banload | hxxp://google[.]com

Analysis

max time kernel
560s
max time network
555s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02-01-2025 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://google.com

Score

10^/10

banload discovery downloader dropper evasion motw phishing trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	RPGMV.exe

A potential corporate email address has been identified in the URL: currency-file@1
phishing

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RPGMV.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	RPGMV.exe

Executes dropped EXE 3 IoCs

pid	Process
5352	Setup.exe
2816	Setup.tmp
972	RPGMV.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc
305	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-UQCGR.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Female\is-35B5F.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\img\animations\is-HB96S.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-LR6SG.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-QGV8S.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\img\battlebacks2\is-7TRR8.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win-test\is-1E880.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Female\is-E0NBA.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Male\is-QTCOB.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Help\page\is-58G56.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\is-KD90J.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-ISA3J.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Male\is-HT26F.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Female\is-QQE38.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Male\is-39E76.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\audio\se\is-TDLPL.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win\locales\is-50J6E.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\tutorial-win\is-KQ7TS.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-B7T20.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Female\is-2P4L5.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Male\is-JKT4N.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\img\sv_actors\is-8UO8A.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData_FantasyJP\data\is-I46SL.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\img\tilesets\is-HAS85.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-lnx\locales\is-7SA35.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-4BCCO.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Male\is-4H6AK.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Female\is-2RHNJ.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Variation\Male\is-A20I1.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\img\sv_enemies\is-3NU26.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-3698S.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-QPD84.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Male\is-687MO.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Female\is-A1GR3.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\img\battlebacks1\is-C5CC4.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\audio\se\is-FOJI5.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\audio\se\is-BUS9T.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-lnx\icon\is-AH2JA.tmp	Setup.tmp
File opened for modification	C:\Program Files (x86)\KADOKAWA\RPGMV\tutorial-win\icudt53.dll	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Male\is-IJ6JU.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Female\is-HEMG3.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Male\is-S3HH2.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Variation\Male\is-RKJ10.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-M0BFL.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-VEC22.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Male\is-REK6G.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Female\is-0KFAD.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\imageformats\is-LNV7A.tmp	Setup.tmp
File opened for modification	C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win\Game.exe	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-KDVRQ.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-LAFVH.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Female\is-HQ424.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\img\animations\is-NFBOT.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\NewData\audio\se\is-RRA4Q.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win-test\locales\is-49LFR.tmp	Setup.tmp
File opened for modification	C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win-test\nw.dll	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-ORM37.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Female\is-J7NRU.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Female\is-QR7UJ.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Variation\Male\is-01J0N.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-7LAHH.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Female\is-A33CC.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Male\is-JKEJJ.tmp	Setup.tmp
File created	C:\Program Files (x86)\KADOKAWA\RPGMV\Help\inc\img\is-MV494.tmp	Setup.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RPGMV.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	RPGMV.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	RPGMV.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Main	RPGMV.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	RPGMV.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGMV.Project\shell\open\command	Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGMV.Project\shell\open	Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.rpgproject\ = "RPGMV.Project"	Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39242051-2E69-6F90-243A-FFFEDE0EF7F5}	RPGMV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGMV.Project\DefaultIcon	Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGMV.Project\shell	Setup.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rpgproject	Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39242051-2E69-6F90-243A-FFFEDE0EF7F5}\InProcServer32\ThreadingModel = "Both"	RPGMV.exe
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGMV.Project	Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGMV.Project\shell\open\command\ = "\"C:\\Program Files (x86)\\KADOKAWA\\RPGMV\\RPGMV.exe\" \"%1\""	Setup.tmp
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGMV.Project\DefaultIcon\ = "\"C:\\Program Files (x86)\\KADOKAWA\\RPGMV\\RPGMV.exe\",1"	Setup.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39242051-2E69-6F90-243A-FFFEDE0EF7F5}\ = "Voice Activation Manager 2 Class"	RPGMV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39242051-2E69-6F90-243A-FFFEDE0EF7F5}\InProcServer32	RPGMV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{39242051-2E69-6F90-243A-FFFEDE0EF7F5}\InProcServer32\ = "%SystemRoot%\\SysWow64\\VoiceActivationManager.dll"	RPGMV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RPGMV.Project\ = "RPGMV Project"	Setup.tmp

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\RPGMV_161W_Setup.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
916	msedge.exe
916	msedge.exe
5820	msedge.exe
5820	msedge.exe
4104	msedge.exe
4104	msedge.exe
6020	identity_helper.exe
6020	identity_helper.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
2028	msedge.exe
1744	msedge.exe
1744	msedge.exe
2816	Setup.tmp
2816	Setup.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeDebugPrivilege	2848	firefox.exe
Token: SeRestorePrivilege	2792	7zG.exe
Token: 35	2792	7zG.exe
Token: SeSecurityPrivilege	2792	7zG.exe
Token: SeSecurityPrivilege	2792	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
2848	firefox.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe

Suspicious use of SendNotifyMessage 14 IoCs

pid	Process
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2848	firefox.exe
972	RPGMV.exe
972	RPGMV.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 5244 wrote to memory of 2848	5244	firefox.exe	78
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 3908	2848	firefox.exe	79
PID 2848 wrote to memory of 5532	2848	firefox.exe	80
PID 2848 wrote to memory of 5532	2848	firefox.exe	80
PID 2848 wrote to memory of 5532	2848	firefox.exe	80
PID 2848 wrote to memory of 5532	2848	firefox.exe	80
PID 2848 wrote to memory of 5532	2848	firefox.exe	80
PID 2848 wrote to memory of 5532	2848	firefox.exe	80
PID 2848 wrote to memory of 5532	2848	firefox.exe	80
PID 2848 wrote to memory of 5532	2848	firefox.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://google.com"
1⤵
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://google.com
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1896 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1920 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {901dba3d-fef7-4d89-a5f4-fc2f1ce45317} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" gpu
    3⤵
    PID:3908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2272 -parentBuildID 20240401114208 -prefsHandle 2280 -prefMapHandle 2284 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e632fe96-6138-454e-9191-5459c94da63c} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" socket
    3⤵
    - Checks processor information in registry
    PID:5532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2972 -childID 1 -isForBrowser -prefsHandle 2964 -prefMapHandle 2960 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {444df3ae-2c04-4ea4-9c2a-61da988a6df9} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" tab
    3⤵
    PID:4756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3636 -childID 2 -isForBrowser -prefsHandle 3676 -prefMapHandle 3672 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97ef1a14-3165-4628-bd31-3b08da3bd2c7} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" tab
    3⤵
    PID:4924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4512 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4520 -prefMapHandle 4516 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c84de94-7618-40bf-8c4c-313b9baee31c} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" utility
    3⤵
    - Checks processor information in registry
    PID:3392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5452 -childID 3 -isForBrowser -prefsHandle 5464 -prefMapHandle 4444 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9190c618-5f2e-4a0a-9018-6185402d733e} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" tab
    3⤵
    PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 4 -isForBrowser -prefsHandle 5672 -prefMapHandle 5668 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4607aa32-4307-4bda-967a-8283d3a87f76} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" tab
    3⤵
    PID:3276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5812 -childID 5 -isForBrowser -prefsHandle 5576 -prefMapHandle 5824 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ffb1106e-278a-4443-a279-76f714cc74b2} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" tab
    3⤵
    PID:4056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6296 -childID 6 -isForBrowser -prefsHandle 6212 -prefMapHandle 6216 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1276 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7ec465c-43ab-4735-867c-ec8c6b84e318} 2848 "\\.\pipe\gecko-crash-server-pipe.2848" tab
    3⤵
    PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7fff63633cb8,0x7fff63633cc8,0x7fff63633cd8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7692 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2164 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7488 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7748 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7764 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:1
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8048 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8268 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8076 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8444 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8288 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8516 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6292 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8768 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8680 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8668 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8364 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2000,12791931945589033687,9287193221229938304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8896 /prefetch:1
  2⤵
  PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C0
1⤵
PID:2648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5376

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4056

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\RPGMV_161W_Setup\" -ad -an -ai#7zMap8603:94:7zEvent3103
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Users\Admin\Downloads\RPGMV_161W_Setup\RPGMV_161W_Setup\Setup.exe
"C:\Users\Admin\Downloads\RPGMV_161W_Setup\RPGMV_161W_Setup\Setup.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5352
- C:\Users\Admin\AppData\Local\Temp\is-FSHKP.tmp\Setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-FSHKP.tmp\Setup.tmp" /SL5="$A025C,121344,0,C:\Users\Admin\Downloads\RPGMV_161W_Setup\RPGMV_161W_Setup\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

C:\Program Files (x86)\KADOKAWA\RPGMV\RPGMV.exe
"C:\Program Files (x86)\KADOKAWA\RPGMV\RPGMV.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-LR6SG.tmp

Filesize
4KB

MD5
44d896525ed9c6dd8a29d957eddfe2d4

SHA1
660ce301022063b1f6c67afe3a77454a21fb4d0a

SHA256
945be27b051687659ab9c5bea83fb05629cd1464f2931d8ae549f6b4fa14a1a1

SHA512
a8710459d5afe9c3d1965e62a698b64b0edd7375a707bd364fa11ce017b7b2ee3253f03954256f3a93b1d829f3204ad4b3780973dcb17112f8f90c5fd8447b2f

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-MK9U0.tmp

Filesize
3KB

MD5
0a26c92d8b68dff85d84454b8215220c

SHA1
6f44f911c6cb063c45cc42b9159d9b9907fcc320

SHA256
0e31d91180eae4e2ffaabbd8df59b1a143f24a4d8b8d8e8e86bc82da3fe48719

SHA512
d1a5d9a5f0877c122ddb162ecefa46984a7dce36a418c9d9f7337103ba22274a2638850f98d78b4dcdce397fb57c323b9f0bdfa51e9dc13c54c8677ccc3d5671

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Female\is-OJS1L.tmp

Filesize
329B

MD5
840a611977fcc36fb7c6952227ad323a

SHA1
c8ace750c447dcc29e5a9c160b0dd556d2955f6a

SHA256
cfe26c28b2718946abeafebdaaf343c93509c3c9594f6f1e19cde6a405ce73d9

SHA512
0fb6ac365c2cc8d6f16a8bd492bd5b8254db5e2c924a5bc1ba6de7dc92b0245c352070fc108b44e9a649222e72dac7d508b2c77b45baaff40420e06e4e5a07bb

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-01L3C.tmp

Filesize
6KB

MD5
5f166b84f4a114b0da783c4c45577ccb

SHA1
3b86425509032768feb69e8ac201d1390b296622

SHA256
4a38f8d877e717aeb83d7113afc927117ed6ee0a851d5c765bc1fe176a79447f

SHA512
cb53be6c920b7ec3101945b80cb17bd7e8759bc9ec4fc1a687a13daf2f50b0fb99f850ec813b782b2235fd51360ae2cca558cdb65f48cf7a9ec729525f2ed0e2

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-6EQAO.tmp

Filesize
3KB

MD5
b2892068998fdda9fdcc64f67d1c8b41

SHA1
cc46436e7c0a7063faf7f843d2930154a27cf9bb

SHA256
4251c8aec438d4ffece730fd9c31d157f8bcddee7c96d0058f671f570e8e2f61

SHA512
7b78b9ec471329d1f1470a756dfc9ef75956f20faaa56cd8f6bafb2ca1a3a592f6935774efa1a20a92e32aeeec06fb08f18d9a3f1a1c3cbdae30203c3c2ecfe6

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-7NCR6.tmp

Filesize
3KB

MD5
75703d08a168eda6c4cabc8b59bcd1d7

SHA1
239f6294f22fcf75aa85802ed761b1456ed4d377

SHA256
fae91b58f318f25da1d1ef8fb9da0e4489efd91b79fb24b873889aa9f458c8bc

SHA512
624537baa72890b82ff6d23da064f5589ff10fc277638f149d4341783c7ce0be42a219caf6afa3b0424acf5a8874ea7b9f4aac02e095d6a2a55d859232832485

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\Face\Male\is-BJH6U.tmp

Filesize
6KB

MD5
5f6aceeb541550e0744760ee24c9ea09

SHA1
36fca3627aac6ad3fc1412cbb783a6d09bc8d01f

SHA256
6c18d713646a32a732eefdf56f6b597b8c5eede203cf4f3ddb86ab7b283358f8

SHA512
1328c2577c4817d0b2854253b909d18f7fd4b0cb840483f9b60b3b63446d3039974b98fbb6547ad83ce0c604797c7d9902651736977abe3de105cc1411808cf7

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Male\is-KAIL0.tmp

Filesize
1KB

MD5
d3646cff6fcdcf24ef84b3af745b3a68

SHA1
1e0bbaaad969fb201414147e0b46626913a4aa5a

SHA256
9b09bd1296767deb0ce32d9999283300a8a28de45eaffb91859bd738effa09a3

SHA512
339f0304b616ffb7069f67b313d44eaaf981209b6f7ec36ceef0ae22a09c08a60f16cddf875a8c34f7334ab4513f5937a41dab78fe4f4913bc2a9376beb888b1

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\SV\Male\is-OGAFP.tmp

Filesize
5KB

MD5
0acc5d5942903d743ee8948b897c60e8

SHA1
2e4a93aedba2dd8223033f5c5f1de51f90be513f

SHA256
29f798b89dc22919c8238d7562399932938fbad6f2c1b2af4cac306210dc534a

SHA512
21c915d7d353ffb85fd61a1f4a12fd996f2ca1751774a79b14f4c2ba47b0474799b00d04cccd4df22f635edaa47ffabf4a7bf60cd52f398ef932a5b7d5c49309

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Male\is-4C2AQ.tmp

Filesize
218B

MD5
8a504626641312a6b247c0f738568b8a

SHA1
457082a7f9b1bc88205e8bd9bd45f96e58c9b3ed

SHA256
3ff91c0c46918b8b352089adcf07913e98349e600247876b4c38a75c4d83f345

SHA512
cafa6986311ccf0900721bf1bfe7dcfe46b8ef6b026a236256f3440e8617a5af50bea89b24be20dd6fba74e859b6799abeeb2615203755a9169aa7b2cc38e9f2

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Male\is-DHEOL.tmp

Filesize
315B

MD5
4b3764ab3d7c42a6f99d5e38636a8f6b

SHA1
aa5a3d8f2d9a1cd0706a0a08a1eed2bd39578f5d

SHA256
15d0451039db20ca58797fb0f0654ef004b8bdbd711117e7fe131f206be16321

SHA512
8ffc6e239b23b274559011243870fec5564e3104a23bc3a31cf1943308f64c3dd4b4ca66ed5d801599c9f7dc07fa426745ee90075493efde087311b7ba5ffd67

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TVD\Male\is-OROUG.tmp

Filesize
646B

MD5
c956277a0959e79f5990f674c840af42

SHA1
506f6a0a1d3cef7ddaf369c50e6facf27a4341d4

SHA256
3e562d841fe99b502c63c827cf0f45354f40407ed0165ebfea0ec45114c42553

SHA512
52b7d4983f6288a0c646dda95424cd594fd880af6706991058f1d8fbc850155fdf18bd22541384f90272076af95a5f1e6354f14c253ba7ecd057a1dfd373baef

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Female\is-01IKP.tmp

Filesize
411B

MD5
c02e7cf68203269c6a1c626c097bfe42

SHA1
b88afdfa7fa6cda61a16bbb1b4b5ce58da6a9e6c

SHA256
902dca8e5b44e4903c27aeec5795db287c94b4ca1d6acccb925117f0e7f6e710

SHA512
530bb3bb1e09881946ef8e094d77af52ce30ab597fbecb4f4b1d8c69b84d84a4052e6d663502d8c708bb1502fd8ce0e43b9e492bb2e4d1f0fc4045f67a534b0e

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Female\is-R59JP.tmp

Filesize
349B

MD5
b0e5f219a6a40c71badf773655301eb0

SHA1
707169777e838d06dd11702c8c6330dea0a1514d

SHA256
78371ccbe98b7a4a9fbf92c28d41d3aa5b90ff60d76b3baa02dc1f548418621f

SHA512
a831600ad9be3c7a91aebc624695edc758686a18d296c8043dfa1b4b68b1b0c325c5cc6bc00f97b13610d7ea3970a38763e8f5f4e86d50a60e8d2648cdc319ae

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Male\is-GHITI.tmp

Filesize
963B

MD5
f8de3d3a58676e88baeb6aa4ed4de34d

SHA1
1a98f8d26ab950208cbbc18ceffe2b7444971675

SHA256
27e4f40b13e6cf16821ccc3e694a4e5dc9974a7b1c431d6de7f379b632c30d19

SHA512
79721f03e84f2d2aba7a4359e48bdfb7146b48020cff52475d65f63a202531c0ea83e6429bede84e4d10a1df2323f3e34e1c99e50924bf7f375243e00b6f4780

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Male\is-HIUDS.tmp

Filesize
540B

MD5
bb3946ce28fc65ce76b57ec8644eecd1

SHA1
52cc2bdfa3d48aacdc04f99379245b61761c64d8

SHA256
27eaa5c3827c0dac1b7c7f4994a2e3fa4e317d89996c4cf4acf13ca02a0241c2

SHA512
3d7272c6b7795e8569cf8aba27ccef157f3f4c2f418c928b6166da6fbfade61345fcc7e848e6b469dfae949306e7c7536fe4c37f70c78ea49ab9c2bfaa8b01d0

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\Generator\TV\Male\is-NR9IR.tmp

Filesize
646B

MD5
0cbcbb7bc7167938c227ff475a679f41

SHA1
712f0a37d49aa909df7cc86c64418e62db63b606

SHA256
e053933c982930576be05bf9e3bc1de68ea9f726b1f51a73c3723fca3823dd48

SHA512
c56abe74d1146637214dbf4cf5afd97881c70bc502dcd1496cff115c23e6fc97c35bb07615a1d77fbb868e0c693ecce941432dc18dcdeb4351f715eaa953c694

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\RPGMV.exe

Filesize
15.5MB

MD5
8184f0feb350c7cf0e5fb2868154f91f

SHA1
8c090398fd84e28d6a67f173c8ada0f3665c9df5

SHA256
148a53375a19490e67b2a8a0a5bc4f5968d7359fedaff696fe7e206e5476c6e0

SHA512
75b71fe61dedbd86d084fea179299b4f510b1dce608bb35f271812f0a688c4d8270e6573145ba5623a9676c941e596d7fb3714e55c00091e755669be5a97aedf

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-lnx\locales\is-II438.tmp

Filesize
392KB

MD5
625890607a9dad58344efa7d7c002944

SHA1
4b5988298b792bb529550a9c83b56f0de4aa4045

SHA256
dae1c0e03127e28f18fc77a7bb6dd52e37fdbe2de8b7f850ec8efb664fb4a63a

SHA512
43b4ff78275d6faccebf92f2d8f52058fe8125272c1f7266997db4448c0ed720b354791b23b086ad2b422844e374ee020a8010cdc1b533cd10503b46f4d95144

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win-test\is-82P1K.tmp

Filesize
9.7MB

MD5
09e3ed722129a9ae82d4a8e0d4415858

SHA1
214cc31d4d66555ea8be4cbfda6c6a59f91f4480

SHA256
83b3d8cecab6eea5b73263af8a4d475231f6fe4145644aa230a223e89378ab88

SHA512
1c351847f7bbbf96304472f9e54650009aaa12fa832873a6956291536e2c1b72586970529c0c77b67ff1a142270ae6e7237aa1bf10f3df865a6cd7aec56747f2

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win-test\is-J1K90.tmp

Filesize
200KB

MD5
51014ed501fde761ddb4b763df687c13

SHA1
e16b402e418e948065834237defc65a788d46670

SHA256
47a86495fbc403ade14d7e451c33edb1baa810402d8d192446a7767bc563dd47

SHA512
340119877ea1befe53410afdaf9b500a674d836564d7ed5e14ea7c08596c7cdef72fdf94dad7aa87dedc0a33ca17e468f350ac5d41be408cc85303e74282d713

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win\locales\is-0T9RH.tmp

Filesize
399KB

MD5
05256d40928c25dbdaadeb6b5eb44e61

SHA1
fad224f545e6adbdd5f9b80e8b4c0a5c4510837e

SHA256
bf21e2115acd7bdbb21f5af28f4ba838c6b6780851561464069863b114479df5

SHA512
06bfeecea6b7d5f01c4b00460f73deed4fe7ecf3745b64824ea9598151cf654b2a3b75dbc4d5b0269813bbd89db7f271a7f6caa24930d88c13ffd04454c5004e

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\nwjs-win\www\icon\is-IMLTB.tmp

Filesize
71KB

MD5
bfa11dc4c70dc92d9a571f98571163dc

SHA1
8a46690856e1759be99c50c8da6a4240a121af31

SHA256
e1875cdc887df7d42c111fc0f013eeb9e986707a86b84114c5ac2cd6b40d6e72

SHA512
92f570c856b4d7be997d8ecba38c2f5c9b4ad23ba4e795f56e3f0f21eb485d836dcf0aade37dcae0ca13045980a64163b78acbadf4f46133e436c965aa2e6c76

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\tutorial-osx\TutorialGui.app\Contents\Frameworks\QtNetwork.framework\Versions\is-LHJSI.tmp

Filesize
1B

MD5
e4da3b7fbbce2345d7772b0674a318d5

SHA1
ac3478d69a3c81fa62e60f5c3696165a4e5e6ac4

SHA256
ef2d127de37b942baad06145e54b0c619a1f22327b2ebbcfbec78f5564afe39d

SHA512
06df05371981a237d0ed11472fae7c94c9ac0eff1d05413516710d17b10a4fb6f4517bda4a695f02d0a73dd4db543b4653df28f5d09dab86f92ffb9b86d01e25

Download Submit
C:\Program Files (x86)\KADOKAWA\RPGMV\tutorial-osx\TutorialGui.app\Contents\Frameworks\QtNetwork.framework\is-O1QFQ.tmp

Filesize
26B

MD5
e58c4cf10cc7c8ef7d7167ccb641aeb4

SHA1
ecba07c7624bc6dbc1cd12ae356d36c8a7bb4ae7

SHA256
59991b51b8ee15b59f07ec45942957a4ce90494257766964f5df60b7c7998e42

SHA512
f7e327e2a84d0922d00babbf51d4e32bf4200f1fecbfd096aa2334ed7f7236d112e88291eaed24306a67e278a7cd1e977bb62974dac9484e9ccbdef1e557b9a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c03d23a8155753f5a936bd7195e475bc

SHA1
cdf47f410a3ec000e84be83a3216b54331679d63

SHA256
6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

SHA512
6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d68c7edc2a288ee58e6629398bb9f7c

SHA1
6c1909dea9321c55cae38b8f16bd9d67822e2e51

SHA256
dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

SHA512
0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
47KB

MD5
0d89f546ebdd5c3eaa275ff1f898174a

SHA1
339ab928a1a5699b3b0c74087baa3ea08ecd59f5

SHA256
939eb90252495d3af66d9ec34c799a5f1b0fc10422a150cf57fc0cd302865a3e

SHA512
26edc1659325b1c5cf6e3f3cd9a38cd696f67c4a7c2d91a5839e8dcbb64c4f8e9ce3222e0f69d860d088c4be01b69da676bdc4517de141f8b551774909c30690

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
69df804d05f8b29a88278b7d582dd279

SHA1
d9560905612cf656d5dd0e741172fb4cd9c60688

SHA256
b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

SHA512
0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
26KB

MD5
5dea626a3a08cc0f2676427e427eb467

SHA1
ad21ac31d0bbdee76eb909484277421630ea2dbd

SHA256
b19581c0e86b74b904a2b3a418040957a12e9b5ae6a8de07787d8bb0e4324ed6

SHA512
118016178abe2c714636232edc1e289a37442cc12914b5e067396803aa321ceaec3bcfd4684def47a95274bb0efd72ca6b2d7bc27bb93467984b84bc57931fcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
34KB

MD5
6242c13ec6b35fed918ab71eb096d097

SHA1
691e6865e78afb11d9070056ba6cd99bdad7b04e

SHA256
b1c7566622f40bad557a6c5b7bc5b8ae25b4da191ac716cc7923282eef96034c

SHA512
52914b4ca7362e9ebe326ea89006f5cc096fd4d1c360cae33ca768af92fe6fdb5078d0848fb6dc092848ba0e3d3f51bfb20a292250c35e8bd2e79fd5a19dd7b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000048

Filesize
20KB

MD5
93be7955935adeb48b77528f2dc2e9ea

SHA1
58cbdc14353bbdc7e8457c4c6a305907eabb008c

SHA256
e334891b33bc300d351d94b78cafae565a30e80c5e52a4ddaa158a8dae64511f

SHA512
cc6f0ae67fe3a11c0dfcacaac2d3c8c00a51caa81994b9fb20c1f855a053cfbe17c0374711990ddfed39a38a138357e55a8d5294a920c2ef80790845520b43b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006b

Filesize
153KB

MD5
1b2731006f2b2597b02859e501bc2d4c

SHA1
118d27a703cef3fb083593a56bbc93e62420f30a

SHA256
59dc184cbc1a318493460d1d78999cfdaaaac9a457b5a3a02c2567dfa17314bd

SHA512
f7452f91afe2fbfcb04f80dc7b051d874224de8790bbc53858678332a6b49f7295a15989a587811e1e8fb58a38625ec3e15657d88a367fd50d5b201d7abbe90c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00006e

Filesize
30KB

MD5
903bc7a7e510f87aa5d0201eb59a0832

SHA1
ac9aa4dd94cde1bcba9037e94087138b127e41fc

SHA256
41a7ac8150cc9f38421451d5143c1ffec7a1f1fafbf7a7fc0f51b98ad699cf8f

SHA512
ec9e70bdade612c577243de12452b2bec6ec90390d9e05b0c949a5a30110f51765839bc6ab22edc121d9c73cf73af102890e601a961d489071f2d05ef0fd2c12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000071

Filesize
84KB

MD5
c477de9f0d9de5ee2328f501d5b07a9c

SHA1
b96cfd2eb95b28e0988257d20bab5e6b7382842a

SHA256
8b84acf1710b6e96227e18960adef2d034936f08fa1a2daa36ca25356d49c03b

SHA512
55bedb7e7d06f8fae7f2238658b41c04e34dba3fffcff8e6242dbe5f41156454489c3e9f48059b919181d4585546c6c4ae1d95903182fac6c432e99ed6917069

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000074

Filesize
28KB

MD5
a762fb5a64dec4556d980f51ff3060c9

SHA1
6ac0b291cbbd8819e9a922c9c5228f76ad029983

SHA256
cfbdf62609fb4493b45b6b7a9a13c5357ab5e7447c606d9fd707dbca46359a54

SHA512
23169bb323a788ccdb915dac2a8d8c58b018c40941f2c7b10a3814a68b42ad3694d07d23e2eef31d77a7c16da355c98d796b94f82b8f352aa4825ec0c3e08b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000077

Filesize
20KB

MD5
a4f3afc86190a2d47f56664367af370e

SHA1
57613bcb2a288ef2508e847e7ba35d52f2e87de5

SHA256
52fd14eb766bc6676dd81e3bb50a4dad1891bb9a47e38c3ec620aa6c2b487c42

SHA512
bae75c59141ee60ef1fc2c745117fafea3d386b64f2f67c1022909f295228578bfc5e5e49de5a2f2efd57e75affc0a7d09fbee8fa50aadd82aff446773fc690e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007b

Filesize
62KB

MD5
35fe37e08d59a3191e5937bbf348e528

SHA1
64555d7ba585935ad7031b1dcd85e32d665c5e19

SHA256
e0050b274222e7bbe0d963be219a27e4a47fddcf1a72da32f744a04eccf91615

SHA512
ef3b2acc746dc86ce4e9d075c133e0b65277c14c6347526e25ad5ede7a0f9403478a5fc6a2a19babea02012b5770de1b7484e68c1dec64502d362f8197289f93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00007d

Filesize
31KB

MD5
00bd4556d9672009a7cce0eb5605fd1d

SHA1
e6aa062aa34cd745dbaa2b0fb851511a5ea734dc

SHA256
11e4340eefdc92053fa38149176a0c17f55472b8fd3897426a76050aedcb8621

SHA512
34f87481e0cfbab27750b392d885092bcd6e11796745b5ef7f39e9564b8d29d169cf8d72795e45745c366c18057d02120726951d2729c699bc60e6518499536e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0720badf6795a0b6_0

Filesize
3KB

MD5
61f970cee3569415ba80bc63e4ce48d6

SHA1
fb7e09bf7e74bb76c7ef11b6a4151173dd2db2d7

SHA256
ff4e5a73e6befc70dccf02722136a237ef903d6f57d39d4878471d8a874fed4d

SHA512
c451f1dd4cc5b8a626e7e11cf31f744e20ff914e7ea9a6e77cd34c4fed431efaaa66d748cae75807c4352156a8dc919b307178cb3c9ba8af0f14f1ce8c4ddba3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\20373895ab728cfb_0

Filesize
10KB

MD5
435b387bd3949b7b613477680013ee4e

SHA1
7219388290c525ce28684f1bd8fba8bef42d6bb0

SHA256
8b906061a60a9830c36db3432ad6fddb5b804d8b8dfbddfd3ee20febeefa3973

SHA512
209c05ce49c9e7f732fd91c91a7980c91235d6fb660f871b2504ee1d00dc4e3fc3ed2558520b2946336737f4d7432653500d95f3869914e77080124bc6be879c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\237a5b4ff8c7ae52_0

Filesize
268B

MD5
d1a34ed283ab24280f3a3116e654d9f4

SHA1
c591d843ba8cee1299da2be7cdf510449689c04d

SHA256
11c47b8389ee50668505da422620aae8261d8831c89a221ccb4312ad96acb1b8

SHA512
d7847c6c38fa358c6a156cf36b2dfd34a0449ba07f7174df0d29e34002af50ccb2ace052fa0a21b5d2404fa71862eaa22b8ac447cfa516a99a92d404eb86510d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\242d87fe25e8b258_0

Filesize
2KB

MD5
eb4812e3bc4c01394e481d00762e5a24

SHA1
5f9a5f87308e6b112eafe0724f5d6a818b7722ee

SHA256
75158f7e410e349f438a55c74abba2423a545f9ee134d7461f63dd3dd8329ac6

SHA512
59fe8c80b775a766cdbb37d7047dbb4ab4b8de394ca24216f456bd94cafc52c5ff6a5345eee43d94b02c84d99284ff9e6a6c54bedbd76c0ca56b97f61143437e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2b7a971ecbdc0832_0

Filesize
143KB

MD5
0f5f5d7df5f2e767a10ac703c18698b0

SHA1
148e2a364fbe8ad37bb615e2fc84bda20d3ee483

SHA256
3ee7a6587e1199af78c03da2edfc7c2533c517d5c0bc9ca4980926daa553c49b

SHA512
1fd3bdaa11a07f782b8e867fe21034c6aa5d70520bf345e740e73472d4c0bc0c89c42084da1bc42671b65102fe4e5750dc1c67156fe2e58844443ec2bc2d2d97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\494e94b1ce0beb13_0

Filesize
278B

MD5
13788e74e5cee404164c1dd0e84ad2b6

SHA1
f91ddeb49a4bf45199ac876ebf668658dcc10cc0

SHA256
ad014050386443f063635bbf9a759f924d05e10be9e8aabc3d400aae7a205016

SHA512
fc4dedbcdcb9582ddee522b110f608a2a6e07661b5f4861014f568c06fd2896cd55f425ce0326dc7003a46f22ed6b81ccd81453475856dc393522683796690a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
f2b317eb3aeaac7aeef2c95dd2ecb3ed

SHA1
b9c41288799ade825907a97597ee2c5eeb66d8c4

SHA256
fe4c1aca5b955f3b2c9f05a32abef8072d2b707a68d27619d46ecf6b283da346

SHA512
62051760947a30689a0baad2e4c44b388307705f8f2bd9c780fcc6f99d4f5c03cb2eac9877ac0ccb62e8d0ec3d996794a3738bda11f526a73edd0e1cfaee1c22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\63b6a3fe95b08ea7_0

Filesize
55KB

MD5
3c722724b87b5cfae24ff96ae2dbd94a

SHA1
49a2a23a512d17c8b9d1c24361221369317a46b0

SHA256
9939efededfe52e5e9ff8307869ce3ffa50cab8e64621fcd03899baa357efc00

SHA512
544f18acf1bcb4d66ff22bf0b0b1126b1ae3f0895f66edd191807a483dec5893be3ccc9d863ef38cd3eedf5c26120ffce6d374fccb927e0f4e9ded53a63f576c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0

Filesize
2KB

MD5
5eb4339bb6fb6fe92e3c706153fb12cc

SHA1
d7fc0949ab5a3fe301bea235c5f07a0c7e38e6a9

SHA256
a7e2116db1e702905b3d2de0e92f9dff72311f9366d1b314e68fb1d5ad733b18

SHA512
17943714dd874876222da7b9cab35dbe5904a9a32600890fe279218a28eafe6046bc011355aa6a0007f673f983c02d6d20c5049140dc790b7b6143cf2d7d9271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6b1c3d6d62495ca9_0

Filesize
3KB

MD5
4021c6df03dc93ccf5df75659f347e94

SHA1
08c2e566f08f933d1f6b2b58c0b479e2faa18056

SHA256
f7a30923be959a157831795798adc78c3735df4de77283934e6b693be168c925

SHA512
1b3cffff3565cf84e9bbfba496c7cfb458c01092e8cdd0231cfaf68d12139705221fb167aeba018dd0d11b192f4573518a27a6a495494325bd70f2ab07c9cd9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\78bc646c0524ce58_0

Filesize
2KB

MD5
023cd3296dd0b4813496b000e8160b48

SHA1
4ef087f5fad879ad9af354fa57d1128dab6c1197

SHA256
80e784d54f50ef92a91a45428a1cf9068ba44b233d54e25fac89371fcaede8f9

SHA512
fa8c91b684d7b25eb7d33759cb33dcfbf7fb745586727b0aa35cb20e546bfe59689391859ee98c6510b5feba2ffac68b02153533a2e2c81c61428f875da771ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8551150be49776f3_0

Filesize
3KB

MD5
c44614a97d9d2fe44d4e0bc55a3f57bc

SHA1
83f56443fdf965dc57dfd10f9c8509722549c7dc

SHA256
8156086e307ebe695c730f4e2e0650e92bd1753a2f8ecb5f0c9edd7a45bae2d4

SHA512
fc71ad0fd699f2497d5e5fa1699ac5e422b246d761aadbef9f1b56efe4010a906ee6142086c6d5f9185b6dfcb59bb80bab58454f9db118880a549b55c9b6f0cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9e262a509ed63e72_0

Filesize
334KB

MD5
c4cb51d90def097989c636534399bfd0

SHA1
d0b0694b7c140e600b2e4279e47c50611e88e7a8

SHA256
766d03a4710badba36b68f12f454bf1ff617eae255a2338b3f497823aa548f23

SHA512
bb2e417959cc454fb85848a16c62c27eb1f17be6be3cefc5ed04833e5a79c72e56d6a55f1d83a648d789eaeed0f997c54472ef01045630e7228f8b582f1cab00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\bf3fee3989523ff9_0

Filesize
22KB

MD5
a9fb0d074db6f8db68bfddf1c423da70

SHA1
e625012309d48cff37a45751762ac2478f03b972

SHA256
084ad91f6e2b7ae45c7544f9e0684ea6716cda23f5a23d7efb0669c5ecedd885

SHA512
4479094b34ced4c0329d53f277fbda8d7d8d78db5e6273de0b41a69c11f346206a3edfb455d901f0f4429f062d0dee2d73f813a6ea4a8c634261439f8fad978d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
cee64d62916fd67d7045d2920eb41ad6

SHA1
69ed29cfaa2e45c74ddffab5893ac0df6658184f

SHA256
c28a9a92b86228dd82c4f0c2098c9ddf9d8c98a678f72f6fae7b6a3beddeb4cb

SHA512
dc50c60953294e357862e2a1bcab5d0cf48c3502a64cf07c075938947e7a69eb2c9fb4dc39eb56b4e6ca2fa98a00a2b65970a06a4754bff884e06fc8c580e7f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
7bed2b2c45ee45e26e3a76560534331f

SHA1
5ef44f3fc6f2847e728e25b8ea485733e609ab38

SHA256
ac982e04a01398cae9607c1fae7de68a1681a05d9ef68e3ca54bd0c19e3f845c

SHA512
0a4ec0309eaead71b7467aeae152bb37a0273bdc648bd9a89855a4d6321035fd575bff65e073e906eecf6283d16e163a3b8d16c03fd4c4b9180f2199bb2da14b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
de07fb716d70d1993de91149b2dfbda9

SHA1
e5700d5163a0cfb795e0cbff97e4e302ab17e762

SHA256
70b6333ae3c439d66413fac3a3ec226a6cdea4d93bb4f7387bf3f559478cd188

SHA512
e402112820a3d36f1c34f6e085075541836e5817af6041be9f78e72ed1c5719eecb4c608038bbe1e9b592b8403d8203e8f655c91440588dcb3588d09855ce425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
5KB

MD5
93176324c794553e348e7206cf315ecf

SHA1
54ca030d72720386c89b4ab2cc2b5abe320d90bf

SHA256
b2e0a91f51a1b8d0cc3061d400482d62617030b5cf961ae8591eb0c299421530

SHA512
88f41a4dafb542800c47473bee161a2beb3d851d7db5fbbc36b1b06ad603c91468973badf7b2c545586260480a6a5fadc03c406a0c48e22f6f4036e34aa3abb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
04dc842f9a7b89ac08360e7b81d4d1a7

SHA1
b4f5c0d93e95a82f04dee5533c9620e7041402c6

SHA256
785aa5f64d93c913aa63d099aaa507acd7ff1239854ecbc74f561a812e896b6a

SHA512
5467ee12e3be37e08d211e572c0bb19e0eecf90ba7b7d4b96f3998e673503c57e78efd1947394458a841494d4fc8ce57ef59fea47a442a262f78812b5921c4b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
96B

MD5
86efc40ee652295bf62913940055c250

SHA1
07bb103929fb0c74829afb1aa0ca4c533e8350d5

SHA256
9fb0b563649d59a6447d6c5a1b5b82e631fa3bfaa94bc6628513a3a4045e3e0a

SHA512
12bb2c25f0bc37d77f8675d185912fffd68fd33feba8af923ec5dcf7965a27a1b0407482ab5c16d80401be5537cec4aa26a8d6d42df90fd08ff2ec63dde16fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
17KB

MD5
e1c59baac408537dd90e68ed9498c005

SHA1
79c4ad9cdedf48462d585a4c1297d37f6fa9985e

SHA256
1be3586e5116f2bb5bdc51a5b2759e78933be18ad92a1978f42110d9413ec38a

SHA512
fdcd41b5e544cfc9872aae960c0349fac5fc36efc036cb495cd8adbc9e67de72f01053e0e8dd4db6e8d2fd6a76beb8528467a8998e07c02e9abbfd767c0eee28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
5KB

MD5
3d174d88f1215ffeb0ab46b382f3dbb0

SHA1
552daaca8b57927b9bf3cc0ee84ce2430a46ca5e

SHA256
d4c79a179c6cc07859ed60b1d720384929fd39fd7617f246800c25ccffc83043

SHA512
c40f6f294f6e73b5f6d865468a96a002384c46227a1ea134b99cd5a813c19731f1a38943dbfc8f3d050a244db729d5b9b933270b6d99b32bf09513cef168d487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
c6011e1537b8a003c5ed84aa9a0046b2

SHA1
798ad80abb9720e4013ac813ac897c1b2a1a08f6

SHA256
82c59b95cc8653525b1ed079797cde418773896727400c4eddc9ffceea0c1d19

SHA512
77b8c2188f210f6b831d160cd92fa4bbd7a1121edaf4f1ce8712cb2187b9578edfb3c4f878e664087a8125ed01769785d8472ab7f00451a991ec74ddff68b3bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
18KB

MD5
ad9fd4bddbe10237f0cbcbf2cdbf2577

SHA1
ffcee0548ed1aa723d7626b604d926b85720c7be

SHA256
d13b177ae75d323e4eb6063ec58db46475e1307123140d132693c37f7a2f04d4

SHA512
f6eee8e712fcd80b6f84b348eee7d814aca7ce3686e41d9c6ace4193210f9df686b26edc66e1a99bb1db9136dede44fcb94ad642c9e3dd200389ba2dadffdc98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
aaa34da188ae3a906ba416dcad2734e9

SHA1
ffd52efb8c6500a67b70e9e0d6d1b01c9ca3daea

SHA256
cc199c0c66b18ae189eeb929f3ab710d3f3fa94bcdd30aeb499f1ec3804b3c4f

SHA512
29bb9f09432fa2ba8eee214aa271a14268eacc409f62768aea7552db1899f60a9c71c4300a063f809b1b82c9350f02e80e9172faa882ab67bfc30dc5953f9b73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d903a8df0d8d44d2c4f9ee011195e36d

SHA1
d4f6ccea91e069264bc8a4e1f8ff5e60fae9eb9b

SHA256
d5de121197a99f9d426ef17937e17394cb735319d36f0cf766dda39decb1b7bf

SHA512
8ae0185518b372258e256a8befa002d190c29d45810bb53179d68d28b0059174999f2592692a3ddcb43b38da47b1dfce22be55ad9d391e34c39f02720f00e706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
a1165db8a14eb4d55b0ce8d8475e59d5

SHA1
be29ba7ead4b7f3657055302d710fb1446757803

SHA256
504b29f7fd3c811b85d576e355c85c83c765e5fcec14b468631e88a9eb7c5b6e

SHA512
72c6815b22d4e88c4ac6c33b0e35fbc1afaf93340135a5d8fae7d2463856654ee21a71024ec7543425f1854b0c2235dcda09ef46fdec53eba7c2c06bfdff3b20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
3486b57e6f3c7323d76bb3aeb71ad27f

SHA1
7d9f8f9bc725547f3e1958dc99ed35babc78dbb7

SHA256
53613a015461a5154ca8fc8ccd678afa9432af12eaf5b147c582107e35e5a603

SHA512
66ba0fa7fddda4793409ad41c8d3dc5559a90ca7927ec2654cfa538f51ed3f0aac51eeb50feb03eba992f504df5ed1344b2eefe4613326672fbabfb9cee61b39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
1be573a200163bf5a686063946ba1e20

SHA1
a938d7c0e7a420cf7499efc3e1accac9a2036779

SHA256
7423ea155bf4f2ec9c2da04bdca1045dbb0af9041c707c73fc12fdd1998fc859

SHA512
ac531e69b38172dbad9f79fd7df34a81e99a2cf90ab3b7e807afe998efa61fd1eec0ad4d680e43d83e6fd8293d39e5b81c2d8dc0d46b2f25488f235c12952a86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
607edbe13bc12c2d9389163cc2af5b7f

SHA1
9ff4fa0c800c5dbc46a9fb810cd04f1b92fcea0d

SHA256
57206d1c9f4a22f28063b298a28c4c863094fe824afc8124b06846bb4ec87d94

SHA512
222576ee209effe8eea05b19352bfea47e4e4394da018d221082ad27c282d30e7745fb4c2298540f43f5b91ac3d345b9537879dc65de859624cadef5c31e1ccb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
481c68fb397f19d3931c78803bebbba4

SHA1
1e5369c5497d27296a804d99d8bc2310db590435

SHA256
a79abc95ea71e57be4ea8fa8113c3603b9a7f436c6b3f3f71df09e0765266c6b

SHA512
203acde2be713acb34733c3a8f12b39dc103d0b1f2aaf94141654162aaee91167911f4a0a6add947ba7e140389d9112d459a34f6338d8f16acaad675dcd7d4a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
41d06a83fbf87c9d171e3a43f5c00f83

SHA1
2db83496b9825e66be24b464a415e4f8681759fd

SHA256
7cb38a4c8c1d198aa11f84d26efd98b93116c365383456842d964b8ff4152333

SHA512
2eeee3f95cd412de7fa77980b38f3ff34cd3791c997c6b5221b7543eb8548c7b2df5a5b55c09731ee57a6effd0037ad313b261ed248d309996a861c6d15d4b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
0fd637fd4a196ac22261562823d78b43

SHA1
a10e26318f5f4fd2d082df2cb805c0a6a4344f00

SHA256
316130e1e83a84bd72673764ecbe159d84a1343cd473b263f54732f3b27a5b10

SHA512
b15941348deee23a13145e06a5ca5761c674663e0b1bacb95066c5accbef57f42689874190718c6c74d4573450d886100ea2bf0d996661be029a4e4cd2013446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
7db764c13dce349473437f95356e4c08

SHA1
acd350c54c6954e8a46432a1fa9ae5fe8b57d0a3

SHA256
dcc2b95f9072c587e9fa8a272a6bef8c4b7c95045e808018b38930fd4f4aa427

SHA512
2b508efffd9ad47e7efcda39a30784d11ecb845c7ddec058c19654192b52641c86df61376e215886e99acabfefe07ead039090e80f409d0952ef3626df694f76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1a14d8865b37d47fcd8f0cefeb8e2ca5

SHA1
e3b8f4187e36380b60a519ac83cd497344cae1fe

SHA256
1b959db9d812b8d7e8eca6b7c69155a66266a39ce29de392ae1d6da55aed0c64

SHA512
d09a12e3904edff4b59d54863d93eb730ba5b9a1299524f567de5b35f5e89de134cb3bd095dbaf901e81b175d338da15c34690c090f77237ff4a779f5fe7575b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8c92970b3dee6fdc91e4c10f1c6b821891975fe0\6f5fd8fa-6b38-4231-97e9-9a4a13fc6180\index-dir\the-real-index

Filesize
72B

MD5
0dd51a523da61c24318d1070e2dd8443

SHA1
27006ec4ae0fe8b60296b296adafb3be1d888523

SHA256
10631b5e91ec66175d3d656d28a2c0b6f28749c750f7d49971ed76753034a163

SHA512
b0ae08827b906644ad6dd3072b61abcbba94199a716a480fe6dadf9c02efaf5ca978ef34b1afeda2897a75a50804236461fc4c280054e20b80adf92759662cf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8c92970b3dee6fdc91e4c10f1c6b821891975fe0\6f5fd8fa-6b38-4231-97e9-9a4a13fc6180\index-dir\the-real-index~RFe59fea9.TMP

Filesize
48B

MD5
25ecdacdf7b0d91c3ecd7989dfd3bdec

SHA1
31ca0e181d6e983c6a0d95222b40ae0dedd8d421

SHA256
69e984111c95a1cb0c57a429e5edbb0303c413616abcbaabbc6fb4317ff47a27

SHA512
5f8e06f6f5d1b0864a706838e4c4005332df07181bc3eba939442fe3e1c949c49e3bfc48190337f1be2d8f41a579d56a777eafea55b10331ee838760964717b4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8c92970b3dee6fdc91e4c10f1c6b821891975fe0\index.txt

Filesize
92B

MD5
4ae27f46b69f0ad5ca89f77c1107caee

SHA1
7c9e42277580f5252ed9eada040b7345124ceb41

SHA256
fe20a55e6ae0482750eb6bb2b9f4b4308234bf42846dd41b7d2047eb37c0ba17

SHA512
919b6789683116bcdc3f286da2647d03e440f379db292bfc57c3a94e9004bebd4ace62dfdaf78fb08f840a6a3d6dff93eccccbd40b85bf6a96a91c06321f9a6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\8c92970b3dee6fdc91e4c10f1c6b821891975fe0\index.txt

Filesize
98B

MD5
d5847e0dbee52f98646d3ecba66e3ae1

SHA1
cf0814065aa179d71bb432d7ac120c8301afb32e

SHA256
e015809c041ac99d59cfef7bfd459cd9579ed04297701ef096a65fda4cebc5a5

SHA512
5f5de85aa742e1032010b5a7dc0dfffe34e13777b225b9701f3fc71f9b951d9aaf8da54306bb0981be5b39957fcf227bac040d3fa4bb3b9a9db30aed5340bfbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
dfc696ea2ca772f74be48aa8ad8c60bd

SHA1
03f8e4ec212813def52b99637aadb4627672a2c1

SHA256
e786ce6afb1d84a108124c22ab8baaaa1b6dda9d7f31bdf2cfd9efbac9240bdf

SHA512
bbb99c9387f223a24ffde3e2c6d7ddf1e6cf6971d5f56c067508b7520db9f7cb0fb6bf0196f98e55c311f0c742a9f8c22fdc2afc5c591642762e17c7107e4c18

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59fcc5.TMP

Filesize
48B

MD5
a4be0f9f24a484f7b0bb3329011b78f8

SHA1
5ec35325e3009e4bc350d7d0cbd99355cdbac1f0

SHA256
814d7a78d09bf543fdf70437bf7d59310b836f02bae47d10cbfa475db7f478eb

SHA512
ae2225eea8ca030eb7aa2a87ab046022700c374099adc896e5c21c18d030ca5b777f2966b6da128821bb9c22b28e4b797e4d1f2665fc2d8e5a427a9d05141ac4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
8f40c474b8b7a0705d62d307380eda75

SHA1
a237c020ae3512ccca4c8ba2654dcc45a36d0599

SHA256
ffc3f86776d52b7df94d1c5a42fb6e0b208090c2ebbe04906c77694c9ebcdde8

SHA512
01fcd3c17ee89fe27e7913b267a5d60877b41a83f40e0700712d6d1d4526362316bfb9f2b11bf4d859a4c813075d7ac3cfe0046557b8bd773f43f49277ff13fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
e17dea3bf83303502e98d945bf586cd4

SHA1
99c0399902ef6a63012f215ac17beeea0949bb87

SHA256
bba154e78080017b090b004539d0ba9f66f1fa10d130ff3edf313d83e369cb2c

SHA512
813f5fd73b5330e33eeaaca11f6c8f738b19678a95f521bd258eedfe2cdd1e3b80d75705600f16868cd9909ad023286a89de6ffee4bec41f24c299f2c47bdb7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
e7c9f8c11bb1c7e75766fa7e7476d141

SHA1
38b2e3c1b2d0b734e58b0fe0bc85e3e824803a2f

SHA256
9cbdaae2601d3718b4367041e518d0adc1d7ca47cced9dca0fb53a330b28c81d

SHA512
7610e48ef516551820a7da65fb89b9aa10f920326dbbb4a5257decd341319b9dbb0d6c48e4b2a53a1ab653f0333b109a00ae3c0ccc13a1e7b9c6c464fd95ad73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
d82743e169f62de737434ad97bcbe71f

SHA1
cd77558da93c50080695b320b63bdcaf02df7a7d

SHA256
5a8d30bfc477ae74f0f2cd60732571c2a2222201ca33418a9f2582c93af66c06

SHA512
e7e35ed130089b06cac37c7744832fd994e81d8f3edb03c5eba468ace7eae83ce6777c1e13c8eadb3c82cd95f1a236a0197b7d5c47356962dd977b0203c4bd59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
e56356abcbf2750bafb755ecc35604da

SHA1
818aac1c468a9a19a4b7145c1d21889d4dfbfce4

SHA256
bb072de6c5d44ac4df6220ee1a43034c75b5d2f65ef4a3ece55a6d3aedc92555

SHA512
f2f4ab5aa3c6b666f981826e98261742dd01024e47292be2b6f015eed00b2348d65d1d28cd7d1d208b3a01961ed72a77b35b061f423e03a357d6d7ed09004f1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
a318bce637a33a70a07eccd7db6f7e89

SHA1
3c4047b73a1e830a4be7c5f4fd478d0b660b213e

SHA256
a4751d0ca6407c21267be9781b2af21a449bd591de9566652d0c69acbb3c7dc9

SHA512
f2e5a48b4daa5d6919c4ec031404ac25d0768d38ab6f2c40df6d7bcfe8b955b2e83fe133a125750996c707f2e4a05b87783ac541ffc3610c29ad5cc346ceea0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
59ff75cacd0302cbd79f06a2782b737e

SHA1
b66d627abe3ddba3d94e35c684a00bba129d3258

SHA256
183e73a5ddbae9ea96569c143373d444caca7fc04ee9b28ce989e1e526e5c8c0

SHA512
ff57f5f7fd2d05fb6982557f4be78902fd05d8e38c1a245b4ea79cbfce008285b4c7ac713e70c6c6b858e626a5c486de18bbd2a323547551967ab35d2f6cae72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe590d93.TMP

Filesize
538B

MD5
fa50a7e14af74b7b2ff0fb8152dc247a

SHA1
05d16a146ab68839f7589b3a6755eb0997e18c15

SHA256
7fae2ce22c164b9e5f3982060822581ae967fee55f4e6321cf78a48b07ef4c66

SHA512
0763b8ad890f5d6950300e0e6b016e24c2d19b70a598d1cd5845818190131dc1a4371c499a95f67249dfafcfcb980c65b3fc1d5bb9c8a3a15d18d95d4506843d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d9fe40dcf41e5751d5f0a2cfe83e1c5d

SHA1
9ca3c078dc8357e4b33806888804841f809fe391

SHA256
afc1c233fb5f67dd33969eb570d7269f9edc57fef8de9918305f4bb68123ae5d

SHA512
c086bd6d1afdf307b163c901f26a148e520cc023add40856609c48634d9d9f957cbff5b7cea19eb520fc95de7b6115b2fece2c813435696b676b2136de007ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d399e04c692e520605a45d7ff23e36b1

SHA1
77daec5da31b9336f3297e902ef0ebff88d91477

SHA256
0799ef6f938a17a80e1e5fac5f524c78286f8712fba2f95b6ba066c4d1ba5577

SHA512
67f1398f5b5aa4af34ddabfbd3bb4c932cc5c44a91867c68485022993da76199c36a3057a2ba4192ae104c1200efbdcbeca92e2c08e726e71f081c2be273ecf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
346ec754a2b17539aa9679dc4f5c340a

SHA1
598978b87630299406828a5e115b840c5f7976b2

SHA256
42ac904f19cce7907e534dc2b0d6bbb65cacc77a455fbbb8f9527580de199ce5

SHA512
03c5bfbff8d7b1f7792e8fa331d82086dbb2b6dc56da6dbf266f640770e03f2310d0374f9969cc0442d7681f170c2fa2c617beff8863f99d9758b7d52c0db8ae

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\activity-stream.discovery_stream.json

Filesize
22KB

MD5
c5ec28e5e5d24efc28ce737b17e02a5a

SHA1
65195ce8f9b62f4155dcbc746b36eb87d3898882

SHA256
3724bb75c2711a741ece5c13d231265f04203d3b780cae11f39177122ad0e024

SHA512
4cc47ccd46ff509ec0ee07d3004fc17604c077f359bef17cfad328a3f1a40de3102eb1577d6fddaf7b998a1e17bfc4837df719628033cfe3cb0f8363eb253236

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31

Filesize
13KB

MD5
7890c4c53bfc5884ae9e25dd84f8b633

SHA1
d54cc56fa52d4e278d3f1e488c2583a19ce5f339

SHA256
3a5bb074a044482eab06dc44538fd2cb22f8066c7d9fe26773bea3134526df8e

SHA512
f55f90dd9e8ae7c0b5a574c5e3698e7cf684da8a6cc40bf7d11cfc3346b5a1773a1a174e7085fbe3e74855ed32968060a28bdfebd7291ebc95d4a16fc0b9e0d7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\F8CBD54DDA10F4286A41EC6A537240712D6C2308

Filesize
9KB

MD5
9988a7031f8c8f8afa622249b4bd91a6

SHA1
ee96f359fb6d281d4a32b11e4de333b0ca26f377

SHA256
d7ba6f908ed6e1c45a0be9781a44ef14b84eb900d8e56930b4c085b5f2cf1eee

SHA512
2c45b57bde19456f5d697e2c8d900dff99400ab5a6023693288db9f573e7048cdff86ec9b17f15108a546aed49e1698393651e1e43c8142b02e0957dc8cd1f2a

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\HTM4966.tmp

Filesize
4KB

MD5
3ae28349a0236046083efd4b9c0d6fee

SHA1
330db78d0e01b3c84bd112b9a0e537e79fbff1db

SHA256
21861c141770ca25bacf9fc205c68298bd44d90d81c659b7043489bc4a8b0fb5

SHA512
8dc83512bae819ffa055bd5052d73ba26acb7d2b53335204651bec332edf48989390ef9e2def29e1b30eb936f0f2e7e3754ec297f009428ede860297376913c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
d86e7b7c93e216ca7e01cc98ff3c07c1

SHA1
de71d60ec5fdd90f3e29201a076854e7b70acf6b

SHA256
a52c4115574d6e97494946a73387a27b54347f8e5e88444e9c09a610d53b0700

SHA512
535ff4d0630c00dcaad1aee533bcb4bc3bc1192a1824db234cb865dd34610104bf2e6fd7fa5e980d534daea56047db78557564299393474390076d9a24199923

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
aafdbee649147d7e2a7a9d83637014aa

SHA1
8bc4cc8c75091bef148ebbaaf7bee84ab3a7699c

SHA256
07ba65ff1b12e856b9d3a6a3e2517fb3754b6fb8852b3fc9d01a0ef6dc2ea38e

SHA512
ee9164cffa0b9c1f4ff6480911fbd94c10abecf30bd37e4bbb6a64c0ee6d1b017e7bd653f59ae3e61631968fcb3ccc07b1cfc5593f9fb6b7092f653bade922e3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
10KB

MD5
d4b03ac063bf3c058e2d13babaa35ebc

SHA1
0e673f388508bc2703ad02cab57040abdc00b0dd

SHA256
b2d6622becab2ee7385b0d79bdb797b387597471dc8b9c5292405a4aa200a80e

SHA512
f5eed7bab571962ea3498cc01cec0b91f901608b0051fe68743d2b2ca600bed166cca7d73db007e5c9ac828052f90853c404bac21aec7d0b1cc587b68e4d9563

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin

Filesize
6KB

MD5
e45ab9063ef642ce8c12ebb4c4b7b8d4

SHA1
1457841984f49f4f9b33a4294206b14672974934

SHA256
903dbd8ce1ca0750f489722a2fc238491df230d9a6a81cdecc23d8f1f710274b

SHA512
338acaeaf0f0cca170abb31c17f7e1ae7f76f420e6f0a226b85788bdc2e062f3603d237702bcda22662b575a3609f63866e8e8b34ec927529930b0dc170830c4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\AlternateServices.bin

Filesize
8KB

MD5
5b01f46b1fc7ff724c0f7e6316fc3e34

SHA1
021dd0a728e36b679952a4c43d05cfe1d4058952

SHA256
4376c38066a26ca511d4c365197c0a5ae84df452a7a0dac732836709a0847b20

SHA512
d9cec2216954946cbb089e21fdaebea8400089e53e98a27ce310a4ba96c9caeb39d746654d4f2039e7deaaa6d06126410d18fd54269eb730d31c5205f078c7ba

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
2f5bd03daec187b62b71a6e32b41519b

SHA1
fab652a910cb4287a236535cdb6734e34c94bbf3

SHA256
380c936bc06797dabd775afb41f0ef2af7acc8650bded66c3485fc91c5153da8

SHA512
e88e6f11f529d74ee73015764f96eb4cb5eef8e2e5c34838fb7602cfad3a50f007128b2eaa01c23ca8081b9092b17f60e8a27f2f5a4547565d6ec83f0efd06b5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
6faa905d525cf7a4e6565723943b4e24

SHA1
4ee69cf02956800328d6a2579f5063f50bca36b2

SHA256
fa2a4e07362cb266db40e0b2f2280ceab322604c8381dab6351a7d7f72fcc53c

SHA512
ffbb9a1e69e1a5538c907ce5d7c886e343798e95fb47eaae4c9c5d86b1e2370becff42d1079d2b75141f0112cda4d92e129ec3a3fb61b5bba1fb0d1708d3c386

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
dcfcd5dd20a961d5a424f75035b5c6a2

SHA1
047ec00c7a19c191a34bdf2875933b0849f5e678

SHA256
bb90442dddef96414b7a503391371b2231cd64b6b10b3350cd960ea642af7c38

SHA512
ee3760a0f314a671ceda222125ab8c0d1bf67f61e96d6883fac9ae30094947b7391e3c31d500f45f7d7f559697d23946eafca8a527326b527183113830c10cf9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
77358f375100698fa1ab03b96c9c94b7

SHA1
5fe1b7ebcac28cc73edbad949fbbccd143d21fd4

SHA256
ce9799e09569b05f36998c03339c0946c7ce200358dfa3854568fdffc8e0a355

SHA512
f29600b67beb28372de95b4d4f00277b05b138a3f1d6e44e3378fa98edb2f68b9d35b82e8b52164dc6744f52abb51c26e791e221c7715f66f711c3b01e26f671

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
655d2debbf5c4fc0bd71b3b4559a304e

SHA1
01306f81644707a05d0a49ca0afe665b0933d461

SHA256
77d7c3a92f61fe14f71ad77c6bd06762e97b65e457ec254025ae62c9ea664771

SHA512
1b80a543eab846d7cd486cf5fa0a1aa88a0e22c2fcc482485a510bbe2ae13aa238b5cc048f474d6a892fec0a7e70e4f95b2d8d68802f3808bcc52673f977c600

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
3021e3460b94c0f893955b2f4043ec43

SHA1
df1696aa75c9e46bad70c13af05e4b05a793ea47

SHA256
acdd6eddac635bea49b9f6f13e7cc811df4173187015822c573beacc66834e2c

SHA512
661e5dc654a99a8221c20ee8de390e8517131a2890ba73fd612f9fdf9c123649ac2ccab4f0f34d083296e04f7e86ca617972fa3ef6c1eb9a53b59bb8d4d87e05

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\48b97488-bc4e-4898-a2c4-4b6f461f9e90

Filesize
654B

MD5
b86e0d8a1d9464e43ed065683990de03

SHA1
7c62e12424057ae0bedf77953e9fc8b545485f39

SHA256
882e07761dc5639e57f8b991797990951cc8f55c60a671fd3bafd265a1092860

SHA512
28c9f21245241fa80df2dee307479a59bc36523a9116b847dce80f0d340aac46e176d65af8ce0b9ee41873184bc83b91badcc6db86570eedeecf563eebeeaaec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\79a2f4d3-4473-4d69-9390-678f399a10e7

Filesize
23KB

MD5
3726c9917f472af82fbc711ad87ef868

SHA1
202241907d82f6e9f4486cbccf50f5591c7c42bd

SHA256
1a55b14283ac17b6503ad3bd98b7b1d7fe152e0be68c6e644812cd189891fc4b

SHA512
0e40fc474cda7f53e2c2cd574152b5a2301b2769619aa02312c49db1151775b9e23e9306319df54736f4287a01f21fea62a5e2acab1ef53eb3841a2a5a738c1a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\a9444360-68c0-4338-9c73-5a3ed46bccb7

Filesize
671B

MD5
d013a512062bef60adaa80a91cc9b23b

SHA1
1fac83a3f40d2bbda9bfdb876398e0e6268279dc

SHA256
cc957ca5b08eff83acc91f6649e25e4765f95665438fb1f9ed5de3c3a74c54dd

SHA512
610e82cb15eb7266357fd25b0025fd358178bee0035301cec4d222f1fd9b879fad93e728ace64f27e412cb385aba2af660df27ca5708eec10ebcefeab656712f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\pending_pings\c7ae10f3-72c4-4a58-9286-f2bb8020c585

Filesize
982B

MD5
26046a51ba31b0c0009360dba0430bad

SHA1
51ffaf46def72e5b9fc37a07781487e57ac790a2

SHA256
c47877a886727a7494c037adf6196331e861e1f588d5ffcfe264f4bf7f0fb898

SHA512
a4fee40e8315a7ad4c9c84f0aabd69e743777d4ddcf905ad505c5f6361f049c51f4d7c517c21150fe53265fddf1a957b92358f72e8a5eb342aa40d63a49c4141

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js

Filesize
11KB

MD5
25291e068f3abcc55f6bcdf4f66f56b2

SHA1
b232d27fad7299cb80a09fc77b1c57dbf69512e4

SHA256
dc4e56dd5ac435cbc98a20214808a1cde684b25d46aafb5c5d563990642b4962

SHA512
89368a571c7afb8d707b75400a53f1a65dddcf98dc7e64afee918992da5800bba0fbebd5288ecb7ba977aa093d512d64292947dcb891a686c319e2ad91223d32

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js

Filesize
15KB

MD5
6f6d8d2237e6d647cf1c15ae1ea89fc3

SHA1
649ce5102d0f037ce6b39c711ece654d653282a4

SHA256
1e8bbc52eaacfe2ee8ad7f7e46918120055ed79ea7164a08c19dd7506af3ed4e

SHA512
ff763f271a6fc76e1c4d67c0506dbaa4b739f0635da1a5de7670fb85041f8ef7d039bc95e972f0d10fe74b94106e8ff4039745c48a1da13cb91fd4557d8b6e6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js

Filesize
15KB

MD5
6a1c73c7b2a1b49cafe41801a08e331f

SHA1
2adf1f9364a613616298814d127056659c0c4796

SHA256
1057265fe11e76b95ab9596f1467a78636fe90562ed29c3c98b54db2621697eb

SHA512
2c865d15c35c27da2a715c305688f755151902449e5d6deb9da969e07c91eb1212e6afc18b679737ed517d32da35afcbcb104bd9df874c33362a327a1958d879

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js

Filesize
10KB

MD5
00a2a4ac1fa0ab8163cbe514e4d098b3

SHA1
6931f09b0c1b1993cda75f5d6c114d633b5a38b8

SHA256
5bbd82915b94f6e9111b289b3e38d2ec57aa666205b93bf234ca8c0d5bc791f3

SHA512
1fd948de31cd0c6f6c631f38fe15bc23cc153c242cb9e3abb4ce14598c0df0fdca6f17fc5a8b27ff9bbee587c039d4a19b96ad93d5e0c2e6e52d8e11d74b07ff

Download Submit
memory/972-13635-0x0000000005F50000-0x000000000615C000-memory.dmp

Filesize
2.0MB

Download
memory/972-13613-0x0000000005F50000-0x000000000615C000-memory.dmp

Filesize
2.0MB

Download
memory/972-13631-0x0000000005F50000-0x000000000615C000-memory.dmp

Filesize
2.0MB

Download
memory/972-13655-0x0000000000400000-0x0000000002569000-memory.dmp

Filesize
33.4MB

Download
memory/972-13618-0x0000000000400000-0x0000000002569000-memory.dmp

Filesize
33.4MB

Download
memory/972-13617-0x0000000005F50000-0x000000000615C000-memory.dmp

Filesize
2.0MB

Download
memory/2816-9374-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2816-13607-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2816-13588-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2816-12582-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2816-11554-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2816-10184-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2816-3516-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2816-3514-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/5352-13608-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5352-3513-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/5352-3494-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download