA1
102ba579d05b7fa1883e8b2ce5e613bb396c75b8

SHA256
1f9c0ce0892ba19fcefded3103a644f672bbf71370344e51da1db2e415ec7caa

SHA512
60c4ed3632adacf15f23ca1a78c8fa2b77b73a48d985dfc4693848c05398fc96940a05fc334829b60f0e9e130a9ec83ce0a7cde569c04331626a94d8c30eefe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
4KB

MD5
9b4cc88458df91429ddddf9661e14841

SHA1
49288aeb13feb62100bb4eb941f561edf46f09d8

SHA256
a0ca8d362695f8ad824a880d0094d813ca579683a98c65e996c76fe52f292909

SHA512
4e5f9b2b45e39dabca779ef833d7cc3574476d543a6d310bc3ec0f93e99b4f37a94166c35f9aba85c4c8ca046b2c865821261714ef2ced7e913d435c08ae6c6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6244ac58cb08a204_0

Filesize
128KB

MD5
cfc401dd7d9ce78fae85777191a6edd2

SHA1
2fb9e7c46121b476de85920c23844c497846b33b

SHA256
5a681733fb91e18d1c9249c16e4ca097efa06e228ccbaf8c122b8d2ac638bef7

SHA512
f2981ddba7736e5c29e1597bf3ec7b1fa11709f584a25167ee8562b923c23cfdc740540d108d64504fe20715a6d31d9f3cf4fa7fae545ff49e88397091c645cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a23e94dc5f5a2a2_0

Filesize
534KB

MD5
3655f8490df371553e86dfb34f1949a3

SHA1
7b12daf76821d1e79e360cfdd36b69a165a3d306

SHA256
3decc353f41f183b669c6ec868399319d9eaaa6e453854b80aebd7cc1903e080

SHA512
8232bff13c36f4b4feaf3392ca3d01b0be540264b2d542288e77e01f822d456e642e241222ec0341b1d9dbe13d93d54809b1e2c09d21c4beb50eeda241de68ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0

Filesize
2KB

MD5
1b3984d13709045634b7f5d09ec4e41e

SHA1
c144edfed2fb38ed5c9e34b3168dfae09389dbed

SHA256
3786540c256b33d23aa5ab0358ee923bb9bbaf6d35a075a7afaefeda9ea0fc29

SHA512
e000eb1dd3c04017f014915fa5664eddecc0c0265e294fe0ea6acaff37a3936b460f27798a509c8be31d62951b0eba3793289c1cedaafee3c3dc1dc4a3540f97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b1c3d6d62495ca9_0

Filesize
2KB

MD5
341c82314db38464169c3b6a0571c6ca

SHA1
e474dc55dcd01824f9370e23e61cd7e9bd30690d

SHA256
58444b27098b10a5390c68d91331389be1334a52b77ea54895b3dfe47707a693

SHA512
0bf0d46e2628d3fd2fa1d07047b01dfcafc41dba18b7e7e954126adb5200f869cfcaf826d636dab3ad5c1fd0c042c19a16a62d1fcf04ebec8bcbf1c671b9d0d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e1427d19ff38087_0

Filesize
3KB

MD5
a6058cb6ba4edbee91c790215ea4f51e

SHA1
b561a53f205c1dc186feb83a95b6f81825dc0fa3

SHA256
c3faa259a25fc797d5fbfe031765e9bc86f88b41084b07a8a588e36f1890618f

SHA512
afc23819f916f588c56ba3936db88dd62faef859edc13dc6311507721bd9a558ffecd1f23b72cbe9c7df241f9614edd0891e26a6780dae18fe9830f333f33115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
6KB

MD5
09108991b617ef68e2aef5aea2bff203

SHA1
edc9a0374946bd2b0b53e4030e937c4a8802983b

SHA256
6aa2f14fda9f49425d1b6b7f0c9888c6ce5156706ee67246ba9acef6f9b1318b

SHA512
2bcecb3ca16b0d75d9c01d9a95aee22bf05a448adbd99a8ad411c7853542f05d2c2329e328fc726763e6f189104759c7a0d8f581e5fccf6fb4dd1808b95e4d17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
daaefa2b76260e49a7e3a41bd53d8294

SHA1
6fb21541c0f80f249e784a616642c37d026350f7

SHA256
565ed57973068c3394e60410ef47e23ca91df615f39f52ade60017e7758397c9

SHA512
6c6cd03064d198ca0fc6bfff8b653e0b0ee6f1e3857d9f22b53cb0036f2016b2ce69a5a1cb5da605712a3a134dac2678942894eb80ad149fa0d9d071e13b7f3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74d5b461fb29296b_0

Filesize
252B

MD5
4b7178a0bf401bdcb8dd8c32b703fe1d

SHA1
1856c72f76476ee583fd2a78ef3abaf84f5365df

SHA256
cbb639d3d013a2e0d9fa4a14ad45d4960bc0bb857ecfe7cd1507ea2cb829b0db

SHA512
db1bc21d566a8a6fcef127a930505b1d3973f7936c4f3d1790d0f60cf623eef097f67ed6de6b15d7ca4a169ac9cb9550a7b64c81a1ee2f741f7600e7c216247f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

Filesize
9KB

MD5
5222c83fe6c59ae7b52b3e32f6e6a6e7

SHA1
d5c26bbc87d38b87d8e6fca28beeae40b99825cc

SHA256
fd8b7f4bd4fc96403925034630dcb65d62563140892b3683e07ed6f34f8de5c3

SHA512
59e2d7c6c01fac28257a81676275ec5c914b36f2d8565f6ee21008fa75f173575d2446a7a9dbf25e608a651c9cf4b788a325ddfe8fac29aa0f7b183daa99c767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\76f1d50ef6183f18_0

Filesize
206KB

MD5
ad7dd2122eb9aaaae22319ee9a6e48ac

SHA1
192ba7de262c7c5ba9bd3b2be49b2b2619a9e17a

SHA256
8db2090ce577b7028f81d7816a28ef27c68e320fcc1b0ec5f6c5f8b051e8660c

SHA512
26e203d883b88d502fe1eea653719e2504669a709271a1893e4de9c50d2cd0881ba27edc95ee2b7a0ecd3164c79382f1703e439dee080b20358576f7ca83a736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\782d018d3f59e184_0

Filesize
27KB

MD5
c419397819083ba6c4f2459eb178abd2

SHA1
ac72da31079500ff741aa2fd35c26de0b83a0c02

SHA256
27c28f37a91ec4927932c0d737bf75b9cdbf62d0fb60351096846f7c1e8844b2

SHA512
1898ea42baa171749478dc5d005a308d102e7a40536427a83908aa881bfa6912ac286226256664714fd67f9d38e0308e13462072d2152c28e9fd1c586332fe25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7d07dc3a67fdc3b2_0

Filesize
8KB

MD5
9d1a4586ce68f834e72e5592a28a86d6

SHA1
89f02d5928cf0366ef2a0e2eaf809e4f68104509

SHA256
c8a2ded94936e000d32666cf1437672f51ae2261ca2f5b2e885d13110b638da5

SHA512
69cdcc2b0f4ea8b5e76d24b6b56276cdf6b7e5c930a5833b311fdd4e8a9604cb991a49c3cc2c2cb3940ac61fa07dc54290af90d865b79eb123556cb6a172ad8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8963c6f04e9d7378_0

Filesize
54KB

MD5
7dbc50db1a47adfa2ea6255f74c2106c

SHA1
2921254f8e49f7ead785298a03e9915a3dbf3f93

SHA256
4930e5609a4f46200c844bf690c9a8f0bfa9846d7f6d3f402c93cfb4dfa1ebe6

SHA512
c60f2f4360ad6de087c7fa19c569b87385efd55d748706c3d6d86b699f1ea0da5f0325998f2041509dfe683185d824476911332909369dfb1d3e718223adbd8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a32a56314d11f11_0

Filesize
145KB

MD5
43d497b3f90c14d4306acbdb49253a9b

SHA1
c5155eb6120445cfb6d870532fabbe9f5a179d4b

SHA256
114c101e755eaf1084a143a081874f0393f5137e9e25aa511dc298b5b2f4b03f

SHA512
3132b0420be825cf4eac1288adc990110cfa1a145b3c3c74697f10f84dc36d43bc7866c196e8f76d15b740d4b2dc9f4a0e60fc4932b49fb9e2b6310d8b4ff474

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8a693e1c4699eaa4_0

Filesize
53KB

MD5
b18d12ce231a38eebe888391d597c056

SHA1
aa297859fe720e00ece3d2886b73ed694fa4f254

SHA256
22c47623e9895b5f655d069aa41846e1e789e751160f1ba4d6cb416056970708

SHA512
f6da3b5f92e7cc6fc3a439e7284a391bb0b465a4ab02234b4d6fc9384b000b49b35ff16245be385935dbb682836bfd13b4a99a38fea090dd6e68cd5048ba4960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8ce78a9ab5b14848_0

Filesize
361KB

MD5
c7a5d996415192b6126b74b9c3bdcce9

SHA1
b8b2df9730a81df5e83fd72f4c1986ca19658477

SHA256
5cbbdaf364bdb8c359f2d4edebff1d2fa9baa3f533cb55bc9d0bbbc5c66509eb

SHA512
f1e667dbdfddc6ff0584d59b193b7285d73d635722ca94809b48c0a413af1ebc59d185d5ebf4eac1e74c72512f53a930df37e3b9a0812e70184ade7653ccf50a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d0e0ae8e0b42bc0_0

Filesize
20KB

MD5
fbbd2e564135fb6f14d9e1f5102347b3

SHA1
d414298e0af1da0a9c4878b2346b016685de1517

SHA256
f6427bacd3a84a563c369c7d57642eaec5f71ed46df13f4f2f82ee4baa8de0b4

SHA512
d06e60d0ab6d54e728e81b5721c98617ddd6f4a231342e9992cc597bfde6501806d46bb8c8dab97a78370bdae80cf579dfdc224cca975781131a3dca126d5c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
6107929c8c5aab47ec471bff5d474d0f

SHA1
8a59f08b462bb8fb391e933131a8652408438356

SHA256
10aeb6f4bc83237673a336b1f59e694a1583c55844295fc6b91d2d7e7f1fd83f

SHA512
7fe5753ad18f6792315803e6f94ef15000f59b468bf918472129645dd81a9b5225fda344d05fdbb63157665e92ef0ea60502d47405194dcb703f53fa47249cb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\93a149b24315cedb_0

Filesize
192KB

MD5
d845324446825f1b33853478204afee7

SHA1
90d10f63104f4865f42c78b07b355d99e14c566a

SHA256
66366e2a9f2bef20e6a22ace1c9b529d13574f21bd3e7f3bb70d0422b39d6b1e

SHA512
3a2cf6d1f1738735b8bd55d4ef258e5f4a29ccc6d54fdc1deacdd25881d53fef910d359c9d99159bb25193e75aeeffa5511108928242f509cdc11d8ac71377af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\94124545ff7315fb_0

Filesize
22KB

MD5
853ad81ff1084ebcb4b28c842f9a4c4b

SHA1
7c4c8a218636243f37abe050b4e4484e40c94dfe

SHA256
fce4603668287d20845ce3610587c218dacd860d1206b84f778db45932ebc3d4

SHA512
ffd2ef4eea1ecc52ec9b16c1d77f8f74d53feb1f1b8c88824675ed7a94ea354e437bf0fc4cb53f1eb7180d6d4375e13959d06ddd18b49b6afb96f06e790f18f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\95ebb9c26144b754_0

Filesize
306B

MD5
33042bc32ba04ca74ffa6c86260b9577

SHA1
1740aeed6139c9f54954fb911a7edecd0addef47

SHA256
19d5856cbbd359ec73c90aa603e863493751b8eac53175fd3e44e8ff5c387c4a

SHA512
ff2dbb1f73c79b99c5707fe781b539f094cc5c2d746f4e1f13f8f5c005dfa5ba95b306ea216617a9e25d337b69f18735f36d835aaba7c65c0e081d558cddb367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9abaae9efc13e351_0

Filesize
252B

MD5
e1aa88b6a2be422fa7292728a4cacb96

SHA1
3007d60711ef44606c405414ed1df27515919d0e

SHA256
80d061430c33d295a2ba3966fbfc553745d96d43245cfdaddf5def46be6b0810

SHA512
bfcf0fe78a00b3c7cd66bf646a81e56cc522237c691969d96529da1fe6d036829879d47d51817150c8ceeb304afd41aa3814aaf9298be5a5be269eb8a8717a49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c47b8705c03cdd8_0

Filesize
350KB

MD5
18df7171f5ac9154473d565df3f948c0

SHA1
dd5e320996b39f457b74af0bbe0683986380ab16

SHA256
aa1493ae68a42c0f9366ce1ac1b08d8c474e04db38e15068b000ef2a61b6a8ef

SHA512
3a23c128d36ad7e2b6814f12ef9f2cb327850e1f9ed1c1dd3ee23563ce028e0d9e6284e22d21e0e1ca75d06ee506f2d13a4725533d89833cdb6f1d879616480c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9ca3ef7f97f6e118_0

Filesize
267B

MD5
a9c36ecb761cfe409dd618764688957b

SHA1
b9309c3c291f6054b6ce5dd24a002de9d6cc64b5

SHA256
63e9a26f9ce42a40b3dc2bf78597de8ae46c4c1e15a53daf1cffbdfc44e2468b

SHA512
2648c03201357409d051670161746dabe46d2e801e2a5366281252819963b75fd6b7e0e82f57165172fa9834c9ad0488af7c55c67831d01bd6abd3a9a2e7d98f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
4a40d113ab15e0cda2874f1e1455e8fa

SHA1
429d385dee81353d820a739a42f2f2d8caf0a47f

SHA256
8f742b4f83d95daf1ddd2f685e02a1ceb60f0eefb59ab3dea8666ce40773dca6

SHA512
df8560b90fafdf47b6c5942992445900870ef685c9d45cbf7186c053c6471899121741c9f3622b37a38238d06d4003392778a2245662129223aa04bb3dd5e79c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9e04f19de8f5d184_0

Filesize
260B

MD5
1623e400ef0fee42ebb6648dab2ee912

SHA1
8e5877b970bff5b817ff35eacce4a993082bb2be

SHA256
3ad71061218f6a79a208dbff3cbd9c98d71041e2730f12c0e4112f0d217557ac

SHA512
1156c6289234899a26945bc0146333a9e7079bc71bbced53348ad735e0111f27ed6b0918a405766ede750634f8933f1779028ca7d1e7d36e2cf07ed6c0109589

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a45ce580214b1d3d_0

Filesize
74KB

MD5
24f5cd7b0d0e8572b7429e48177d7162

SHA1
b3280d784b45ffc57362683d9626544ec2fd08fd

SHA256
9de965d46e7fe155b8706172a725d29f0a47495ab9f7850eaf2d53babbb306ff

SHA512
2fee97289f0c41cdfa0a5b22eb0875894b35e14750aae0ce6624e6980758ebf008991e2565473efeb14313ec3e08c11b786c37f9f9ea2e57674b1d979899bdd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a4fbb6819eb6c1e2_0

Filesize
865KB

MD5
81a757d405326eebde18963e7f1244cb

SHA1
ee5f8f83f4738a080b9a284917f4435664e895dc

SHA256
6fcdba4d07f00b7225cab94df102718641bc869b973e6bbefec1462e345ab431

SHA512
b82896a6008b8cc2b97025cda63f1e004cdc833edf5674dcc2c775d7dece6c7caf2f7f4c7c5004ede8b700de88f2e9c787aa6bea747a273f3da6f36b8776821c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a89fb4df370be535_0

Filesize
554KB

MD5
b23cef2570cea2ed9baeebf76153491e

SHA1
a6c9557c28a1a2d8f22873343c01d5ec0d2afc58

SHA256
fe0d3716002bd50c4688b447196c5a46432ef02d64172577c895ee4fa6070844

SHA512
31709e1bd0388a8530d08a2aa9abbed6cc06b9a9a7abd91aa7d3012620dd45f145459bb0110d4635d9f816702a5b049d820560067f040181307f7a4d45215bfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ad391a0f451df4e9_0

Filesize
4KB

MD5
3996c4036f8b01d4233791fcad8c2d02

SHA1
0ea362355fb8540c49a788d21c22c3677c46a565

SHA256
339ea4556e7cba2f02d480ca45753dcfea1a0d9b4bf6c73c681cc29b03e0f717

SHA512
ca077a0afb68003f887fde07fc7dab4ef562bf944b397769415b16e5c45d9a07ec1b04262fa7124d12a5cb283979285150f6083bedf8e06b5d84e87816056758

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\adce463dc0e730b5_0

Filesize
15KB

MD5
8c12390651a44e9b14e908e5a44ff9db

SHA1
763f24ccabf7514e0f1517ae51a5098cb4d746cc

SHA256
8be704aee7d952c4914692d20d95f1ae7f8b5ef791555f27e0dab4f1532b3b16

SHA512
f982ceb7f401ff0637fd9fe901986f1245e998f6301e39dcd38fc6df35970221da42cadc6aa73ed82d0329fbe0164b7f80b13ac4dedfd62b743671b4a1b9d6bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\af685a4c8625d684_0

Filesize
306B

MD5
69eaf49ea25d6e268acca5355e962b6d

SHA1
793c650e4c3df55da8c848cf41d74237dfbe8a7d

SHA256
08dccc5856fbb363ff296f3c574658d94b4bb4262800efa5bc944e3e20e103f7

SHA512
c95b2a48f308f1381f604a2fef2d85e0b4bd155c8f0edf04d2b5d61c4a96496a59a28585c1ec6482429509d2a0f3d8da5ecc24649f65f39a411f238f9a8ad19a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b0e8c20204a2d26e_0

Filesize
75KB

MD5
1df0fc30b1a2f6e8ce29e85812e7a1a5

SHA1
10347ef5d8f950de566e01c482a6061ce5d703e3

SHA256
0a9f2950e8ca3dcb19e6079b199a2781d57982577b2df1945e38fbf3b099aa66

SHA512
7095dbc390259e5f6c7e8070224557b535f1fa26edcb2ab64d0dc35bbb6b4ecb56b2dec498182bff8d131fd7c3b44a16b68266e9c99d26b681f3e2efca66d89e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b1d693ac0f52716b_0

Filesize
3KB

MD5
640af463d090ac89eb9b37a4029c8a54

SHA1
0d8f45834bdc9a6b3c726ebc167354a1a110f9d0

SHA256
59476ab0bc106ffd897be0d87d98c6aa7ea8a7b8ee8384e6e7b2cfce3b5d4fe6

SHA512
b2b45d656c539303dd96acbc4edb61b86b4e74c146135eadd531ea19c2d9859cc3e36e51f9f657edf67ddd7639bf83f2995a77b6bceed675c21adcef1f20670e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b389095db6a3c4d9_0

Filesize
31KB

MD5
1fca66187287fa1a6b8567d02bf63df2

SHA1
419de4f940e22cff4eafb99e318f71bb8e583d9d

SHA256
4e5ee1c5a373311abb04c75a7cad8a27e0cf38ce3b1bce9cdedc32de7c5b96ea

SHA512
4d50ed10dc20831f61977c776eb2f215fb22a87e62ae0b6cd79a34167754f9646f45db41058d8b278e8009818202f32434427969e454f8a12f68514a981d5bc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b3e82669a81c981d_0

Filesize
2KB

MD5
d94b8c2a3af65627f946a947bb9d642d

SHA1
ce2fb4e193ff0a10a7d58b6070a613def035cd68

SHA256
e6d6a5954023eafae089a9b76588a5357efec324b1028f7422987b25ad92c70b

SHA512
18e027d6200a65e9af7c74d29253866f3c93d365277c669452e19e85da22cd98332b50cdcd4d5f1077d76b4dc6d3e54c434f144eea8edd97efeda08139db307b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\b8fb7f17faf71513_0

Filesize
251B

MD5
2efb5a42fc7e2e74c30f359250e95234

SHA1
7ad74953e2d6d7fb6ce1995191125c2f10b4304e

SHA256
154962681dacc7501cdab5b3292ab957311253b3f8ab34eef0c6e7f80568c518

SHA512
38fe34cd706250ac6dabf132a053bc20f3ce2fe3b71beb03023cf9e79815c1e898d79799c6e6c937b4eb95d7973aa51f2db5009920fa96903ec38e3029174c97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\baf767b9123164e3_0

Filesize
289KB

MD5
4db3831c919c9772da9ce20cade3deda

SHA1
6d151f95703968e79d9408560261f4ffe59aabcb

SHA256
1d7a373cc804e55e9e6b1129530c2a07240bdd3be2c3b0c95152b52f6e504ffe

SHA512
75d539220cc2229062a2a8164d65aa057db9cfa13d69781549567d11ec2cef998610ade53c9bebf246342ed0b2a4106f5b70a569fc4e1475aaa8d07240cbf82f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bc0276656709e65b_0

Filesize
259B

MD5
f334e1b7e55e5c6531954c5343350cea

SHA1
b2c4f5a433534b3c950591a43bede774df3247dd

SHA256
1d162e352d1ba860e5c61d93b56c49cf484e874d853e58f3e9ce8bc43512c02b

SHA512
2a0686687fc060dbf9088bbdf542492c50e2b486f1a1df9f0cd9a1dd12d49c67b5a044cd24d7ed2e650703ba18e8f02aa8411ff3ddfa650a6bb7bc9f48451b45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
1KB

MD5
92c00467d185c2f22585c71382c724b9

SHA1
d29a1940b1d88d2e74d5f186370efee6b2ac1132

SHA256
13331f9d681eb02c45d60584575c937451fe3698cfc005c215c206bd3e4fda19

SHA512
08a30b1940ff88af806e4b54db84683c2f1dce4b48b41c79bf96c63888ebeee27a6f4a5e522af08c0d6303963d952ad41c68d8238496365b9fe8c9f4d27eefc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bfaf848dd932ce68_0

Filesize
80KB

MD5
183709495326f35c99337c058cac6e19

SHA1
f986480a75e478320f20f52dd44b1f69e0f8aaff

SHA256
042aa5de93ed42378c35dbf6505b6b2d16005fa12b47a7a1e0a7ddb0959bffcf

SHA512
99d161d11987434c2cb0db51e7808fe203a7d94fbbd3df098b30b97cd818b3746e47014c8c1d81decee81577e6bcebe305bfd1429f2c83c7639ae3cfb5e827b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c40133092d101876_0

Filesize
29KB

MD5
b97d5297d3e0d8812e04eac25d724fde

SHA1
1ed942de77c68b93e0016fed1252d49341ce15cc

SHA256
dd9157f68caee34addecad6e86a2ee20783f0369a7ad0b69141f4fe65daa8540

SHA512
e9a4fe9d6d74bc2718096f7039cec1d23cba4a52c9c132ccebe1aa333c5c3a6a90a23466ba9c763e1c3639d20eac2ee195502d3e957e359071babb8e52f27576

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c44449928b6297bc_0

Filesize
270B

MD5
2a2deb1096e2ca3b49766ee1d11769d0

SHA1
90a393383a7eb5b3fd1b8113fc47eb13b8075ff7

SHA256
43394f5a3e95467526cc8729d85e6d411af891df5ccf0d6db6e3e738fd43cb4c

SHA512
b52676699d050cdb0ee0e1c0ed7b77c84a57971e62e8b582eaeea12c5c4d4747376ad5623db9b8399ae4c65e4353a0fee03afc7952d6b68486d8e9cfbabb98c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c91c845c83814759_0

Filesize
14KB

MD5
5367674538a84d95f4879af041845e02

SHA1
2a3388bc464261ddf3d03c17df564a8a48949537

SHA256
23d991bee7e12dd16f17dd9b07f67d523f3dfd019144b337b91d8360910ed648

SHA512
b98843079c7b8e6a4e31cf5a3791d4ee71ccfe0287ffacd6dcf6ceede07b1fdf5a96f019afcb4698c966b2b443b309bd87c6c30e5ca5f73f2425509221b2d050

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd9a47d844308cbb_0

Filesize
6KB

MD5
f353a00410c9d046c1c73ce3f1bc5f0a

SHA1
b7428a1184dd6b9944247e859a97b496c0f16b03

SHA256
1047c6abb95b29eb237d5f0c2e0cf93fc27b74633b1c97d696d4a6e02265fdd5

SHA512
df304bb1629ca949c39464e88150f18e49194ac290b0ee9d5ca3d2f3b1d22b671c2358983cc371b0231edf5661feefce7e0fd201edbc3128dc42cb49ed0e7597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d16e7811b38cef70_0

Filesize
337B

MD5
e4313bae718d802c9d314e6ad59baa79

SHA1
484c0cc6daf560f9e48fad7ae562db86ea9888a7

SHA256
65a3e4d1fb813c138a883ad63a1a2264a7d77f5e23738d17c9dd8056bfd7c02b

SHA512
6c22a82ec9ab0884d854dfb690c76bf57b706c35d6509fae0840614b0bd4608c221f85c585d73deb250cde22bedc65e824079d965e7abeff608fbea0c397400f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d23c5885716d996f_0

Filesize
262B

MD5
bfd227c97e51ffa8d3b8e6c42674bb52

SHA1
512e43125499bf44433464409abb1c44d7f2a37b

SHA256
34560e41949a131dc92e365f6cd3a71c20af21e0666e0a59a8b55e3dca722ce6

SHA512
2b284a5902930a71d95f3ccdf91785f4091b2dfa6968017c523ae704d9d51e25b161bb86c20bfd1d9117510d82366815f5842b9629635dfcedc645851bdfff22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7082b136006c70f_0

Filesize
14KB

MD5
dd68d79ab66fbec2b4f738ee5f15be68

SHA1
919c240a0fb2cbe1965d644c29d707926a4e3dfa

SHA256
68c16e2a39dcf2e59d641460e2c845ee8b0c9881aa68db68ec7364f94f1ed922

SHA512
8d4a8e61e454bdf43accd0ec844cc8950b9e99b3b05f52677071992dc2bcacf9d95abecbcf09ef421c63c175eed5ecffc22a6cc9856e10d48cbb11b240622e81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d782f305bb50c377_0

Filesize
300B

MD5
1c2f51ee7270a774e56c2200f3d934bc

SHA1
1a724b92f5de3e7c113ed0724c13dd628b3d4118

SHA256
67864392c61d34a60a3858465f82c935c7323a432adf037f8c7134b686b04c79

SHA512
459f75cdd92aca7799d920ee2eac60d00b4fff6f67d861d763defe8a6a32232f7a21c959e9ab90078f505c2515824eb1d2c94f36fc411841596a4007f14b1a92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

Filesize
262B

MD5
eec04bf0ccbc134c750df0b4d17dbc65

SHA1
7dfce7eafcadf5405246301ea3367ef5d54ac4e2

SHA256
4dbdcaec9304ab5f1066795c0bb4cbf973b4352d9e3211262ec0e78b4388ca79

SHA512
ea4e05e2cd7bc50c13f26f1813128f4713bb93fcbcd141742290b7ee6826b8172ba8f3c80f3e3c042361da6628ffc101b9bc38b015577a2083bd7112ea290ae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\da82014a94532e8f_0

Filesize
33KB

MD5
411c35c2149643820225e7af98b6b9b0

SHA1
57443283d4967d11bff1697f061c8c6c9e96f664

SHA256
e559cf77998b0e240be8a7613ef8993c17f61ca92a26707e8fc3792fbdc7aa57

SHA512
fd2afaa73758dce5020d59395207c1067d500f7c2d02555d2d2066c77fb6a4bcda380d3bc596514efbcd6374505aa24c9bcdc6df8d92c5660f125782b96a1da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\dccc6e10ef775901_0

Filesize
277B

MD5
d57b1ec44a3529c30c73e1def9f6bbd5

SHA1
f32887fcce88e905f5173fb60f3f7de98b044bfc

SHA256
53461933d2b541e3dba7e42e84824f340092b64bf9d418e19fefdaed40aaac12

SHA512
13c1f7d91351fa8074edb12a0d17afb5626e0744acc66e0f9b774fd560fef1072e812a86871c8c7d4c1c7c977e8f60bc2a4b95f50a374ddba8682406d27cf4b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
6KB

MD5
a87786ee676ba2fa587ce441ecadd2ea

SHA1
438f1c8911a7c8078cc5548ffa1e1a2d4dd99fd8

SHA256
2dfeca7dc98fc569d558b32dcb0db06d348d5b36055b884a5226957810e2da96

SHA512
69f21cab51f3a8973551f6527ebc4f3d15750fc96bddb5b24d7c9f2fe97c6c759a2b88d71d77024274302a1284e8f274468d610a9633d7f4681ef5b26e3d2120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e201db4afc7e2e56_0

Filesize
307B

MD5
3ee4527070185a0012004792216de023

SHA1
ac2d32b7f4963aea7111b4bcd7c335ae75c9b80a

SHA256
1c85f892b8c19bad318cc56904253d08e218509caa4148fc34f71aeb3bd35cb5

SHA512
12c90f666e53f0ceffa44d7c326b74036afe6ef9ac6208330b6da5908aafe3814877506aea226cbac754eaecd1d3e05c3fd2123dc9456af0b4d70c8968d08197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

Filesize
47KB

MD5
c9414dce34b6165a1868cffae7d06a6f

SHA1
0e831e8677b1e0aa89bc48d711cfb804ee33a4e7

SHA256
b54ed0557b0bf9e3f3b965d542154430e9643223b9991516bb8f1438389336c8

SHA512
e5d1a2fc61bf118e4d9cdc194f8ad38d79df072101e6a9d1ab5c728173e3cc64157ca973d87ab7a2c684c75de7013d12d8ebf1c981734fb0ae7b460b24d3aae8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\ea204df25cf6e4dc_0

Filesize
175KB

MD5
b9df9c44af9da643f95e16eb1e64e159

SHA1
fcccb073b6ed1d2acaa80cffd2ca139bf2b7c257

SHA256
8a536d0c6577554ef45e0d6e9689a91f3920c8c8be8f38753d9e683f2315ec95

SHA512
7a792aec5a9b6dba0e3368c32a6a049137f427d5110fa31ecfa1e723214541fd049dea6fc2bcc01ce837478fe1cf6f871fbd5d3fe202d8c6e5dc1ddc7f60da55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eb9aa4691e62ba3e_0

Filesize
269B

MD5
4174f68c4b9b3636c476a725de4062c1

SHA1
8fc18caf803aa2ba7d68ef74fa13348883021b16

SHA256
3e824caab3ba8245c7a436cc305acff2eb756175416595dc17c9ed83dd2f4d0b

SHA512
1855ffceac4988f86760ee309191099d6de9a84720e75ecbe13ca58ced4e0a637ca674220e57a6fd3acaf8924a850b28243093666dfab769d580d3675e91dd66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\eefb2e1479c3fd9d_0

Filesize
352KB

MD5
8052f394e8e4629cd6c3e19b3f26865a

SHA1
9f0d3f60264f033c337d50eb2532115bbf267080

SHA256
f4e69412e64b76c018de85b46fe0673edecfd88cca8cd2737f17b772648a2282

SHA512
018e7a2ada02821a52da5fd6a59cbf0404d95cdaee1cb8be16e4ba57e1155ae44a8221bf65a540cddddc7072ccdb6af47d105c3ee64620d85635ee1e6c52d9b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\efb2cfabf9bde180_0

Filesize
54KB

MD5
91abe7b39367092ef5fb6ed78dbbb557

SHA1
29255e8372d010e16a700eec3d30e3107130911d

SHA256
f0ecdf731b300c725be46184dd542d38c47a61325449b0f1780a2e4bda0d787b

SHA512
be9ad2960839d438f7a1bb304d9c26c97c5993cad42f121aa508f989144df31c71122b9c5ee733b48b1e97f43ec5904ac03a202e9ab3ec2e8a4435d65314d817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
9bc68ed38a7e44584cae8d5eb86ce757

SHA1
6fc8f1e6e1d4f24a9a21ef23309cea98c5cd540a

SHA256
5c3cf2bf0f73c027c185059b87eebabeca17c3074b8353b45e9db4845cd9a78c

SHA512
199bdfd8f7ab2e58f3757c531646bdf2996a127eea5f282784fb073a0f0bfd9683423413661fcb3b03344aa2596871cee55bfc5c585d7398e44ec711a22ea437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f8e533f5b80ac21b_0

Filesize
72KB

MD5
3ff69d3d51336a2e6f40dc0e96ed175c

SHA1
b52623e3cada6a687f226bf173b31d1f573de4b8

SHA256
9bb1c5c8c4320b7e5cb835c2cd53c90f6c998c2eece76ad89060bbfd296f3c04

SHA512
95f6a3aba2c30bb81a71bec91d26cb0131fb47f57b5fe95bcc3c1392da51665b16d673fac27190cbfe464a207fc9895205f51b5d34faee818d4372c2c0e5d2dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fa12e1740e147802_0

Filesize
294B

MD5
c9ced0ddcd345412bf237b22da438231

SHA1
7623b50f1e080a0993050413bc5383a0ffc97076

SHA256
41757be530e6d0a5574c288d530fb1d9f3a300415ae7e0226c4c0d0fee4a6042

SHA512
124eab359be7b2aea80af7561ceef1c27e80bdfded4d60fcc974ae46775d9279acaba1fd8ef6bd31670ab9b43f7b1d5f8bd63c5fee0b9097c267d4c088c45c3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
6KB

MD5
f9853eb62ec0fe7326944353634dd997

SHA1
b51f3c376b1577887eb806cf28d3adf47fbf3b6e

SHA256
6c48bf31ecb3f8035cd15447dbde5c4407a20666876b4e2fa65843d0a1bdd337

SHA512
9d77cec80c37f1855b24d29b88f7d1054213a8df23ee818584620a7912af726f028910e340f8d1eb8febc0fde15fac0d7233af5a6d8abea6ad1f4e4cf2b8e5af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
91b6c116a8c3f291e609efe66af45ae6

SHA1
eeccf9621a733cfe8a9df4925aaaa3faadffe703

SHA256
9fa449ce5fd03809b23c5efa849c626312a4ff2928d62d3fab4e1ea495499100

SHA512
10cc3abdb4e384fd20b2ebb11b569a9c54a8db55aac2c4b24deec2f6acae8c464df08a0c47d49729fd65bb3f7594f168f9d8ace56e1966729cdfe05115b91320

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
3adc6e1d96bb6ee3d46198f10948cb67

SHA1
79cdffd543aa78b98a4b88716f44c2df6d252a3d

SHA256
4bf605a3ca2612459fb35d395e6362d176f7bf66a6e65fbd9cc45a520a532935

SHA512
1b508543f9a2dd825fd4fffe03592e4e3277719e297f01dc9c6072b2a7e9be6a376ca370ef4e7a63e75bb8bcb215abc3542c8f497e753f57370e9344dda2a327

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
66edf85708038a320bc9cf8d57bf6a90

SHA1
d0b237bd91e72e906de317ab1fe6021bfdfbe257

SHA256
395e6d9c7168c93460e3870041f5b3da9a3d7a2e27eb66e98ae5fbb18992fd06

SHA512
38dbe6ba9fa84b3b458647be11743c681698e77568279d58e089bb016b09bb2ec0aa69ff43bf61cd92910fbbbff2df968164e3892573f2350fb526e80d95c357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
e8008692c19edc9bca2830ea7c20551c

SHA1
9f472640099227b0ac84b2994dade258cacde47d

SHA256
8bd25d8031e9952b4c13033d7b55329a86628383c4d261221c8bfd64489b168f

SHA512
f90425ffd6f6b8d982492711b887bb373b3d38a9e494908170a044ee45874b9268ab6573731a0a80cba84307016d5320588f4b29e33b8ba5549e4ff24878d56e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
5faaf8925fab099a977c95e5433d2ed4

SHA1
9da09930f015a23770b7ae12569706f3cc7cc3cb

SHA256
6a78e750ffd936e7959b2f9f471081f7845504de54550880cacf2cc66cc80506

SHA512
b226f26abbdec2b6150b14598bb7c111a6e251d00060446a2a0735a132606f685e3026a3b2b05347c1c7a062548b5c983549bf62e390828bcb6a2861246bc267

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\LOG.old

Filesize
391B

MD5
26ec717d0b5dbaf0745edc00ee132491

SHA1
dd38ad5580a795f53129882b7ab9fe70a1cb863f

SHA256
a2d2f6bd27ec65aec65914af32a12b1103906ae0687da17d2cd198ba35207f51

SHA512
a5fbfac2437a60dd376d754aa9277e112646a9b215e0426641af8f849be2f1b77b18000d398a049b1f43b960202d9c16202273bbad44fe074121df51c6287ddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\LOG.old~RFe59cfaa.TMP

Filesize
351B

MD5
4a608586821f69fd90b78c78cb8e692b

SHA1
f7d590587c7af2cea1054c722f5dedeb1e4afe6d

SHA256
3dee6342c3128ba922619888e2010867ff54a076511efe7393860e677483746e

SHA512
2ee5fe92ea0472de282b4afbb9206f840ee5632fb1289a0a4fddd1e168d2fdd5b095f3e4106bd6b53e7ee59ff3d3fb3ff617022cfca5825e7b7cdbd865d732c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_en.softonic.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
19KB

MD5
70ccb9e3d25d5e6cebc14235dad187c6

SHA1
a666eef3d3109997d4813f74bd8aeaffd50e73b8

SHA256
c9418952cf196d84fc30ec240c087c17cf07e1e49869498963062cebd6e9c696

SHA512
0a678d661205159c21a9fb661e52174870f8008310484815e5d41dac091efe734d2b7751dd585f8c21ed0c0408fe42ba6cb8487792938e5f88dde5ae20843054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
14KB

MD5
e439e5bc1f4afc45517d9672373c79a9

SHA1
ba64d1d15bf9dacbe0d4b4049d6c5b3accea8f2e

SHA256
e4e7a3363803f4561826639d1cec66581357901bf01695f11bc7997f13c920f5

SHA512
5fef3906fac9aba0359df08b8e2e17ce5d05033108b2fdce0fedbf304f1abaa9e24974e637e7cf621ac5f2c3a8ff41fd26597b02f1947a1f4e90cf5f92644694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
95c18a6211feeb2b9de7b8b16fa649d5

SHA1
4d0785568e465fd99b943a5bf9946e1384f9bc79

SHA256
ed06355babc4659fedcb256df7b6bc657eb4cf993e811dfd23244bbfe41b5a2a

SHA512
ec351011d3227996781d0a8af7d5b50100840212bb83e3cef7115980cc8b11e404a079781643dfb6c6a62d2eb484f13bebdd32084796abea8be5c11f49294eb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
18KB

MD5
253ab5c8cce2b9e3856530f20b5f4a25

SHA1
36e4e77ae28bf95430d2b55d771e6726c99aa5f5

SHA256
a0e41cf55fdf019b8fe80b4461191d6f628fde82149e3cbed3e45d1219db040c

SHA512
1b3d14238773aa78a15f1ea62a1fc8c4f662cf3bdb196f9abbb8cac9f0cbb8e0274e0b4424f2c46984da9ff37dc922738ba5cdf20afaf58279b0225ff15cf52e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
16KB

MD5
eaa5bb70cb05d137a029361a41968ca9

SHA1
8a5cd749efa59c0559a0b8627c01c1c639960fe5

SHA256
c93a746c89d1609a8ac1b8fb46f6bfcfad5f6c2ce6a30d2863c311bf90990dbb

SHA512
9fb2431d3c5bbd98d24ee94291f1b306cdf200990bad0f995a42ce30167db5be9379e2341666f9bae0aa32c2cf29f0991d006215e7a24c6c3bdc43008a7e652a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
18KB

MD5
62fd6452b37988c90bdc411eb095b7e3

SHA1
4e28c36bf93a3175c8ca472d7cc6fcc333efb9bc

SHA256
d53d188f642ce6d77080ecfdf5f33db8b8c5d3d6ff114cbc93385d73b7363681

SHA512
534f6439bdcc05297634358606421e221fc13669c1f23730ef781844767781b2601e6e1102e4413fc215e458db89f2e699464b073c28be656f3fa0f6d28daeea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f26d7b57d8364e7d3aca6d636b4159de

SHA1
58a470e2298f59f3a26b212389d6b6b5b28cf0dc

SHA256
58f44d9da063f6c7f3a7a585ce5e4c5f07244be8479748f231b37f4dfd3098ac

SHA512
fdb211c2307474bca82dbb07e42c25702c83c65d17e610c50e702a05bb82eec511783ff8a10c7deea8729e54fe822219e3c062ac51a14cce64290ece30d75e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
9a296e7b9b2bdd7330e8c32cb65af836

SHA1
0a4b084f14633d4dc9f7f40f246c845756e199a4

SHA256
44281b3dae6cc4d45e8adbdd9ad675afbf55cc3aa79138ca3fa0d127f7f81c2a

SHA512
7c9ecc6d90a7fc683f8f739f7762ee31aa402981088dbf65ca33f7ca78babda1db905788c2723a998ca908ca795e78813746d3241ef0d34015841da163426dbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
5ce0bccbaf3efa2c4211c0d697bd3eab

SHA1
4e5c9e947df8aa7760c1949f81083c5d9019f839

SHA256
cbd5fa1dd047810a1194f12ac89c95c88a081209e5638f7ade8d14f7d159ab1a

SHA512
dbd344f2d8e6534061a758930c96149a5e81bac1ed5699742f8c5753dde038b8c9b0b46084517d42e52c5977e85462b478671fe6e9edfa47ab68939097dd3718

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
b02b9d56b8973b9af3bff145fdd02eaa

SHA1
0762dc7dfbd859bd9b9da7f09120365d29b69bbf

SHA256
72102018dc8d503bf3720aebb33a0199f26ddeb3b9b560c4fc3f65d5051db646

SHA512
330a09896decd91d5c388638e4d3864f25ec029eda001ac199a1af7a4b348b38c62102c21f0547e51e5d4143228c866cc96f0849c9d4fbbc9a69a7c9ef74a02f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63d65df56378da1dddc81b596e0f8f94

SHA1
7417102a6eca6ea2614dd54ec81f1980fa273970

SHA256
a9df2df99a7e0b3a64a21fa45efc8b788a3e12abf59d0ee62b642b263835482e

SHA512
00cce9bf55815b9e13a02be35749f1bf363acc4772c157c677bf14c8d1923a46d8216e6686f43cfdc81314e38090fa77d86b2106f0c79606fdba6a78e887a368

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
4277e90fdcccfc3d0e7eb59870ca7550

SHA1
1726cfad4bf6cd45c85b6c97612525a2511b4f43

SHA256
df36381ce51795686882dd8ee0188e75f4ab1d50f58c5a63b169913b3b547201

SHA512
2a7b2c4f2c6984c2c7b93876409d0e64c330a98a29236aef1c6b1ec652dfe4bd1ac82fa0072dd96ede68d447378ffb18f51df44c0c029a8ac272e393c62ca6b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67c58af6406178665788872a49dd6ede

SHA1
b10c02ed3685164169839f28be0780a826ca35d1

SHA256
ae6f3cc8abb4fdf35ffd9431d1083aaf840714e41e7088cb50069d13bbdeaa2a

SHA512
9c0bfb1c0bf6f183b10c52cad5b7dc899c572023d51a4fe2ab8923b6713790bf075a9998ce433b6159a471688b264bab4087410454ec68a60e4ad1ed0bdd6784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
c6cdf97e0df155015a3bd73cb8562c15

SHA1
3a17eedc4ff6bd4e561aa8c7add0bc7ab18c1822

SHA256
d87d668099f4f81803b3c258d15896d2aa29ef29e0a23cfd27f8ad816fc85bad

SHA512
489b0306462d1b958c8af4b55bf7007a3c2eb6cdef19865e2d30422fd20acb7b1044df21dcb07baa51ca3062594546e76b3665ea8841c9ad8acfcda268b374c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
90151421c2e6878cb9d508ddcb620b84

SHA1
c0507ad9a50dfd1afd64e9116469743f05082da4

SHA256
a16a5e31cf1993d04fb5a1dfcb982dbd32f9d208565e617f7384e470451ccd11

SHA512
a74b03c83a46f1c2c65a10e8d58ee30b1681ca8edabf3494f98eb3dccd79858e37536050b3e485d3300cafc42a15e396f2ebf9327f44a204490d1a99f54919e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
be633ae45ea9c64c77b79d3fe3c76081

SHA1
e99ada41b688007d8c3ef1e0c43f4614d1b36ae3

SHA256
b5154b0e75fcae276877466fc01481098b09314688e34d8b993abae668668096

SHA512
cbf15d600ef101d390176917625d7acc6114d870a6187b0418cad6689527662644f658f4c6be4744b5e98e2d773db0622e587cf387d7823f6c6e6dd7ddeeee2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
cc2db62294d9714e6342c17b5702744d

SHA1
f271da33a91afff08ec0ce8c7ca20660608dfbf5

SHA256
302085e354692a838146886784b1f638c37d7c353486c8c5a5dcc35a275fd090

SHA512
d08c32a85607c9e8fe80c8194c85ab35d78efb75316eebbecb61f39f926be386d161bc46053f001a9f66803c8ebfc1379744c165c9f740fe65cacffeedb4d481

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
7383da98bf69232608d2a08a06d39286

SHA1
c6ded1943ce7f62feb21f68ac5e21f5489b8aa6e

SHA256
48babc56bd7c5f176626598704ed8ce1bddbc47846858bfbf783b1e50cf3c853

SHA512
674378e255111a8311906db6aa1b03ec14e5f4de8f635c3e0852ee905fa39ddd939327f863f5764b6ad71b82fac0ea647c4c106fdca909c4f94643835d719bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
23KB

MD5
3b85bbc19783220fb9862db7e05e5579

SHA1
b80d8778e296257aa4bd920bbe9e837f05a1c046

SHA256
d087e1ccf6680d0e5364018b206a638a1561a95dad84b54e3e82d35d38dddc4a

SHA512
f5b5c3d9ace092744f0f9cdc527a9a2e586d3acd64575e21b5674f0cbc58c825ddf6c1628c2b96f6c03feca5d48b879159fded7b1b33d3a6c73b1b1b40a526b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2ad33ee6f7107a9ca4a33e6b3e19b7fe

SHA1
b7b2176509149274f3dd03f3ffb474eba32daa84

SHA256
176d8b31931d60f60d4895b2404b83876812f3974a5aaf04f3d1d8a5021af07e

SHA512
af616f41ff7fe0027278d7772bec02f9926e52c10a1f67aba63363b70bc8f75749185d9f1c62f6972b4881147abb133969def47cfe54f37e9cf427f7a8c202ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ac8e9f6fb00250206bc2b22bac7ea6c

SHA1
0716cc87965a66a942731bde6a7ae37698bc6e09

SHA256
9f8719abb33eb54ddad60ba91aa2b0da7fee8371e141beee1f8fa4b74b2b3d88

SHA512
f17b04eb98615c8d023c86756f0151fcd8801ac1ad07a9785a2d77a1c40662b3cbb803ccbe188cd7d50d86b9c32de14b7319b4361a5b27b9e4ab9682c9704af0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
64700292f45d52fff72ccc7480310bff

SHA1
b2bd76992aa42c779557eace4640958f658a3a26

SHA256
4181bb7806bf1d25d64fa1e2af69407e99f19e1a8390b5ece4293ac65b0c356b

SHA512
bff4e4a40900fdd6f9272866a217ce779daa5c3cc70fe792992b23a61ba1c8157f5b56b5db7b32ab2d0086f5e357882d37118319ba631255f5e66b2e51c4f9fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
a8ee408e15232f70c04de29a38927fa2

SHA1
f3d5de4dea8beba7b35c875bcdedd9605d5ebf08

SHA256
4c205d13359d2f234adba723e9000cdc1a09b801fd4af019d92f237506164a73

SHA512
5315690374f376b15273bf2079593d975a5aa9bb8c70e9fa866a64b3778d38eb109465ee6d8932c483a365f408942ec7f637142306a641987bce96c55c62475d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
446145586ed835e8bb8a5fd58174342d

SHA1
f8fb5dd5cc6c3755f3e23985fd4029323b64889e

SHA256
a8fee41ca62920c0133468b24afcd35618f740f469b8c4fe4239fe74430e7f80

SHA512
a220389f42461ea9cbc9be267df5c79276e594a760df792c841541b69cff03be69cf9135c3fe7392500d020bc903608bed94a4a11cc869e23551b26917adee46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d17a23b0ba46b52fe90e6fddf51713e1

SHA1
108f085d8d22f989224075d749a862ea601c02f4

SHA256
d942969af0d10a4cf25c8f2e7d28d8c46c53451f0890bcfdd3fec33469cc3704

SHA512
0264651f0aa09c85f213660711159e2257fd4d55387eb8223fb6ba443e94415be45cdbe96c731d34c19d4c541320e4bacd629efa380fb7aa629035537bb36181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
c2aea89259322f5054f3410fba5c57ae

SHA1
1c93005ee3a7f405004a3dd8c78b644963c95d9d

SHA256
76d431ef655c11247544bf029fd173fc7457dcd506be32753976a66ead9f7774

SHA512
8f1716980e3d79089372a6f0b62008a6e93acd02aa951feb29129301107a896a93888d90f5ee1eb35569b960534188c02754511c1a33c5f82bc4d077d7008a37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
21KB

MD5
9a6ca7b3ada819be700e8240b369c572

SHA1
33b9989856e3aca2798dbeec5d848a1e7a98fef0

SHA256
c69a20aa4dd3f457bdcd00d899e7d42be28d4bd7c48d2ab2c3007569aeb874a3

SHA512
5b13c65569490bdfa763a70675e4903ea300654555bd0334059bf56042abf2d266c6f6980d853dcbbb04da7c30fda0a8f2d4ecb74f8ed253e0d715d8c4c912af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
8f39f8a08f4ebea4a5b8fe997d3758f7

SHA1
36f2e34f5c8acf16dfe5e672b41a2b8cb864127d

SHA256
2742b6d732162a8e91497c10ccb480609b2c2b1d5244824ee6d8df52e0dc1266

SHA512
36abadc3e749605fdac9a1de85a1bad799d93e00ebbddb9894afc60ac3271b8232b7dafcf8ff7a7571db38afb3d82c0e0dd36d9d087fe4a3170fca78c999d78d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
6d4b98dccb05103143999d0f15058085

SHA1
80e19fb87e289d436c325ec97ca859515807c8a0

SHA256
300f019b0acb070c5b54699a55a791069eca275fccce5178b865ef688cb5c1be

SHA512
9396cb35dcfc3a9cd0c1d8bfb86a1fe71437453585a76d007fee51fb5962a0e560bc4593c41b55aaa0ce612c44cf728dc348619c79fbe2906f93d62b2cc7e8d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
4ce1a9d5e67138e1b1757a02f1caf6a8

SHA1
77901fbb79d2363a46a717a2e5d89e32fdf39238

SHA256
9037727b57ea06ce061739e067085be14b0066d9d7a8f381ffdbd732a5aeb20e

SHA512
0cd0aecdfa08ebe60c9bc14499f7efa750b94ff29efa95965ab5e4bfe79b65c786040c3a3c464f4533e76fd5a5572ce6ead9b8f593065e8fe2ea5a9e0d8d8c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
7a488e4d9941a9f863627688b50d6488

SHA1
81cbfbca9d6dca56a5326a65aa9acb419fa52376

SHA256
6d05f4ff95f08829771a06c9d2233c7f997ea6f7a8cb2cf82903e61c852047bb

SHA512
42a25110d2c80acb56bd0e6e20d7f268fdae67aaa3bbc1f07690acde4f9311236214e8c434cb45ce426872e11d988ef8ead652d6fd1e578a03b8f8e82a3359f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
dcaa74723687f093527af28459805534

SHA1
f0b7c1f24902cf75ebbe6251e92abd95a8417bf8

SHA256
500519b4a9dd60ccf123803c44799950173491bb15aa76485981a1b0cfc48e58

SHA512
56826724183e5a53ec7ed465190941e37e7be25e4742ac393b24a1c5ded9e48a18f1b81d1d3909677de2d83c94119dc3f3e840c930bbf994a0ce86b8af9b13d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
b0bc95b919b5abfe96071cec8b1f4331

SHA1
18e3c864599e99e6b135583a687ca404a9cf3868

SHA256
824f258c8a6e9fe172f1fbd6370db82195d8283abba71acd0ad5b224a7ba80b0

SHA512
823ad8d8fcd3c8f1dce552e449c42e37182ebd04f27124da761af6584f39321117611ff59c719edeb2a69129f08e6ab6152c61bb233e2ffc492cc25d37033640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
216B

MD5
2f1e40a3c279f120495e2fe3daf7e68f

SHA1
a99be20b583c09003cef7b822563a7e22fbf11ea

SHA256
ddacc3665cb158be425d7ced49e6bd00b58a3c3b44ac41b3df00ea96b0dc921f

SHA512
ddd1ca198ec36e869264623a068433d53a57b0ffa6ca24a6a823ec28ab4e6de5a36ee540aea9c7e2d6a1bed8a82b56aad204d9a02a8700109076a163c73271ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
168B

MD5
d0675b0fb84c3e126470ad3d6f17630e

SHA1
7b14450f9d86c076d690289675dcb5979f4ed11e

SHA256
4b3ccfe178872e7ca4f0cbacf4ff28eed28822b871e955b17d57c8e058d96ac3

SHA512
baca5e74318d8785d823c05bbbfe71bc0d4a3a9df0a4ca2ecf9d8a6d8c4c9864605b4af4aa59d27bc69e50b2e8cb1b4f9b81a725dba0453136bc99830c0806b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
144B

MD5
716cab2f993bc5513a7390379ed215b2

SHA1
74cec41fedf2b05f7dbf3b23c060c2f0b7456535

SHA256
6c1542bb0c5c332d607c76b46f719f31731c4ae43fe538ee43eacb67222c7184

SHA512
f4b33a3d1d43a7cb43b52fb6c09e88214b2dc24854310713f8cc0df407706d25bc6dc6a7dd6c4932d33d4febf2f309cab570e3a2f443d680c546a94506ebb1d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
192B

MD5
a5e3c91a56a6be84d1edad53e19c371c

SHA1
52ac316d2814edcff5a9d0701563ab4988f9dc44

SHA256
68f7015e80444e59d4f4cc26c17b681adc941904632d9104e4689738913bc964

SHA512
2985591db6e2ac16c71b2700c91bba6684bae26f431b54ffb60afe76bf431764cb31010eee16f4c62f3e46e890bd85f791932f675324dd5ee3ebbd01ca7e2201

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
240B

MD5
123a7e3190993a3443a4921eb7fd3721

SHA1
8d5805fa947bb7fb19a2e78e0732aec9d4bbdcc0

SHA256
c5afc04aecbe7cc88d3a97a4889e5b71129710f8cd66a37e23f2d4f33e050075

SHA512
c5e6d559beec50303f238a0e22b56c8d021aea27f7bbbdd610cb4063c190867e85656b9438c00aba323473aae0bf832ca0e96b97e411c0c58b5e240453151bf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5945e9.TMP

Filesize
48B

MD5
77f25d8a3712432b1ca136975ee451e1

SHA1
01026259dc6a7672925e4d6571052655fc71e96e

SHA256
500ce55ef3fbd61f3bdb0abbbe055c9063b6dc00b1e670e30dd773c3e8d88b78

SHA512
d0c8972ea1b1e4020ef4e226123d15d54b1e04459d7397f4c11a88b2bacc7bba1e95b5a89a9247e75967505f8de299380c22cf065ad17ff5b0cb49fa2d388dcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
380e7a81a0db31b6386baf2db3a897ea

SHA1
1d5f3a2ca85560f9dc01ac9faebe218a1075f81b

SHA256
06f73f125df60c37eaa971c8f88e74a0736f9a341726397a982846288bb41352

SHA512
f3ec777e0a53b4cb63d512fc63428e7bd2ea220d82a80dd9728c95b8130f8146a739307b225ee7bc1f01368a89c1026f2450713586502425df1033764c3cb094

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
e6e1448602b385f2f12056426442288c

SHA1
fa641f62eb7e366ef75182cfcfec8825090c72ea

SHA256
b17eb2234d0183c123763fad26c32b297e7effcc872980cbef34350e33c0fbb4

SHA512
bfc1b68555c5b21194c7207c11ced889425c57b6ba24df54b5f3353e5b09b1aeca787cff4af7e2edc87df80b3a66c449d2470c42c9869f1419fa847c9d1c3ee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d41445d7138e23169c4a36e2afd581ca

SHA1
ac9c561516874182c7e0226dd719235ece084c22

SHA256
37de869231e22a389cd3bcf4e6b28be9d0dc937e5025f77c8a7dcf47c80f76d2

SHA512
b1b7d44b36f4f920e25133b5633e868d9803e7e05b84ffdd8d5538a13ef0996c24e32a449253a3a98207a5663c6731782d9fb90ade21832374da649325578761

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
814116780d5a42d9bd2c969fc0c038cb

SHA1
29c7c5832ed2062643c627d6e789da25e1ebfd57

SHA256
056c68423f56af813bd1b1fa3006d7b29bbbffd8c19bb6e36083e167a4d40aa4

SHA512
676cbddda19e73fddcda88a5106e3e737777cee65eef44a24cb16981932098167213cf2a0febee3dcbb60e10198c329621b7f48f3294505165a9a933afb41fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
508f9a3d4d962890b321c3275a2c68df

SHA1
7ce840a5a0effa6953632120b664a3a4cae47bd0

SHA256
31aa15b47ea0a836040179d1ce7a00c1e26b56de9e4e7b0f861ed5f2b9e9fb43

SHA512
6687ec6bc13d4e36aa945de2b67a9217a61134fd83a2339162470723ac3a165e050de80bb813e604b97213f4b1b6b50b941b4f1497ef5c86b009579bf778864a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
c80982d7582d53a7050266cf442cabc7

SHA1
1322302919b6d20ce93ea62a3ff47e3429494c02

SHA256
daf6ca957da6df782686cc332d969c302e469e50731e9ccf6a0dec9542d72305

SHA512
1e3ab480e89be39d0485778d430cd384d9e4e8c617fdb1931d5fdc0e3b013a1cc5ad0b77d1683b701b97698d0134c2e818c2a5a27b30ebd6ab13312999d104c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d015d3cc8f14c21059c7901c387f069b

SHA1
d15a37f9a561a32fc36d49ca86aaf0bd777b8e23

SHA256
36cd2b7811a6dcf4fb81eec510382688d5a7aad2bd662eb8590d197516e8e313

SHA512
3e255ee26460caa2ba8993782c4d8a1ba850583599084c5f9f16ecb0280a30f582d4d0a1e7c1a6dbf95934d3e73561dee7a7afe57326ae8b11d90a4443f26745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
02fbda96093ec1dcc4b85460157c4640

SHA1
64c7e535fdc07da86518086a22258e4d5b01d057

SHA256
a2a85f80d7d3f009abbc43a080ce594fbfae14e9e1a70acb80b38a0495d126dd

SHA512
e84e4e58fdd9a773a48b3198a0f6f13084bd1a73e5b04bee2cf1e1d17c157a96923cdd52f5358db4d1255fc45f58f7a1f30cf83b9e77931d9d3085705b00cd70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
4f1f0c5df1d849376570d4d49f9aea8f

SHA1
aae3908c98ffcf3c12d589ee73cf37324fec52ee

SHA256
f27a39e74f59a67c9f987524b821cc009e2c859cd1f5fe3f4ad4442e2420cddc

SHA512
c4da11591a1095f442d2c392b0632375e93e73e9819d7dbfe8014ebbafaeac0841e410f9536bea9fcf0cb83dced260ec8298c85ad87fbc454ee1441ef4a0c651

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
fe4cbc4905c2e9c00ec942a3f43da855

SHA1
96fa16e4e6a2fef6d6401956e6aa84e3e92f02c8

SHA256
7899592115aee63d643f541a54b75dca6bb28c7a67dfeb87c2e400a735379fdc

SHA512
75352fd12fbb39986c351174624c6b721354c5d64305d140b9c0753f316808ecca203eacac1a6cc24856fe079d72d34473f9415a6c72159ed45c29a859ae5516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ccc496a496c068d7c09f29e8c9a7aa00

SHA1
a08839c96a65d6ac1681f1f87ff27d4ef8e443bc

SHA256
d3590c961a050af67965414a9d114ada87ef3f025aa82c65e39da753e3309c0f

SHA512
5ac4ecc7002c610c257f444e494f665659e26a49e31579b7cd777b4ab3de60e452b279059a2cc5c2e786c49be66b0222ce0b2f8c676e7d43f2763bf5a342afe9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
534B

MD5
851b21697c88977d2094a241c1d72b22

SHA1
e12ebfe42255f195e0c34180dd833b0bb6435aa1

SHA256
30c03c16628de18e8471ca07bc0b41e04903365f1921e247330178d2edfee0fa

SHA512
51203098c020aef4c1ae67b6e0b112a44052e39a9c81edbad345465d9c39e69ca7c039a27c98eb0d22f7313eaad006ea3e65e3c3566deb06c8824949475ed8df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
38d6c727e9474381a4d241f5480dd6c8

SHA1
db878f05b63841e9ffe63aa6a4dfc9a91d36b464

SHA256
f7c4542a2f1380f0f5d73e56892140534088b4ce29d93178f3f23ef68060c633

SHA512
c6f49809cc86a43972564a013e593b58731fec4ba696cd371c9b579ea09242f5c8e60be73a4c5b3b4ca2f6baacbcaa0cb10da0487582d075f1534ae87cfc22f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
22f2b8fe900c3f474340907bad1f2bb6

SHA1
7acb2531d0a070f1c5ca4319264be7e94c9765b1

SHA256
530b260f5baeca15b0c1f1c65c63cc1de4e0f71e0faea55b56c6683386f13959

SHA512
9e7c0342916585bd243f0a4fd757390520ca232d46b14ee419a9038f263a9e9982dd4cc519a0767f6a4fab1ef5ef76ee6c887c51eaf7ff91e85933e468e44547

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
f426df119c25f421497bfbd762c48aae

SHA1
6495b9272efd2aa8ac6416b55575bb75e0a21fe3

SHA256
bbcf70d1bb34acc6c044bfb81d49507499c9fa0d65ca30a04e0cae6b39c7f545

SHA512
1f7f8656890e8b8aff9290db62b3180e02c2f5d8aa68c652c4228e7beca8692f31b01b62c93042a3097306ad357eed6188952079ac34ed150ae75a9dbe6cf62b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
e574cda24886c908c8a9ae364b5aaf57

SHA1
af39dca46517d57cf4b9689467f9ce22274f328d

SHA256
81138361c7cb442dc378484de2a2be4aed4a21c7a4339f7037ada9ab234d6e4f

SHA512
c56e3737cbc6b79504af446396defd645c0eee4cbcc1d05322a2c7197df403a7a6d6483ae89a83967357532348b7743a1a9f2282e00be78337dc531e58f75973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
2e839cbb2b9453a2290a5d31510563e4

SHA1
b80bb4929331d98406ec79571c565ce489418af0

SHA256
18d71e2c0babdb564626734b575a0d7ebe3e695868c7f5fe206e615422882462

SHA512
b7d6c6cd1445570c1cb799e8e9669d7770cfa669d933783157211850570bba745446beaedc76818124b506b0f25a4a3b91e5975f857c1832001a3968267238c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
dca4e91a0027ed5e33c543a1facdf17e

SHA1
4fce746ce55c97cf2d05a861180dc0c15ae6d684

SHA256
ec880736d357ba72dd93b3d2ee3465b8b6c98ca281525dbc0f9b4244981e4e43

SHA512
469a72403be2880148fb8b6e84bb216342716f6de3270df3cf0b58977c0a6e72a745ee7585d14debe3baea9163bdfd65b46d3e2e325a908af9a84dd74c629f2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
b576d71fcf7e97763a921e798ec8b213

SHA1
7250f705f8ccc854eb58af82f2105afc67431326

SHA256
c20ba8a87b010eef6ca266d64364872c0e79ed75aa62fd3212aa294070e65634

SHA512
5f098b139321304fb8a26e06308a71617c43a5f2c290ef36deb52529c487f253cb564018122f28bd65ce86901905ff0a0d38f675fee311f716a0a31bc8fda408

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
99557a4e54d9952413ba44a06c247814

SHA1
5467c5c7c4e60491489244ec5b5677ed20afa4ba

SHA256
08d3fca8f96d0b292dd6a3ddcf2ca683b210ccfd418441af6581da4d33a131f3

SHA512
1989b50793b7cfe8e4df2105337748c65ecb0d8f3500c1cda63464cc466193bc297412a5430b195084951628fc9a73349ad94028408d0fc9b9430a395e0d9182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587ac9.TMP

Filesize
534B

MD5
63de60fd01f87072b8f363b781fe0f1b

SHA1
29768e7cb0a36e909f1108f1d5a5665f95b63e90

SHA256
8bfef93411f491421c437d99853d7a2ca35b275889cfee37a5256233c05fb194

SHA512
86cae295d6facacdbfc492866b050deda61121a028379390fe5fb7beceeda0393cf933c38ef145cdfcfe2e05b461236ad315c2795477639d261587df0064ea1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b5d9849ed1dc3e7d1176874b40403ca

SHA1
71e08410a447d4ad37dc0806f8c0cdafbdd67c11

SHA256
936266a43acdfbede541be9ac761ce332c21786ba90e8f47286afb7f945d1924

SHA512
07ccecad20f0b7b189e601b2a02cc0160940751319b8e987aee3b2db8fef2a2ad3d45c6f970d93a4ec466f0567a2f41bd3ba4bf95fb88bca896db4f7a69f47a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1a578b5aab3ec80e54dd39c4f056d648

SHA1
1d1af5849fbe799547f54b3be8ab6799668b61e0

SHA256
faa2580d2a3a58e6a5dd9d102c90c6d9833a156765e33f3e88904bbb499c3668

SHA512
43d9df98b0335d987633a72726f5f12408f8ea081997b2e2964f3160316816bf12538858439317e5d243edd4df15a3c0c39f0290cb7a9d0de13db533396c024d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
db3b596022e3d95fee6099bfb3957f5c

SHA1
d9c300a0b9d6ed1c356d966bc0f9217996ad6120

SHA256
f335a25c965f77a50ef61a375dd4761a1918ac74448c44068fb433b34d77be20

SHA512
060b0c1449dfe66b3d2bc638ddd2e97b9185095a0be85bf766c37e721edbf7a0cde646fcad4bb268fb001d21192d1aa1d58c2b8db2b9351a4b7b6ef269a95f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
82152489111000bfa3667eb6224c6eba

SHA1
a2e827c1f12b7e838941805a9ac1292bd3b81589

SHA256
a6c372dca3a80e4a5e0f77f49505f3cab5c99a91198eaf30b622319cc62e99fa

SHA512
4fabe630d1a747dd7c13031546d48482039c4662cc9e67f445fd634add8b7096456ec827c64da67b1cdda778e45130cad2ab1a18f357bd7d007df547c6efaf98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b4944aa4c3ddfae5fbf8d44cddf3f3f8

SHA1
68e2a82de78f77e1411d1994996b6b2fbb00e3f4

SHA256
dbf15ba610588af46f7315b738abde57e3acf33dae6c112606b57b7f54aaa4f3

SHA512
77696044a6adb699aeb85303e0720c7500bba2fcfa2877e220c3818cfc1a87fd2597dc4524f0b6acccac30069d57f3ba82759c24f1e02eb6f8564b35879e2423

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d7e07b872c440fe49abb4da6e89d30ab

SHA1
0f26226e576b25aa7505fe12a35de07b1e4e7133

SHA256
5746cc124f4bcb78776f6affc32dcd579c303e919ffd399e67e41eedf3a6a5d9

SHA512
9f630e7f252b0d446fa2f9f8549f8e99df23b69f5bce235fa9cb72e0e01246ff53b3b654d46cd65b0745b5e6b0c0b53f5a20db9b173d08cca0181e0701c98c0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b28c74411106dda3ce6e889ac98bf49c

SHA1
ac68b983d982bf362fc16914efb6d80f418a1239

SHA256
20f043fcfe17a847281cbea60007893f29f39016605e84b5063f004e5476c20c

SHA512
8fbc3b590fa28f84558f631d1b517c272dfd733ec540c522fc9bde5a89988385bed616c61db6585e63fcc36910c3770022481efc236db0f18d662976cfc933b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\CallbackCtrl.dll

Filesize
4KB

MD5
f07e819ba2e46a897cfabf816d7557b2

SHA1
8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

SHA256
68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

SHA512
7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\bghtmlbottom.png

Filesize
2KB

MD5
9c4d1f850fee91967c574cbae37894ef

SHA1
cf2c9eb44c7e0e40fbc635ac83b9b374fb599e5f

SHA256
4e7b4373f5046fc315f47660fd54fcda2592b33b827998cca0f1c762af8a12c2

SHA512
90dd5f05bd405f92f07b93c5ddd41f43368ce129544084303642d4a9bf463ee221953aa8eac678c01bea6a7b28f3ae781890c9fb225b0a74604d50579f9c9d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\bghtmltop.png

Filesize
9KB

MD5
2f5bdffd60d55bd5d8a59438dc536703

SHA1
5c6187f98690964208bb9ec417a5eccd06149b7f

SHA256
d460054058306e3754d1a6b43dd63c60b862c8147dbaeb051b686ea8a837bf5a

SHA512
ef7eeffe287835a94bd020d99d58c9b96ffeeb59ae5ecc5fd26d8427c85c527bba0d71361752d9daf55cd05f175c924e58490078b8ae0a4218c521a19caae1f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\botva2.dll

Filesize
35KB

MD5
0177746573eed407f8dca8a9e441aa49

SHA1
6b462adf78059d26cbc56b3311e3b97fcb8d05f7

SHA256
a4b61626a1626fdabec794e4f323484aa0644baa1c905a5dcf785dc34564f008

SHA512
d4ac96da2d72e121d1d63d64e78bcea155d62af828324b81889a3cd3928ceeb12f7a22e87e264e34498d100b57cdd3735d2ab2316e1a3bf7fa099ddb75c5071a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\icon_10+.png

Filesize
266B

MD5
560c22d598aee7c262b61a6b11242e6f

SHA1
068246598beae15d8ba8bee945b6195c22b1be19

SHA256
076602d03c43ced82f13ccf94ba30d804c1e924492310f223b39f8a290f21e66

SHA512
7ef6771ee52fa587219706d5e7ef8b3bf87167568d7f4cc430827e51af92db7bcdf91ea578d967ad56ed7d97b22a5e1501bcb4c40a9755c98de0c10d5a647b59

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\icon_car.png

Filesize
183B

MD5
f40cf25c06826d8bdb1516bed50e0119

SHA1
a14ecf6482a4ed2a9a7c712e18f65ba0aa61cb06

SHA256
912bf550897389226899530807f0b3796d5029f2d87eafac89249abdbd468496

SHA512
af42b814420acab72f3dcf6ee859d56fbd1560e65fa84457d088c1c5446091411896ae31f3e62a4f011eaa6551a18545458d492e25b74da9f3b09c18abeebe7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-C4MGS.tmp\webctrl.dll

Filesize
8KB

MD5
d0372bedb70710aeff382818ad683f54

SHA1
f960deffdde9cd5cb5fd3608185a49a91d398f3e

SHA256
b3daff58c8e7ca8ce6fe155ca78c681a7d3144a538c3ed4c2913e91a1d2bd717

SHA512
4b24a990ba155b664bad58884810123898f99f3ffe3d9704662c9576d31d60f1889c7a368589af7c3c9559e5fb9921cf87bc4faf73b4b83d1262b50c9bb5f706

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\CheckRunning.dll

Filesize
75KB

MD5
bde4550b5c9563afdad24e393d0b3f7a

SHA1
17d286aa45414817252cfe0a96ecedb3692911e6

SHA256
2642c3b4dced9404bed8afc68db31a7f777e3fe4bab2e8adb42019099d01024f

SHA512
b09ab84b7293bde483358f7a91ca10ab737f24fe4b6a96475235710496ec189e515d754c0f78e91563eb5bbb2915f336841ba5150188726dd4b2e5ace099b30d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\MFCButton.dll

Filesize
240KB

MD5
89f2f18309679dfaa520218676816719

SHA1
bbc1a5cbeb27cc80b3f2b53a742a00132bb2cb6c

SHA256
c3e299b95595941981fd3e3bc0194c20e62e1282ec2e52c67a5cac89a31fcefc

SHA512
2917ed234c018fce30607890f937b3338a7229a50f7d18b35d02a0cedc07ff2d81c69a47f8801e9dbd6a04bfc6a1a5636f6098b49e0d3650d1a8d531b79f690e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\across.png

Filesize
137B

MD5
ece0524c346240947640289ebaaf5a83

SHA1
b588f039b2ce34ae51c30d5fc6bae7a91c639c8a

SHA256
b4a667f9a966d6cd35a8bbf76ed849ead7b14dfe08ce4f149f8c17809418ca99

SHA512
ef38ed18f5e9521c1f0faf38d0553fedc8aeea00d82ffefe041698ccfdb5ee6bbcc5cf7dcce3be7a63aebd825771b0cad38a9717c88d18323a13a1bc34d87cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\aman.exe

Filesize
1.1MB

MD5
59fd4eff74d1f2f457655f4de348a14a

SHA1
d8f605f20fd9b0bd33a9b3467cfe4c8e4fada126

SHA256
d9cc1707442ed9648c150987747e3b48a6ac8d395d52d6f8301f25b477fbc644

SHA512
e45b31959481abe72d378bc58a3849e8aad0968523366ae2f8ec0c47276266bb7828009d3e3ceb0b2e34e99db53961a78a1516e2f3c0cf38fbe8dd0c6765bc40

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\iconclose.png

Filesize
274B

MD5
3a58934b887aab94f6b08f937379cd27

SHA1
1b56a9405cc8b818c4c2584372d30ff2e3f07173

SHA256
2412f5c1a826c923b6afbf41aa700066f8845227bc6c0732f1917f4671e16015

SHA512
f5232174b1c4c3871fbc0fbcab403d2281f8d2c207127466d215de44b23d4472e5dee32210e3adf2294a9be31b334e0dae14f0421ee05318ed419239bcb983d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\iconminimize.png

Filesize
375B

MD5
5577c4f4a5b74020337c273b94744d25

SHA1
46c46b1d15a07319d7396e9ab1bd686764abf785

SHA256
8e9e7818db8b22e2d7e836ae72712eb402b4e94fc43aa1b2a6b1217dfb90e9ac

SHA512
3cd31fc686103a83ce8779fc94771b51afbf1343f5ab4e36f3f2d1ede013feb6eb4b0d66c48c5f00217eefb9c407071fd30188dc0a16244d86899116c6fc4f45

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\install.html

Filesize
129KB

MD5
11ae2b6d5f4afb3a4c9edb1939d59606

SHA1
02a42ec515b68593d6c1827e7518393bd9c7b7e0

SHA256
af0ecad803372b0350941bf55c246d8061a6826bb4ac6abcfb6978fa3f907906

SHA512
2bf921f6600eb8b63b237da8979ac27ef5552cc6524aa9d50cc0e630d582ad127d78c8856e703dc6ed351c2ddcc614c2536b285209445646e1c2bb4ea0711e68

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IE46P.tmp\vertical.png

Filesize
140B

MD5
2f1b4ef6b5c3dd2174030eca6f402ba2

SHA1
c15580e3dcc711a77d290d0c57036249b527a6d5

SHA256
d7c73c8deacc5d6ebd2ab64834a915bd02040b357eb0e325300232751270b7d3

SHA512
f7f5e43a688baf360beb710b46ed0386740f6c4056a33204168b0ee8884e446ed0c9079fd4fdbbdc181d22ed5dca122ae2f0ccf361a2dce076792d58aa32c05c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcf83B8.tmp

Filesize
12KB

MD5
c0cb841d90f9793ab04ddaf17b95bcef

SHA1
9e32b69489b5b13361480f536ef681aaaf124943

SHA256
345bd54f23e045cc96e5801f7e092eb778d2469164805d1257837fbf91cdb471

SHA512
3b8d1cd8b71535210ff52999141e5524c4982ec84e74e63afe005674b17d7d58e6169d91cf6b8326648966a0b8efbe19ee71b3bf67db645d37b7c85b912d9296

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 128701.crdownload

Filesize
783KB

MD5
e83e79734aec1116c4af858ad1608016

SHA1
77c4dd4a28211b8032531726087472d78d0877d1

SHA256
2fa63a4fbc26eeddef8ea43ee2b5db3559f02fa11b4e78c6035d3c5e88100355

SHA512
58c72455bd9daba46cbd6ee83762da236ebca1f45bda3577d72efa159e10435dbc6c35624cf2a5d5e519634fef9bd30e36e97886d09de89ea39ec27d0d0070bd

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 385129.crdownload

Filesize
25.3MB

MD5
980ba0b0f4968ba425f67416e80f01cd

SHA1
96bfc681333e01480647872cffa3351fe295d008

SHA256
e518d8d7d5ec08d2f30914517bafe2f19f04bf7ddae56c8eb1705a8b13c48232

SHA512
e1a074e88044a423ffef93d85a9030fc0caf9a9373704a37477005d2d0bb872274d7f2927abc69f23888496c619ae6cbcdb04c9e995197fee461d1fe4fa72e72

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 839694.crdownload

Filesize
11.7MB

MD5
d96cf505b904c903f942b010eb6e0fe6

SHA1
002b948b977672ff18dc89278fea1b2e5f825ad0

SHA256
c64afd0f052a07c68b12acc344af3377a1c2935a38ce881e658e0e435a196959

SHA512
078266d14b4aa93fa6ca7832b07a4cc9f9a6339c4b34f62672f1e7760e646e19dfac0e2eeecf9d43e06bbdfbabbd5a21e547c4436c3671e053a767010e825c2d

Download Submit
C:\Users\Public\Documents\Baidu\Common\I18N\conf.db

Filesize
403B

MD5
99f11d417efefac677b7d30a809059d4

SHA1
00913146a353f02dbfddab6fd14911bd0524b468

SHA256
e8921828ef1008362c4b37544d1c00d1ae3fa142377a79d5076eb38f0ae4ea7f

SHA512
4b0894aaa581790fbc43e0ae4867f900a02786ad9623e8cd125f78f56f6295d8f7e15cba7c7be8306fd18100a35caffe0a7e9107b603092aed68fe6f09d83cbc

Download Submit
memory/408-3209-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/408-4102-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/408-3427-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/1600-4238-0x00000000039A0000-0x00000000039AE000-memory.dmp

Filesize
56KB

Download
memory/1600-4233-0x0000000003980000-0x000000000398E000-memory.dmp

Filesize
56KB

Download
memory/2124-4103-0x0000000000400000-0x00000000004A1000-memory.dmp

Filesize
644KB

Download
memory/4668-4066-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4074-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4067-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4078-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4068-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4072-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4073-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4077-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4076-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/4668-4075-0x000001C6D2C80000-0x000001C6D2C81000-memory.dmp

Filesize
4KB

Download
memory/5748-3357-0x0000000005BB0000-0x0000000005BBE000-memory.dmp

Filesize
56KB

Download
memory/5748-3365-0x0000000005BD0000-0x0000000005BDE000-memory.dmp

Filesize
56KB

Download
memory/5748-3428-0x0000000000400000-0x00000000005ED000-memory.dmp

Filesize
1.9MB

Download
memory/5748-3429-0x0000000005BD0000-0x0000000005BDE000-memory.dmp

Filesize
56KB

Download
memory/6384-4298-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download