Analysis
-
max time kernel
314s -
max time network
317s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
23-01-2025 09:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://en.softonic.com/
Resource
win10ltsc2021-20250113-en
Behavioral task
behavioral2
Sample
https://en.softonic.com/
Resource
win11-20241007-en
General
-
Target
https://en.softonic.com/
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files\\AVG\\Browser\\Application\\131.0.27894.265\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser" setup.exe -
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe AVGBrowserUpdate.exe -
Checks computer location settings 2 TTPs 32 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation MinecraftInstaller.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation avg_secure_browser_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowserUpdate.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation avg_secure_browser_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation aj2A4A.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation aj2AA8.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation avg_secure_browser_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation aj342D.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation GamingRepair.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation aj321A.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation avg_secure_browser_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe Key value queried \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\Control Panel\International\Geo\Nation AVGBrowser.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6916 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6388 aj2A4A.exe 6400 aj2AA8.exe 5496 aj321A.exe 5588 aj342D.exe 5724 AVGBrowserUpdateSetup.exe 476 AVGBrowserUpdate.exe 5464 AVGBrowserUpdate.exe 6676 AVGBrowserUpdate.exe 6912 AVGBrowserUpdateComRegisterShell64.exe 6740 AVGBrowserUpdateComRegisterShell64.exe 5568 AVGBrowserUpdateComRegisterShell64.exe 6700 AVGBrowserUpdate.exe 5152 AVGBrowserUpdate.exe 6752 AVGBrowserUpdate.exe 6396 AVGBrowserInstaller.exe 6340 setup.exe 2588 setup.exe 7580 AVGBrowserCrashHandler64.exe 6824 AVGBrowserCrashHandler.exe 4232 AVGBrowser.exe 640 AVGBrowser.exe 5504 AVGBrowser.exe 6768 AVGBrowser.exe 5608 AVGBrowser.exe 6536 elevation_service.exe 6916 AVGBrowser.exe 5620 AVGBrowser.exe 6108 AVGBrowser.exe 6548 AVGBrowser.exe 4732 AVGBrowser.exe 2972 AVGBrowser.exe 5392 AVGBrowser.exe 5552 AVGBrowser.exe 864 AVGBrowser.exe 5244 AVGBrowser.exe 5804 elevation_service.exe 552 AVGBrowser.exe 6912 AVGBrowser.exe 2144 AVGBrowser.exe 4688 AVGBrowser.exe 5344 AVGBrowser.exe 6992 AVGBrowser.exe 8176 AVGBrowser.exe 6812 AVGBrowser.exe 7620 AVGBrowser.exe 5564 AVGBrowser.exe 7056 AVGBrowser.exe 7812 AVGBrowser.exe 6664 AVGBrowser.exe 460 AVGBrowser.exe 6560 AVGBrowser.exe 6276 AVGBrowser.exe 7156 AVGBrowser.exe 4588 AVGBrowser.exe 7036 AVGBrowser.exe 6788 AVGBrowser.exe 4484 AVGBrowser.exe 5928 AVGBrowser.exe 6568 AVGBrowser.exe 4500 AVGBrowser.exe -
Loads dropped DLL 64 IoCs
pid Process 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6916 avg_secure_browser_setup.exe 6916 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6916 avg_secure_browser_setup.exe 6916 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6916 avg_secure_browser_setup.exe 6388 aj2A4A.exe 6388 aj2A4A.exe 6400 aj2AA8.exe 6400 aj2AA8.exe 6940 avg_secure_browser_setup.exe 6388 aj2A4A.exe 6916 avg_secure_browser_setup.exe 6400 aj2AA8.exe 6388 aj2A4A.exe 6388 aj2A4A.exe 6400 aj2AA8.exe 5496 aj321A.exe 5496 aj321A.exe 6400 aj2AA8.exe 6388 aj2A4A.exe 6388 aj2A4A.exe 6400 aj2AA8.exe 6400 aj2AA8.exe 5588 aj342D.exe 5588 aj342D.exe 5496 aj321A.exe 5496 aj321A.exe 5588 aj342D.exe 5496 aj321A.exe 5588 aj342D.exe 5496 aj321A.exe 5496 aj321A.exe 5588 aj342D.exe 5588 aj342D.exe 5588 aj342D.exe 6388 aj2A4A.exe 476 AVGBrowserUpdate.exe 5464 AVGBrowserUpdate.exe 6676 AVGBrowserUpdate.exe 6912 AVGBrowserUpdateComRegisterShell64.exe 6676 AVGBrowserUpdate.exe 6740 AVGBrowserUpdateComRegisterShell64.exe 6676 AVGBrowserUpdate.exe 5568 AVGBrowserUpdateComRegisterShell64.exe 6676 AVGBrowserUpdate.exe 476 AVGBrowserUpdate.exe 476 AVGBrowserUpdate.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AVGBrowser.exe Set value (str) \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AVGBrowser.exe Set value (str) \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGBrowserAutoLaunch_2539D9FFF1F40C0A976762D6C815D3E3 = "\"C:\\Program Files\\AVG\\Browser\\Application\\AVGBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AVGBrowser.exe -
Checks for any installed AV software in registry 1 TTPs 23 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast aj321A.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast aj342D.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus AVGBrowser.exe Key opened \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast aj2A4A.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\AVAST Software\Avast aj2AA8.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast aj2AA8.exe Key opened \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\AVAST Software\Avast aj342D.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast AVGBrowser.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\AVAST Software\Avast aj2A4A.exe Key opened \REGISTRY\USER\S-1-5-21-4069049685-955655941-4058287599-1000\SOFTWARE\AVAST Software\Avast aj321A.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aj2A4A.exe -
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
flow ioc 329 https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html -
Writes to the Master Boot Record (MBR) 1 TTPs 9 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe File opened for modification \??\PhysicalDrive0 AVGBrowser.exe File opened for modification \??\PhysicalDrive0 aj2A4A.exe File opened for modification \??\PhysicalDrive0 aj2AA8.exe File opened for modification \??\PhysicalDrive0 aj321A.exe File opened for modification \??\PhysicalDrive0 aj342D.exe -
Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer AVGBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer AVGBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer GamingRepair.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName GamingRepair.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer AVGBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName AVGBrowser.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\vulkan-1.dll setup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_ro.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bg.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\psuser.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\acuapi_64.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateOnDemand.exe AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\ar.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\es.pak setup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_ca.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ko.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\af.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\nb.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\mimic.dll setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat setup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_id.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM583D.tmp\AVGBrowserUpdateOnDemand.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_vi.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fa.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-CN.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_zh-TW.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\pl.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_mr.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ro.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\notification_helper.exe setup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_te.dll AVGBrowserUpdateSetup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\fi.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\setup_helper_syslib.dll setup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_gu.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_bn.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\Download\{48F69C39-1356-4A7B-A899-70E3539D4982}\131.0.27894.265\AVGBrowserInstaller.exe AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\he.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\zh-CN.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\MEIPreload\manifest.json setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\resources.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\AVGBrowser.VisualElementsManifest.xml setup.exe File created C:\Program Files (x86)\GUM583D.tmp\AVGBrowserUpdateSetup.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_am.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateWebPlugin.exe AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\gu.pak setup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_fr.dll AVGBrowserUpdateSetup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\131.0.27894.265.manifest setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Extensions\external_extensions.json setup.exe File created C:\Program Files (x86)\GUM583D.tmp\psmachine.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM583D.tmp\AVGBrowserCrashHandler64.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_hu.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ca.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es-419.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_tr.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\chrome_wer.dll setup.exe File opened for modification C:\Program Files\AVG\Browser\Application\SetupMetrics\6340_13382097411197294.pma setup.exe File created C:\Program Files (x86)\GUM583D.tmp\AVGBrowserUpdateCore.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_it.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_sw.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sk.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\bn.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\nl.pak setup.exe File created C:\Program Files\AVG\Browser\AVGBrowserUninstall.exe aj2A4A.exe File created C:\Program Files\AVG\Browser\Temp\source6340_2139181841\Safer-bin\131.0.27894.265\Locales\ta.pak setup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_cs.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM583D.tmp\goopdateres_ms.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateCore.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fil.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_id.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\Install\{1E468125-1BA8-4C94-8579-D9E12D947E42}\CR_3A349.tmp\SECURE.PACKED.7Z AVGBrowserInstaller.exe -
Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp setup.exe File opened for modification C:\Windows\SystemTemp\AVGBrowser_installer.log setup.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat chrmstp.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat chrmstp.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8736_911031604\manifest.fingerprint AVGBrowser.exe File opened for modification C:\Windows\SystemTemp\AVGBrowser_installer.log setup.exe File opened for modification C:\Windows\SystemTemp AVGBrowser.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata chrmstp.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8736_911031604\_metadata\verified_contents.json AVGBrowser.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp\AVGBrowser_installer.log chrmstp.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp AVGBrowser.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata chrmstp.exe File opened for modification C:\Windows\SystemTemp setup.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat setup.exe File opened for modification C:\Windows\SystemTemp chrmstp.exe File opened for modification C:\Windows\SystemTemp chrmstp.exe File opened for modification C:\Windows\SystemTemp\AVGBrowser_installer.log chrmstp.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping8736_911031604\manifest.json AVGBrowser.exe File opened for modification C:\Windows\SystemTemp AVGBrowser.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserProtect.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MinecraftInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aj2AA8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aj321A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aj342D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MinecraftInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aj2A4A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdateSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MinecraftInstaller.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MinecraftInstaller.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 6700 AVGBrowserUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 17 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj321A.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj342D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj342D.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj321A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj2A4A.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj2AA8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj2AA8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AVGBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj2A4A.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AVGBrowser.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AVGBrowser.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 GamingRepair.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz GamingRepair.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 GamingRepair.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString GamingRepair.exe -
Enumerates system info in registry 2 TTPs 14 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU GamingRepair.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS GamingRepair.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AVGBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AVGBrowser.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppName = "AVGBrowserUpdateBroker.exe" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppName = "AVGBrowserUpdateWebPlugin.exe" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077} AVGBrowserUpdate.exe -
Modifies data under HKEY_USERS 12 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update AVGBrowserUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry AVGBrowser.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133820974674024828" AVGBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\ AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\devmode = "0" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\endpoint = "update.avgbrowser.com" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\hostprefix AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineId = "0000cbc4aa53932df6468356dc6cec24" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineIdDate = "20250123" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser AVGBrowserUpdate.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\NumMethods AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\NumMethods\ = "24" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ = "IJobObserver" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.MiscUtils\CurVer\ = "AVGUpdate.MiscUtils.1.0" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\ = "IBrowserHttpRequest2" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE}\ = "IApp2" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGPDF\AppUserModelId = "AVG_Secure_Browser" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassSvc\CLSID\ = "{30612A81-C10F-498E-9163-C2B2A3F81A14}" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvgHTML\Application\ApplicationDescription = "Access the Internet" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C0BE1521-7935-42E6-B606-058A559910BA}\NumMethods AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreMachineClass.1 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA348B59-06AD-4482-AD87-966302908F0F}\AppID = "{CA348B59-06AD-4482-AD87-966302908F0F}" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6972DB5C-E9D6-4A81-B352-B415A3A61CA6}\ = "IAppBundleWeb" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\NumMethods\ = "17" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6972DB5C-E9D6-4A81-B352-B415A3A61CA6}\ = "IAppBundleWeb" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{40C1C1D3-AAEA-46EE-AA2B-79A2CC62F257}\VersionIndependentProgID AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AVGBrowserUpdate.exe AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BEBC1D02-EC16-479A-83F6-AA4247CA7F70}\Elevation\IconReference = "@C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\goopdate.dll,-1004" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\ = "ICurrentState" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{30612A81-C10F-498E-9163-C2B2A3F81A14}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\NumMethods AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C50E3A4-12A8-41FB-9941-E8EEB222E07E}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ = "IJobObserver" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\ProxyStubClsid32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\NumMethods\ = "4" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{358EC846-617A-4763-8656-50BF6E0E8AA2}\1.0\0\win64 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\NumMethods\ = "5" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\NumMethods\ = "4" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\ProxyStubClsid32 AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7BA03866-1403-40EA-81A9-23FCD97810E2}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoreClass.1\CLSID AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{358EC846-617A-4763-8656-50BF6E0E8AA2}\1.0\0\win32\ = "C:\\Program Files\\AVG\\Browser\\Application\\131.0.27894.265\\elevation_service.exe" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DAE1732-F855-42A3-9D28-B7F6E291ECCD}\ = "IAppCommand2" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8159E37-5EDF-4E6D-8E6D-E558E8DDC2A0}\NumMethods AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2}\InprocHandler32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassMachineFallback.1.0\ = "Google Update Legacy On Demand" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3COMClassService.1.0\CLSID\ = "{82C85EAA-7C94-4702-AA75-DF39403AE358}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\NumMethods\ = "9" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{079CAB07-5001-4E71-9D5A-B412842E5178}\NumMethods AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8159E37-5EDF-4E6D-8E6D-E558E8DDC2A0} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\NumMethods\ = "10" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{384098DD-AB6D-412E-B819-2F10032D9767}\VersionIndependentProgID\ = "AVGUpdate.CoreClass" AVGBrowserUpdate.exe -
Modifies system certificate store 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 aj2A4A.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj2A4A.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj2A4A.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj2A4A.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj2A4A.exe -
NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\Downloads\Unconfirmed 561407.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 715899.crdownload:SmartScreen msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2720 msedge.exe 2720 msedge.exe 1396 msedge.exe 1396 msedge.exe 1204 identity_helper.exe 1204 identity_helper.exe 6376 msedge.exe 6376 msedge.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe 2284 avg_secure_browser_setup.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 476 AVGBrowserUpdate.exe Token: SeDebugPrivilege 476 AVGBrowserUpdate.exe Token: SeDebugPrivilege 476 AVGBrowserUpdate.exe Token: 33 6396 AVGBrowserInstaller.exe Token: SeIncBasePriorityPrivilege 6396 AVGBrowserInstaller.exe Token: 33 5196 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 5196 AUDIODG.EXE Token: SeDebugPrivilege 476 AVGBrowserUpdate.exe Token: SeIncreaseQuotaPrivilege 6388 aj2A4A.exe Token: SeShutdownPrivilege 4232 AVGBrowser.exe Token: SeCreatePagefilePrivilege 4232 AVGBrowser.exe Token: SeIncreaseQuotaPrivilege 6388 aj2A4A.exe Token: SeShutdownPrivilege 2972 AVGBrowser.exe Token: SeCreatePagefilePrivilege 2972 AVGBrowser.exe Token: SeShutdownPrivilege 2972 AVGBrowser.exe Token: SeCreatePagefilePrivilege 2972 AVGBrowser.exe Token: SeShutdownPrivilege 2972 AVGBrowser.exe Token: SeCreatePagefilePrivilege 2972 AVGBrowser.exe Token: SeShutdownPrivilege 2972 AVGBrowser.exe Token: SeCreatePagefilePrivilege 2972 AVGBrowser.exe Token: SeShutdownPrivilege 2972 AVGBrowser.exe Token: SeCreatePagefilePrivilege 2972 AVGBrowser.exe Token: SeShutdownPrivilege 2972 AVGBrowser.exe Token: SeCreatePagefilePrivilege 2972 AVGBrowser.exe Token: SeShutdownPrivilege 2972 AVGBrowser.exe Token: SeCreatePagefilePrivilege 2972 AVGBrowser.exe Token: SeShutdownPrivilege 2972 AVGBrowser.exe Token: SeCreatePagefilePrivilege 2972 AVGBrowser.exe Token: SeIncreaseQuotaPrivilege 6388 aj2A4A.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe Token: SeCreatePagefilePrivilege 8736 AVGBrowser.exe Token: SeShutdownPrivilege 8736 AVGBrowser.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 8736 AVGBrowser.exe 8736 AVGBrowser.exe 9312 chrmstp.exe 8736 AVGBrowser.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe 1396 msedge.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2284 avg_secure_browser_setup.exe 6420 avg_secure_browser_setup.exe 6940 avg_secure_browser_setup.exe 6916 avg_secure_browser_setup.exe 6388 aj2A4A.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1396 wrote to memory of 3136 1396 msedge.exe 81 PID 1396 wrote to memory of 3136 1396 msedge.exe 81 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2088 1396 msedge.exe 83 PID 1396 wrote to memory of 2720 1396 msedge.exe 84 PID 1396 wrote to memory of 2720 1396 msedge.exe 84 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 PID 1396 wrote to memory of 884 1396 msedge.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://en.softonic.com/1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0xdc,0x130,0x7fff6f4b46f8,0x7fff6f4b4708,0x7fff6f4b47182⤵PID:3136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:22⤵PID:2088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:82⤵PID:884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:4720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:12⤵PID:4616
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:12⤵PID:4072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:12⤵PID:5076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:82⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵PID:4952
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff7c8a15460,0x7ff7c8a15470,0x7ff7c8a154803⤵PID:3220
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6288 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:12⤵PID:1800
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6568 /prefetch:12⤵PID:2512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:12⤵PID:3776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:12⤵PID:5152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:12⤵PID:5160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:12⤵PID:5332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:12⤵PID:5652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:12⤵PID:5760
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:12⤵PID:5768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:12⤵PID:5748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7320 /prefetch:12⤵PID:5916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6704 /prefetch:12⤵PID:5236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:12⤵PID:5520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:12⤵PID:6084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7796 /prefetch:12⤵PID:2440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8144 /prefetch:12⤵PID:5256
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:12⤵PID:5604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1840 /prefetch:12⤵PID:5220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2768 /prefetch:12⤵PID:5552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1196 /prefetch:12⤵PID:4300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:12⤵PID:1056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7156 /prefetch:12⤵PID:2024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8424 /prefetch:12⤵PID:5264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:12⤵PID:5240
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8240 /prefetch:12⤵PID:5160
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8812 /prefetch:12⤵PID:2408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8804 /prefetch:12⤵PID:5624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9128 /prefetch:12⤵PID:6204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7932 /prefetch:12⤵PID:6512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9292 /prefetch:12⤵PID:6520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9516 /prefetch:12⤵PID:6528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8736 /prefetch:12⤵PID:6796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=9292 /prefetch:82⤵PID:6976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8828 /prefetch:12⤵PID:6984
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9788 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:6376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6400 /prefetch:82⤵PID:6380
-
-
C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\aj2A4A.exe"C:\Users\Admin\AppData\Local\Temp\aj2A4A.exe" /relaunch=8 /was_elevated=1 /tagdata3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6388 -
C:\Users\Admin\AppData\Local\Temp\nsq2C7C.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:5724 -
C:\Program Files (x86)\GUM583D.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUM583D.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"5⤵
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:476 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5464
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6676 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6912
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:6740
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5568
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezQ3MzAzRTEwLUVBOTgtNDhGMS05RkNELTJEOTRGRjRBODBBRX0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins3MTM1OTY1Ny05NUY4LTRERjEtODFCNy1FMTk5OTQxNTMyQUR9IiB1c2VyaWRfZGF0ZT0iMjAyNTAxMjMiIG1hY2hpbmVpZD0iezAwMDBDQkM0LUFBNTMtOTMyRC1GNjQ2LTgzNTZEQzZDRUMyNH0iIG1hY2hpbmVpZF9kYXRlPSIyMDI1MDEyMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins4NDgyRjBCNC00MDAxLTQ4MzYtODEwOS04NEMyOTNBN0VGRDd9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDQuNDUyOSIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIyOCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNDk0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:6700
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{47303E10-EA98-48F1-9FCD-2D94FF4A80AE}" /silent6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5152
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --heartbeat --install --create-profile4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4232 -
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fff5e5bfd48,0x7fff5e5bfd54,0x7fff5e5bfd605⤵
- Executes dropped EXE
PID:640
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2380,i,10512848686355164027,2620220425168068019,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:25⤵
- Executes dropped EXE
PID:5504
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=2056,i,10512848686355164027,2620220425168068019,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:35⤵
- Executes dropped EXE
PID:6768
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2120,i,10512848686355164027,2620220425168068019,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:85⤵
- Executes dropped EXE
PID:5608
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3352,i,10512848686355164027,2620220425168068019,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
PID:6108
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3340,i,10512848686355164027,2620220425168068019,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:25⤵
- Checks computer location settings
- Executes dropped EXE
PID:6916
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3660,i,10512848686355164027,2620220425168068019,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:85⤵
- Executes dropped EXE
PID:5620
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4032,i,10512848686355164027,2620220425168068019,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:25⤵
- Checks computer location settings
- Executes dropped EXE
PID:4732
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4612,i,10512848686355164027,2620220425168068019,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:85⤵
- Executes dropped EXE
PID:6548
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --silent-launch4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2972 -
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x128,0x12c,0x130,0x124,0x100,0x7fff5e5bfd48,0x7fff5e5bfd54,0x7fff5e5bfd605⤵
- Executes dropped EXE
PID:5392
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2552,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:25⤵
- Executes dropped EXE
PID:5244
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1912,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:35⤵
- Executes dropped EXE
PID:5552
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2204,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:85⤵
- Executes dropped EXE
PID:864
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3520,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:25⤵
- Checks computer location settings
- Executes dropped EXE
PID:552
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3888,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:85⤵
- Executes dropped EXE
PID:6912
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3508,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:85⤵
- Executes dropped EXE
PID:2144
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4184,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:85⤵
- Executes dropped EXE
PID:4688
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4140,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:85⤵
- Executes dropped EXE
PID:5344
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4244,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:85⤵
- Executes dropped EXE
PID:6992
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4164,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:85⤵
- Executes dropped EXE
PID:8176
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4556,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:85⤵
- Executes dropped EXE
PID:6812
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4396,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:85⤵
- Executes dropped EXE
PID:7620
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5004,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:85⤵
- Executes dropped EXE
PID:7056
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4564,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:85⤵
- Executes dropped EXE
PID:5564
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5300,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:85⤵
- Executes dropped EXE
PID:7812
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5480,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:85⤵
- Executes dropped EXE
PID:6664
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5000,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:85⤵
- Executes dropped EXE
PID:460
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4708,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:85⤵
- Executes dropped EXE
PID:6560
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5008,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:85⤵
- Executes dropped EXE
PID:7156
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6060,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:85⤵
- Executes dropped EXE
PID:6276
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6064,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:85⤵
- Executes dropped EXE
PID:4588
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6100,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:85⤵
- Executes dropped EXE
PID:7036
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6508,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:85⤵
- Executes dropped EXE
PID:6788
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6668,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:85⤵
- Executes dropped EXE
PID:4484
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6840,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:85⤵
- Executes dropped EXE
PID:5928
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6708,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:85⤵
- Executes dropped EXE
PID:6568
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7032,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:85⤵
- Executes dropped EXE
PID:4500
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6224,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:85⤵PID:8328
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7000,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:85⤵PID:9480
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6672,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:85⤵PID:9648
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6232,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:85⤵PID:9848
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6832,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:85⤵PID:10180
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6996,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:85⤵PID:10200
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7160,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:85⤵PID:8648
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8312,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:85⤵PID:8756
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8480,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:85⤵PID:3052
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=8596,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=8640 /prefetch:25⤵PID:8324
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6236,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=8768 /prefetch:85⤵PID:1388
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=8952,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=8968 /prefetch:25⤵PID:9056
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=7592,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=9088 /prefetch:85⤵PID:9892
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=9376,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=9440 /prefetch:15⤵PID:6920
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=9404,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:25⤵
- Checks computer location settings
PID:5504
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=9920,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=9936 /prefetch:25⤵
- Checks computer location settings
PID:8824
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect5⤵PID:3576
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x130,0x134,0x138,0x100,0x13c,0x7fff5e5bfd48,0x7fff5e5bfd54,0x7fff5e5bfd606⤵PID:6632
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe"C:\Program Files\AVG\Browser\Application\AVGBrowserProtect.exe" --registration reg-task --taskintr PT10M --runonce6⤵
- System Location Discovery: System Language Discovery
PID:5668
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10520,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=10548 /prefetch:85⤵PID:6924
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10612,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=10660 /prefetch:85⤵PID:8092
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10616,i,7077852495736902830,16557627751484828501,262144 --variations-seed-version --mojo-platform-channel-handle=9884 /prefetch:85⤵PID:6848
-
-
-
C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level4⤵
- Drops file in Windows directory
PID:7748 -
C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7b86ae9c8,0x7ff7b86ae9d4,0x7ff7b86ae9e05⤵
- Drops file in Windows directory
PID:9104
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
PID:8268
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exeAVGBrowser.exe --check-run=src=installer4⤵
- Checks computer location settings
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:8736 -
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x124,0x128,0x12c,0x94,0x130,0x7fff5e5bfd48,0x7fff5e5bfd54,0x7fff5e5bfd605⤵PID:8432
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2428,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:25⤵PID:7020
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=1980,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:35⤵PID:9372
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2160,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:85⤵PID:9704
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3368,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:15⤵
- Checks computer location settings
PID:9024
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3372,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:25⤵
- Checks computer location settings
PID:9008
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3988,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:25⤵
- Checks computer location settings
PID:7828
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4088,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:25⤵
- Checks computer location settings
PID:8816
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4808,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:25⤵
- Checks computer location settings
PID:8832
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4856,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:25⤵
- Checks computer location settings
PID:8876
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5584,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:85⤵PID:9748
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
PID:6796
-
-
C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings5⤵
- Drops file in Windows directory
PID:7216 -
C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x250,0x254,0x258,0x228,0x25c,0x7ff685bfe9c8,0x7ff685bfe9d4,0x7ff685bfe9e06⤵
- Drops file in Windows directory
PID:5592
-
-
C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\AVG\Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=0 --no-pin-startmenu6⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:9312 -
C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\chrmstp.exe"C:\Program Files\AVG\Browser\Application\131.0.27894.265\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff685bfe9c8,0x7ff685bfe9d4,0x7ff685bfe9e07⤵
- Drops file in Windows directory
PID:9488
-
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --enable-protect5⤵PID:4492
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVG\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff5e5bfd48,0x7fff5e5bfd54,0x7fff5e5bfd606⤵PID:8988
-
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5724,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:85⤵PID:8476
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=6404,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:15⤵
- Checks computer location settings
PID:6564
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 has-startpin "C:\Users\Public\Desktop\AVG Secure Browser.lnk"5⤵
- Checks computer location settings
PID:9944
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6708,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:85⤵PID:9512
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5024,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:25⤵
- Checks computer location settings
PID:8972
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=6948,i,935078000819121033,700842768658144861,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:15⤵
- Checks computer location settings
PID:5236
-
-
-
-
-
C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6420 -
C:\Users\Admin\AppData\Local\Temp\aj2AA8.exe"C:\Users\Admin\AppData\Local\Temp\aj2AA8.exe" /relaunch=8 /was_elevated=1 /tagdata3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:6400
-
-
-
C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6916 -
C:\Users\Admin\AppData\Local\Temp\aj342D.exe"C:\Users\Admin\AppData\Local\Temp\aj342D.exe" /relaunch=8 /was_elevated=1 /tagdata3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:5588
-
-
-
C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:6940 -
C:\Users\Admin\AppData\Local\Temp\aj321A.exe"C:\Users\Admin\AppData\Local\Temp\aj321A.exe" /relaunch=8 /was_elevated=1 /tagdata3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
PID:5496
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8116 /prefetch:12⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8380 /prefetch:12⤵PID:2532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9368 /prefetch:12⤵PID:4704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8616 /prefetch:12⤵PID:6244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9468 /prefetch:12⤵PID:980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9348 /prefetch:12⤵PID:552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:12⤵PID:4588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9620 /prefetch:12⤵PID:4688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9800 /prefetch:12⤵PID:1168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9968 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10220 /prefetch:12⤵PID:864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10212 /prefetch:12⤵PID:6888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:12⤵PID:6920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10648 /prefetch:12⤵PID:6900
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10780 /prefetch:12⤵PID:6904
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10924 /prefetch:12⤵PID:3676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10080 /prefetch:12⤵PID:5480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11244 /prefetch:12⤵PID:976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:12⤵PID:5132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11268 /prefetch:12⤵PID:5484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11296 /prefetch:12⤵PID:6052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:12⤵PID:5140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7912 /prefetch:12⤵PID:6640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8588 /prefetch:12⤵PID:7280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:12⤵PID:7560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6968 /prefetch:12⤵PID:7580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:12⤵PID:8136
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=11804 /prefetch:82⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9040 /prefetch:12⤵PID:7744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11688 /prefetch:12⤵PID:7832
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8864 /prefetch:12⤵PID:7884
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8908 /prefetch:12⤵PID:7892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11664 /prefetch:12⤵PID:7916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12176 /prefetch:12⤵PID:7924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12304 /prefetch:12⤵PID:7932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8820 /prefetch:12⤵PID:5156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10784 /prefetch:12⤵PID:1392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8360 /prefetch:12⤵PID:1952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8824 /prefetch:12⤵PID:7408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9660 /prefetch:12⤵PID:8076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8748 /prefetch:12⤵PID:7308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12964 /prefetch:12⤵PID:7352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12772 /prefetch:12⤵PID:388
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8036 /prefetch:12⤵PID:5692
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8672 /prefetch:12⤵PID:5648
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8188 /prefetch:12⤵PID:6872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9472 /prefetch:12⤵PID:1916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:12⤵PID:7224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12316 /prefetch:12⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9716 /prefetch:12⤵PID:7924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:12⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 /prefetch:22⤵PID:9636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8724 /prefetch:12⤵PID:7624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:7228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10024 /prefetch:12⤵PID:3212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9156 /prefetch:12⤵PID:5452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:12⤵PID:9592
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9164 /prefetch:12⤵PID:6680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10432 /prefetch:12⤵PID:6224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12360 /prefetch:12⤵PID:6816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:12⤵PID:6872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10608 /prefetch:12⤵PID:4180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:12⤵PID:5268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:12⤵PID:4100
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12460 /prefetch:12⤵PID:4536
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10644 /prefetch:12⤵PID:8820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:12⤵PID:6788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13212 /prefetch:12⤵PID:5452
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9464 /prefetch:12⤵PID:8812
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:12⤵PID:8728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8280 /prefetch:12⤵PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12528 /prefetch:12⤵PID:2676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10960 /prefetch:12⤵PID:8212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12176 /prefetch:12⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7636 /prefetch:12⤵PID:4296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9856 /prefetch:12⤵PID:8304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:12⤵PID:10044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12496 /prefetch:12⤵PID:9428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9840 /prefetch:12⤵PID:2416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11008 /prefetch:12⤵PID:9960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12152 /prefetch:12⤵PID:2512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=130 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:12⤵PID:2276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7628 /prefetch:12⤵PID:9296
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=132 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:12⤵PID:7552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:12⤵PID:3564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:9500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:12⤵PID:9332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12400 /prefetch:12⤵PID:5708
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8644 /prefetch:12⤵PID:5724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13284 /prefetch:12⤵PID:6860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=13300 /prefetch:12⤵PID:6680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10056 /prefetch:12⤵PID:6996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:12⤵PID:1232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9848 /prefetch:12⤵PID:6672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:12⤵PID:1768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:12⤵PID:3032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:12⤵PID:6740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8276 /prefetch:12⤵PID:6796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8020 /prefetch:12⤵PID:8408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:12⤵PID:7036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:12⤵PID:9476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12372 /prefetch:12⤵PID:9280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9300 /prefetch:82⤵PID:8676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10576 /prefetch:82⤵PID:3400
-
-
C:\Users\Admin\Downloads\MinecraftInstaller.exe"C:\Users\Admin\Downloads\MinecraftInstaller.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:8228 -
C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe"C:\Users\Admin\AppData\Local\Temp\GamingRepair.exe" scenarioMinecraft3⤵
- Checks computer location settings
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
PID:4944 -
C:\Windows\system32\msdt.exe"C:\Windows\system32\msdt.exe" /id WindowsUpdateDiagnostic /skip TRUE4⤵PID:8952
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeploymentServer/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeploymentServer_Operational.evtx /ow:true4⤵PID:6412
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppXDeployment/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppXDeployment_Operational.evtx /ow:true4⤵PID:9176
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppxPackaging/Operational C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppxPackaging_Operational.evtx /ow:true4⤵PID:2676
-
-
C:\Windows\system32\wevtutil.exe"C:\Windows\system32\wevtutil.exe" epl Microsoft-Windows-AppModel-Runtime/Admin C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Microsoft-Windows-AppModel-Runtime_Admin.evtx /ow:true4⤵PID:2692
-
-
C:\Windows\system32\wscollect.exe"C:\Windows\system32\wscollect.exe" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wscollect_gr.cab4⤵PID:10044
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SIH" "C:\Users\Admin\AppData\Local\Temp\registry_SIH.txt" /y5⤵PID:5876
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe export "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\DnsPolicyConfig" "C:\Users\Admin\AppData\Local\Temp\registry_DNSPolicy.txt" /y5⤵PID:8472
-
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_GRTS.reg /y4⤵PID:6004
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKCU\Software\Microsoft\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_GRTS.reg /y4⤵PID:5376
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_AppModel.reg /y4⤵PID:6568
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_AppModel.reg /y4⤵PID:9676
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Appx" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_Appx.reg /y4⤵PID:7804
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKCU\SOFTWARE\Classes\ActivatableClasses\Package" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKCU_Package.reg /y4⤵PID:8976
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\HKLM_WuPolicy.reg /y4⤵PID:9680
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServices" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GS_Service.reg /y4⤵PID:4764
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GamingServicesNet" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GSNet_Service.reg /y4⤵PID:1652
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameFlt" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameFlt_Service.reg /y4⤵PID:7840
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\Xvdd" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\Xvdd_Service.reg /y4⤵PID:9064
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblAuthManager" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblAuthManager_Service.reg /y4⤵PID:8388
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\XblGameSave" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\XblGameSave_Service.reg /y4⤵PID:9524
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\GameInput Service" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\GameInput_Service.reg /y4⤵PID:3164
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\DoSvc" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\DoSvc_Service.reg /y4⤵PID:3332
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\InstallService" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\InstallService_Service.reg /y4⤵PID:4732
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" export "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" C:\Users\Admin\AppData\Local\Temp\DiagOutputDir\GamingRepair\WerLogs\wuauserv_Service.reg /y4⤵PID:10084
-
-
-
-
C:\Users\Admin\Downloads\MinecraftInstaller.exe"C:\Users\Admin\Downloads\MinecraftInstaller.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2380
-
-
C:\Users\Admin\Downloads\MinecraftInstaller.exe"C:\Users\Admin\Downloads\MinecraftInstaller.exe"2⤵
- System Location Discovery: System Language Discovery
PID:6708
-
-
C:\Users\Admin\Downloads\MinecraftInstaller.exe"C:\Users\Admin\Downloads\MinecraftInstaller.exe"2⤵
- System Location Discovery: System Language Discovery
PID:8400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=154 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10576 /prefetch:12⤵PID:8868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=155 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12416 /prefetch:12⤵PID:8844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=156 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:12⤵PID:6720
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=157 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:12⤵PID:9456
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=158 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=12336 /prefetch:12⤵PID:9736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9840 /prefetch:12⤵PID:6952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=160 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8988 /prefetch:12⤵PID:5316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,10025399774124269869,15069317441943949583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:12⤵PID:6600
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1016
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1120
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:6752 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{1E468125-1BA8-4C94-8579-D9E12D947E42}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{1E468125-1BA8-4C94-8579-D9E12D947E42}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:6396 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{1E468125-1BA8-4C94-8579-D9E12D947E42}\CR_3A349.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{1E468125-1BA8-4C94-8579-D9E12D947E42}\CR_3A349.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{1E468125-1BA8-4C94-8579-D9E12D947E42}\CR_3A349.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:6340 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{1E468125-1BA8-4C94-8579-D9E12D947E42}\CR_3A349.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{1E468125-1BA8-4C94-8579-D9E12D947E42}\CR_3A349.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=131.0.27894.265 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0x7ff7b31fe9c8,0x7ff7b31fe9d4,0x7ff7b31fe9e04⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2588
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
PID:6824
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
PID:7580
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x324 0x3cc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5196
-
C:\Program Files\AVG\Browser\Application\131.0.27894.265\elevation_service.exe"C:\Program Files\AVG\Browser\Application\131.0.27894.265\elevation_service.exe"1⤵
- Executes dropped EXE
PID:6536
-
C:\Program Files\AVG\Browser\Application\131.0.27894.265\elevation_service.exe"C:\Program Files\AVG\Browser\Application\131.0.27894.265\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5804
-
C:\Program Files\AVG\Browser\Application\131.0.27894.265\elevation_service.exe"C:\Program Files\AVG\Browser\Application\131.0.27894.265\elevation_service.exe"1⤵PID:8380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:240
-
C:\Windows\System32\sdiagnhost.exeC:\Windows\System32\sdiagnhost.exe -Embedding1⤵PID:4284
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
7Software Discovery
1Security Software Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28B
MD518330208ef6aab76efbb3a2f5074711b
SHA194001289de5db8513ddda6dc0cc4a5a9236479d3
SHA2563aa0aaac67bf9f5ae6ff29f44303897fec3d0a56d508240d909ebbce273c40ee
SHA5122a47dec6bcbf06aebee24e6b8997e14fc9f2a26ca78df714459021015778e3d0190c5f6a02271ff01e3a5763d078f5a9384e97d888b4d495c3981923202b0269
-
Filesize
28B
MD51df27529705e8c503920b840d5f85e3b
SHA18524f61e878f625f93ab3cabbe7547a6d6d7abe1
SHA25617031e89c51bd58bfc6659743b5ba5b721e165b9beff3214766eb21f66e73c50
SHA51262d0c639479bae5265ee3ceb58f61d3c248aac2657ec0fcd990d48a4a8943732ba51c05d2447d42776f6e45668bba68ece3a2267305f34f7e07a1a63fef9488a
-
Filesize
28B
MD5f80679f03911d2ca01cfa01350dc5350
SHA16cbcbf1b5b4f09d62b25f7b97e007d8f8b8b812d
SHA2569cd4f38c8d6db5adf0cb3ffb3fa178d448d2c87b8f68384a27b31bfe7bf470c0
SHA51259c91e054c32c5da8c78f1f73b806f338defbfb970937975eec5b48ce314e19a35744a762af1db62a99cc75db480603ace92af53aba6f91303c18e86e2d6c9f4
-
Filesize
27B
MD5fc8ee03b2a65f381e4245432d5fef60e
SHA1d2b7d9be66c75ccf24fcb45a6d0dacedd8b6dd6f
SHA256751a04263c2ebb889fdcd11045d6f3602690318ebaaa54f66e1332d76dde9ef4
SHA5120837f2b22c9629990165c5e070e710a69ad4951b7fcfe28bd52354c4b8a7246672497b8aaf521a8773c7ec2a4249fc4318330948ab0d8db8c6c74da57b32f1c4
-
Filesize
40B
MD5cc326d3e6bda34974e70988ad066d4d9
SHA1c41187f29eaf7de965f2cc25c8b3d5b408564a20
SHA256bbcc579fbc2b437ac06e936bccee59639d4e9f482dd904ce1377cbaa81246033
SHA512a90aaa991c97a9418cb467aa6dcb3b97983de47fe12eab15d996f0673b515030449d6ea97ed4db2e3c5faec8610d49768d4ea0115385c70766dd8c40c48ffc0f
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
36KB
MD52c38ee9e9b0c4739e3833c648ac60cdd
SHA1c6ee9b675ca4ce98a5f25d0c8246265da6db85de
SHA2561fd8901bc4fcb62fdc74190623f31594fc66fecd7faa694a37f06409f6eb3518
SHA5126e56f96ec98c359feb2f350de8eeea377135c592108d2949a1687c70c3a2281a21a9339243ff72d0503cf761b0ec039ebd6a802ff878c93213a418d6a686e602
-
Filesize
39KB
MD59a01b69183a9604ab3a439e388b30501
SHA18ed1d59003d0dbe6360481017b44665153665fbe
SHA25620b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
SHA5120e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
-
Filesize
72B
MD54f3280558532e3a1c2fb0762f958810c
SHA1dc797d055051f06b2f0f5f3fd2349b966c710035
SHA256f9876facfc7d4720b856611f9e26037ab743707dc7dc175a011b8770539fd415
SHA5125a5a65cf5fbfceb51de5aadbf8f828ca11f69b10dea0d8b64ef98553443d378fcb893428b2d1a4237e9e5ab7bd9a8da2b2a846ee6fea48b73d0866d219e7485f
-
Filesize
120B
MD5aedb26e0580a70f26c0ce02eb7d07856
SHA1e88c1cf067d52873b07cba651b0b250b6f8d5724
SHA2564a0c58e005a105a6120db4e10c801f290688e582954337d71d29f9cbd2c92580
SHA512047252a1dce666331912970d61d33c5e3ae2350049c890173bf3bbf2208c772dd62b98fa7cd16f417bc31cf1c5b4dc065c860bcf9668b42f1f2410a2ae00af60
-
Filesize
384B
MD5fb24032898b6b36f0c9cc87c6dd8d60e
SHA1a18ec163e32d13394c340da76c2b75ea1458bab8
SHA25657d4217882cac303d49a569f0380d955235dbb86a6896ee86ba6ef1fc05ad79d
SHA512e564dddd091b0e697bde22ab8a3c426edc8a85831b3d7c8019b8ad7d7f692877e70ee4d02b51ee7ae5d0d28586378e9f2cee5e71a7b38d823432bd9b6a8354e9
-
Filesize
360B
MD5b6847fb274808fcdeb8106723f79a473
SHA1d7407070ef2e428765281eddc91d7a3b5d01f291
SHA2561dbccb0bba15a6cb49fc6db39c959d64b8950424b7a1423529a65a8395d1d957
SHA51219a06bf02cf3db968c9cff08ffa1110666dd8281e919655b9a8afc1212f6e2f79008e219e4a9b5196c3bfdc01feb4dcbc2ed62c523bc65aa36765e075e7b9b24
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592929.TMP
Filesize48B
MD52b51a987c3a0b663d3e7375b6ff60326
SHA1fdbfb6db6dd36c1e2ad56e1428b2762563788494
SHA25693927ea1b8832d2c97865b3d0dd28ef427016f37e95b8d3238e8a03e8422bb6d
SHA512bd1d8dd4ea3de6c276bca08ba078eb896d65ba19e8aac97b8f6958c5e90ed07a24e2885bd0f1d4492b469b23828c2b3b6d852fa2e5e5e9880f8778695fe4943c
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
256KB
MD596a533e5943b84b87f0318f85318bae9
SHA10b231062762975ff1fa7d286eb15c71c4220f3a8
SHA256fad5db5858569eecae16af17fec26131f97b27d6ffe8b25a0dced94666e2f10e
SHA512bcdcc6d830d65e094bb511684c1ebe47d5a067af0dc31954efd697c55a01f47d927d82a145d3fcdd821e22b911a86d7e606a1daee51fe59f272188db12ae5c95
-
Filesize
2KB
MD56efbd240869038ee73b7e5a7410bf7e6
SHA1fcc4b522c81a2734c085ab65af12a77c0fbb0cd9
SHA25617c14d25b0aecf04c3f792149503b8a575557b1e9b1b67e8d6e9ba995b596efc
SHA51213520182890c5b44729c25493198aa270ef1736abf4de0db9ae35b516726d91d60832dc91dcef0977af1f09842a52f1cf6df6d58256a6c79bcb2ab7430bcc624
-
Filesize
2KB
MD55606897a3c761d454506c69cc2739f78
SHA13804adfda39d4f8039dffef8a85af72338ba548d
SHA256aeae3bbb0675d01352db03ed99dcd0786f11d9df09af2419b437c518354536c2
SHA5125e210887c373b892a6036182d61678a416b8b118d635f3497e8ef99a6f8f00e0812b313e054ff1e55465d6934d216783a3e84306bf64490014724cc76638b4a7
-
Filesize
750B
MD5b789e60b52f72123f1c00bad72c97347
SHA1a1c374c97b5c788de2cd6f7937ff1a5c352fc360
SHA2563521781bfae789bb5cafa5de9d289deed27e7bd56eb5028262f6ab0616ad991b
SHA512edd8fdc2e1c753e7117ee31544e12bd718a3a51b4d87642460237ac6acb427c506f2149b43cee4472dc911299c1d31c518e26861f62124c0a20ff07489b369b7
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
521B
MD579da308c03cd2d831f2061445457adf9
SHA16e0a1dd4d6f34ab68177604515ac2df7c2ce2294
SHA25659ce8038fb49d4e2b5e1ca21341fdadbd7bae4dc45931b68db28a88b12259935
SHA512d436c6030ab57e3ea852f188a27c3cd7fc3ac89cf70d1b96f69624dbb568b6ddf83a37485b898efb7e2570abe6fd65f1f7038c0714aaacd447ffc6eec4eb005a
-
Filesize
517B
MD58cca0a4c7a7f5cc460cb2bc190f34b3e
SHA107991bcd4f296eaa0ef575b2bd0eb6bb4ad27c3c
SHA25647014860bab23fa09cf191082ae7241be336ab09948cd1e83688a7d455f5aede
SHA5123b5f197eda616bc229b49ee7062edd997b7934597d1c98122f86bc93aa5792778ef2249c82f07fe394cdb4de955a32f43f015ee96692c65977804904d74a5db3
-
Filesize
60KB
MD559009ef980a1c4a6591ab9ac4d898e00
SHA19c2fd7cf637f7e5f0132f66d1ce3fa7e1827ad24
SHA2567bc3917dba26777d28691bd0d939a17b95a182ccf2a3b82dcb5fe6c48e3b7ea1
SHA512ddcf6bf016d66660da595ae2e8b075634ea6c418692b0a6fd55485dd0a908bf95b21a327da7b798ee9bb4d7261484765049c2f831f44e8766b3a2c821483e367
-
Filesize
59KB
MD5366e58ac19dd46361a23611d175c4f09
SHA191e208e8e3cd89c08b41642118c2202837beff91
SHA256bbedf4611eb730a19d759c41eddc239757fbfe7f383f97c20cbaf9d6db75c8e9
SHA512bb1462b05e0480d817bce5d88839bcf031d256404160481473068c12896ae9d32af53070310042c2a2dc0ef2e43cefa460fbcbdf667fe8346d73d63958f8043e
-
Filesize
49KB
MD5301a0c2cc2f10178f21833f349ed987d
SHA133df5a8c572406e00fce5e8ebc37bd949c8801ea
SHA2561f86cd1802cedab6dd218dad7e959e4cfd9d8bb960776bd65bd536e01573a450
SHA5121423242a33cf94a828c2b6bbeee81f69134c284fa543be0f1868a34b352c349b352f6d484d68cc4f4bf2b3d8d3083a9990a80b092a5f8ed65dd8654eba7af595
-
Filesize
57KB
MD5e451d4252c301ca886b496ac784c42c2
SHA16751268946867cd782894d5fdcf2e928c1408b1c
SHA2566023594fbe67cdfc00777bcc900a244997dc04a4189567fc5752af26034fa921
SHA5123ddef648b2b712ab42af72f4150e84d09b88be5fc64d4a12e1cd5906e6bb84235ce331bb317baa05e20744ec620fc8c29d39bdea62e2964e5386de95db2e0da4
-
Filesize
3KB
MD5f10098644ffde84d3cfdc250486b06a0
SHA113264329049d1025279f86ead7d7176759e15abc
SHA256b39a3c0d563c6fc9ad00523dc3c10ee7b224446ece348be1a50ca37998650ca8
SHA5124c89461cbdee3136c18219f8413a0749b4ec1a613a92b73efc115341614b740b0e522f5bb38c17a59ff6a31a943620363518c905ce06d949439854978f6403b2
-
Filesize
34KB
MD5f565e2d0cd3538a2f6cc8c277b3a9f01
SHA1b1af4b687a808f42e8217e255e6bc0737c00b1c8
SHA2565ebb5fc3940333d52da94033ec6db5fd86fc7c7f18092d4a6c9269287dae8d35
SHA5120acd29e742f5c7549a2f520eac04d501c23106037c7c6345ecff71e4d65b055164b3e6077009bc48a49e669574040eae2075d2e73487dd46c45eac64eba6a7f8
-
Filesize
33KB
MD57548619867b039a8ebb93c0c5c74338f
SHA18d08360a9a9885779715407541a079771d7605e1
SHA256004258b25ce8795971053da9d69d7ce0dcacd828330d711d19fca9805485535d
SHA5128b8c62f025b0f40569d9d94f7b72b246bc845a9c548fc476a4abd016e0124ea3ef61a299cb2d1902d298dd2b22f99bfc6dc10baa60d2a586bc5ffa5f97d8bb56
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Service Worker\CacheStorage\26cc8f430c37ca3e66a8d3408a02dcaa5fad402e\2145c3ab-ea9e-466a-a74e-1b7a58c3b9e7\index-dir\the-real-index
Filesize144B
MD5b28ac28ba26fdecc0f1d2dcede0daede
SHA1b33b1204ae0aa6673c24620b7ddc739432bb2dce
SHA2566fb96d92c5764c461c50bd5107a240fda86b4dc1e793a1488bf0f5668c41ad2e
SHA512a11dd1bad0951f04b9b51881563c63f6aad8cb71ae6f25a5ec8db857bc7e89f1578a2b422ca3f1393fe2418ee535618755343e8970282090f8fb2a078360b146
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Service Worker\CacheStorage\26cc8f430c37ca3e66a8d3408a02dcaa5fad402e\2145c3ab-ea9e-466a-a74e-1b7a58c3b9e7\index-dir\the-real-index~RFe5ac8df.TMP
Filesize48B
MD5f368c2d84b01ed6061549a6de5cefca6
SHA144019b3d8e582afab2f7f6f89fb00c243cf41e6b
SHA256a4f51569cfd3aa01916c46c200ef768896139044135438cd8913fd9bcfafc128
SHA512617d063376c8dd661de6cb1683eac6b08b0653ea9f481d790d166d2c0d41b6813c4957f114509498ebcd11c48a7d2e76011b4c00c69063754fcf2748a4683bd8
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Service Worker\CacheStorage\26cc8f430c37ca3e66a8d3408a02dcaa5fad402e\index.txt
Filesize150B
MD52ce4eb7b21f4e7deb9a3115808d7f342
SHA1afffdc248d14f6dbac1fce3268fb6a0af86a4799
SHA25690fbd12d7e7b6773533f33e98a9525cbf0ed1c4606005b8e892b8c822aa83fea
SHA5121964695db0a9e9aa9de592726a06e21893adc1d0634e3e9166fd92f2948936bb7b7ed8ad8685496d6a68bfb24b59ea988513af101ab618493ddfcb9a4f81312d
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Service Worker\CacheStorage\26cc8f430c37ca3e66a8d3408a02dcaa5fad402e\index.txt~RFe5ac8df.TMP
Filesize155B
MD5063bc30fcdba846d559d7de7142b4211
SHA1cb5810cfb0ea72ebdf2ca9f2539e6a2c92aab5bc
SHA25639c9246c45061cd0384b3431302baa352badb0100592bd684f94e8a3f42da9c9
SHA51238a6a5c7b3e2d9fb45df77950d4b93aa770d6d4d1f59ed38e8c0703078160be4c5aae70fdfee2917a4aafd60c2b7e9a9bf79f77f737cdab51e35d30330b4e73f
-
Filesize
24B
MD554cb446f628b2ea4a5bce5769910512e
SHA1c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA256fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
SHA5128f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize144B
MD54634c7deb4ecb476207981997b4bf23b
SHA1077e2f4b838e756d89816ffeca292ced277f4a68
SHA256365158ce7dad501dd8613b163771965c5c904b84472b27bd5154a21e6d13e9b2
SHA51228788f964b09dae5491bb3a5edc6c1f2179a415dde1432c573cf534fb36392916c431351c54eff518c8c8dc76eb9af2068dcff774c01dbeb21d0e851292b3bc6
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD51cfc3cf82af0271e14b9a8147fbd82b2
SHA10c45af20673e2fd715cc533c55d1438305445fea
SHA25629ad5270b4e19e49ccf167fefbca755464a9f8533f68476710d5272fd653e93d
SHA512d532a3d3852164f0f1f6e3d212347800386a342aed0c5886cbaf620d882e78a8418cd97fb837dd71bfe6b04dca4aac51d9e9551bb3cbc2945460cc1a82693827
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize120B
MD582ba8ef4fd88107bb0bd9dbbe1b61f19
SHA10973d7f472f66f9225d5057af79191028c583391
SHA256e48448db1b6e68b43cf37bd6bb7c46742f797c907e4a1cca1c1847a6bdcd9732
SHA51239ec47f2271f564c57cc1f4f6ae443b8d17579ea45da876afc9da5feb79f68754cd576498f389264361c41d17ad3333ad1e65ef0d793910b5735b6afe7af5f6e
-
C:\Users\Admin\AppData\Local\AVG\Browser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59291a.TMP
Filesize72B
MD5df65f2e64b0acda2dbb38993a19a6076
SHA1f81eb3356f19a81655f007071b21a5c8665bafc8
SHA256fa6f478051c18b2569fcefda34841e9c7c26bc87072ec41fad09f19e107972c1
SHA51227bc926042f1d9bfcd53e05a5fa3a68a8877a4f6e5df0e5a68e08acaf487a0890e7c62d48dcc57752e8f1a7d15f7431654a213a7e93d5e7cd993ddc2ce5a7688
-
Filesize
168KB
MD527e0a973f1449e90508c04e5a6a5b86e
SHA1a73aeda6a24c88cd513edb51fe82057888b33e31
SHA2561a1d3f226e1b5d6b13a15080b67865bbd624d8bfd9c4f8a2f7e35b029c6b39d0
SHA5128724eced195065a2bbb38f3fa940ae8b66202690e12fdc598a669574ffaee36d86a32e7fc608b23c83715f7859e6cfb556cc659181f7c90178b7241240449679
-
Filesize
414B
MD51ebeaf60a22f519a4e2afeed7a646017
SHA177f4c997db9d728b694ca113f6c99aeb6b12be15
SHA2560820e597d5638d2fc6ad55b86c432cad5f9be937a2ceca6b9b79e032383cdbe3
SHA5129ce9d78987eae604d0ad18ffe313c886907976137be490173946ad44a0ca1e7915d1617edd15bfa6b960db76a9f5459a851a78ae2fada8a2c5c8f73fe0a3dbd0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
9KB
MD5900afd931f540b9aac5165930c7dda8f
SHA164fd438624a324834e5480120859e43c324b22de
SHA2564ffa14b0f3fa573a1514f780ed084f9810d604b886ad5dddde647488b574d581
SHA51254cc527a8f12b9570ce16ec91682916e97e614066053f96ebe0a97b8a93cd1ab5dc6fd80c7661a9cad5f586f0d21752991c53d2ff47d2212dcf55987ca832e0e
-
Filesize
23KB
MD551c6d102b1388b6ce4ac9a3e03d8a201
SHA1daf0be55b7f64518f1c17006813bc875c508c62e
SHA256760a117d6a79148da23b4a62be40700dbe643d681b280f26fa1a889088ac506d
SHA512a03aeaa768a6a8542c4a766d625230529b704cb77cc98ee139a4475165f2ceb717465190d779b7c2daa9e4d8b1c837c8e5469deec91335bb8bddabea98db967d
-
Filesize
30KB
MD54e6b9903e6222e26597b46acb16469da
SHA1e937e5d3a9bf390e4785f18a1bee1ff0409944bb
SHA256431433a015910a76d51182b8d4c239fff83e086b8182b90624ff6bd343beab06
SHA512eee999f2861ebaab6fe25ecfbe13b768feb025d43ccf70cce7a07bc2212e19a87ab5b809742e3ff8df7303288b44367a3ec912f7a76a5fae096ec53f25aa8e17
-
Filesize
7KB
MD5bf18a4244816d797f737b058166deb22
SHA18452757cb38752f3a283b5b850fd1e5ec27b3c9c
SHA2562e74fd693ed142641587ad481847bae47a84d09fb0e5374dabbd395430901cb7
SHA512fbb5e07b6976964383c084f2e629a067f4e106e18ef2cd2d9b617aede99fb6fa966eeafd3ad4bb1d6e1c2ccf9ba61e91726817cc6c3d56f88c1dd9476017344b
-
Filesize
8KB
MD5c387c2da80e842d7ee7e7143a60da5d6
SHA137339ed2e727effcf426e99b1be3b594e1d0995d
SHA256977bcdf3cca3d1c8aaaff71b2e54a434feda8d8cbe20f83ddf92de49da8d9ea8
SHA51218870696a5db6104b246442aa2d5d0ddd846b51cc03d6ecd8ae21a98eaf0904da49aac7b64f0a58c51c50885cd777458b1314f9f1f7ece1e1ca9ec3ab78aae93
-
Filesize
1KB
MD5b02aaeaa47aa997dba2ed993655764bf
SHA13fc8fa536e6c6b1014f2a52946bfca9f839054e5
SHA256ca71e40f9503e7e4f29a6534d9caea7280aae69d98bdedd17aecc60a0589fca6
SHA5129e6cda6916fc4fc2f0d0a126320c9ed481806f84ad7bd9b65eaf1852c67b2bbc616cb3ae4b96054da000892411d3f31360cfc3022ae0e7ee583a07c50d909837
-
Filesize
1KB
MD5039fd8b432e0d60de70f2a69759a7b54
SHA185998754c9154c60a46587895e3db8755b35816f
SHA256f4b85bd81811114c70002f48977f02c9dec80e9a4ba0d502d376520b1b4d4aab
SHA51278cd6dc85160fc22bbf19b3899c6693eadb56e2af9e9b41e22dfb38229202c196613538077d1aa9947da9295b5ebd22e8b2629ab743409743232da390f4aa794
-
Filesize
152B
MD578789c91e16d10f550331b6172ea4751
SHA1aee25d6d200d75e8a0f753f888d19545278999c6
SHA256b91a0fcd45635ad28ba63d3c214d22a8c58f33965a8fff5aa72bff0bbe65fb24
SHA512ba1c51d05f1165e2044b94edf8520af3c20bde4eac62b730714da8a484ca691fddaa2f436debf78f60c4e60aab2f4cb2ced8448531b3bf2731d206af4863f815
-
Filesize
152B
MD520ce33649b0aa2e62230849d9203743c
SHA10a13c95b6bfec75d3dd58a57bdb07eb44d8d6561
SHA256482bd738c304fb1f7fafcf92f313f1faccf57164c944c38ae8d6d4727164d72c
SHA512332cf2a0a7fe494643b00ca829d0f49e9f0835f158dbc37ada16564a55eb60ccb1cee20e91f1caffa0a0229b85e43da41f508a356c36d9109cd8c3beae2a5620
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5daaaa6a-3740-407a-8ef7-c896d85f27fa.tmp
Filesize9KB
MD5fb7fae1b54ed92b44d13058c038baa2b
SHA190dba614e843dc1e70ed35b21b0d8f648bebf069
SHA256fc8e3b0a8fcf471f41d38c3742af03225e6fc4a7046da5c25f83d47015ff58b1
SHA512a995def55847983c998f3fa37f7098152f5f8f981419108f9761aa14981c32e4eee2790c0f721e5d5179ceb82f33076c2f8fb530df408dad11db608611799f8e
-
Filesize
21KB
MD543aae636c1198da1d475a245d2d9acf2
SHA1ce45559167d95ec6dde5903fbd0fabed62ce5478
SHA2569b65fa7ed0b5f478acf87370e34b5d98f77712fceb1caff78d394c98f30e5f78
SHA512deb696c6f017c30d7f5f75e1fa0671c6594c9a24882764e0bcb923626ed1c0ecb932e6ceac4121bb355944350273a42867186ae6020d0680919528ffd10cb74d
-
Filesize
152KB
MD566653ec126b1ae2862fd720f7cab6e2c
SHA1686dcf9dc0f69697c85184ee953b561e47e1377c
SHA2568235c4f81f018598585920ff6bf83bd462dc91458de6658215d603e78c6c9834
SHA512b602ba9787c60644dc290dcdd2c0deac318895d854b52b6fbed322a46fb3ceed079d07068cfcefee1966fdea8b20c1061a37081424302389246f26129b434bbb
-
Filesize
155KB
MD510a933ab55624488b948d4826026b95f
SHA1388d4dda9fff21372b7ed88993a394ecab274ff3
SHA2562891a30a522da8283de9b8a483e46c2511de625036fbdd533316b85a4cfaa836
SHA51290657231961cd791729e2f3e60e7046a2d54b1fae3cd59227abce2a57a7b7ad625f8208dde0b5bd853d9ed7e7d105c31293ab53e656922d96ea16fb0b3650873
-
Filesize
127KB
MD5e9afa062f54f4670681a7be765a2925e
SHA1a17ca700c62fed437b7392c8be506997edc67a92
SHA2565f4cbf776902e47e07b38055b0eb7fd738f362891b36e827338bbe7887c5dc0c
SHA5122ed36437fb0023b411a6f6fdb98c910b6478bd773bb817e95ee885a399e613c57d93ae822545769c8120ad91214a7b8449a1741e7bb316834956fcb5310b4063
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
28KB
MD51752326ce45c039f4c5e81ea24c27c35
SHA14a22a9151c3c94d170cd3d23659e8e1a5a6f0070
SHA25613dac981c708b9d1c6d7be7666ab5ff34718fe7d1362428217e88c75530774ad
SHA5127ca5eb8b11184b97b7ecfed373420f7b9926839edcd36ea6bcc37a09190478175c49d7cfdb6dcbf1ecc8f2570feec9a0ac8aae08442fddef7986330043ff2d08
-
Filesize
16KB
MD5bd17d16b6e95e4eb8911300c70d546f7
SHA1847036a00e4e390b67f5c22bf7b531179be344d7
SHA2569f9613a0569536593e3e2f944d220ce9c0f3b5cab393b2785a12d2354227c352
SHA512f9647d2d7452ce30cf100aeb753e32203a18a1aaef7b45a4bc558397b2a38f63bfcfe174e26300317b7df176155ae4ebaee6bdf0d4289061860eff68236fe1bb
-
Filesize
20KB
MD553c586a5a2e0e782493c4a650f725ad9
SHA1432613a19a1f59b003a88d9818a6f16183ae5f14
SHA2562139c9382afa8175a5fa0fe7bb616b8efacc4a2dc948d929ee17e482f765deab
SHA512dec372f1e592f5d4e63498fab90fb059b2802de9938f2d00fcb42d28d24a2cd506ed274fb74e4a4d42179d4ce075f97d14935643f0e66f3c514f44ecad17ae0d
-
Filesize
16KB
MD511825cf6da869d7589201092299231bf
SHA1b650151674a230700dc66352a0f002ad5db6d195
SHA2562f315c341e2ff775fceede3d1b5dc2f8124a866a382a2c30b760ac6c2abe7bdd
SHA512e5902c14769efb05fa457dcaf62d4b0d126cf3b71aa9be596e3609e1b63f83d6bc2ab3d1aed9a077a6fbec3e7f6a633b3d0b1a8b77d7d0161af60ed7d260a6b3
-
Filesize
17KB
MD529b8ae1d50ef8543dcebf4e9f53089ef
SHA190297279de99683b3903534459bc9962924d79fa
SHA2562dcbd24e8f78b008251a1a0499c981a79be59fdf154ff9938a28ecb7e64cf12d
SHA5126de295089b62bd50ff955c2e381be6bb0e59b1f0776946c5d3b5109fffb84ee2a673f49d2d5a56e5600d3b09fd8e9cecbcd0e677234a6f96c1194dd1e1c27c94
-
Filesize
103KB
MD5c12602b8ebdfd5ea5113f42ee978d526
SHA11159db5c354e5c9a73b2e072b3c0c5d02f3ff07b
SHA256412aad14e7b55e51c4c56a88949c8f5ac81e06bd1d9b23da4378b1d9711a0794
SHA51200ba76a1f0f08c969a96f4418c158d482eba611fa5984cec234ded9c7a1aa2e9e4dc2a69816c2940783289767212ac729cb7b3ae4cd002f772a5dc5d45bce3db
-
Filesize
50KB
MD58d89efb10efbff2ffd10518122b54b25
SHA19dd205bedddc70c5c5f07299426e9a0f1969e68f
SHA256a302a8cf42ce1f2658c6e58dc8fe9049b03dc04dda2070e89fa0a7a84fd1c5ad
SHA512f72d8a9257efed40abcc43b3d866dfed05a40862cad6f2608b73cba591b875e3003d880ac030c6397b7734d29f091f0d409142eda62abd712f66da10aa029679
-
Filesize
94KB
MD538dad2e29cde65bc5c27b9bf90888113
SHA1cb7746049be8467eaafab4551d473267c9bafebb
SHA25659caa615aa31cdfcd1d422c7496fd89b4049934c8ed6d5b08f02e1e2cc3a3a12
SHA5124d762f8ea69ce7f96886f8bb8d9c10d33dbbae0cb906abac0d801330d9f2a3a33ce1f29818626e120e3dd7cbfb086afb2f6f808f5dc529fdd29ecc1a99ab7c01
-
Filesize
33KB
MD53408392fb8f73e6e1173d9dd00593eb9
SHA1d32bc572dfb2024692367dc31fa7b043d92c2ede
SHA2562426ff070ab6634e6729ab177088b8a44eba05aff6dc9a0b684e62f318a9b37a
SHA512bcc31d4f1ff9750fa7bc1359e1647155e0617412c68c810410970a6fb406c3c3e7119fae9fb5b31e0f7c19e7062d8d39e649b4c34ed5ea5c9535fa5c2315359b
-
Filesize
42KB
MD523d5f558755a9d58eef69b2bfc9a5d99
SHA1fa43092cb330dff8dc6c572cb8703b92286219f6
SHA2566e5bec69b1c6424972a7f5481ac57049811f0f196535b707613126c11292c5cf
SHA5129c56c94d059a27dab9f69c9dfd718382a8eb192b8c0ce91cd6db6ec0769b8756acf9c0956a35561474b87d6278b13fbe88a6e4df6260c278b1ae06e9be55dd6d
-
Filesize
92KB
MD50aaea3ebfdc9d9688e08967ceef33b0c
SHA1d2c5417cdf75ac4e4623c91dfab4dac4d9d75841
SHA25695c541873a4785a51fb5180d4972b75b4b1fe5085e2d0f71ea77e5d007d358a7
SHA512a86b64c948cd4c048c6bf00f0e297ac9bb6d028804445106fa71b4058d4d7e08abfbca9336b0b233c812841912fb130219f439b7a86d0b40d2a78995e86e0653
-
Filesize
155KB
MD59f84deaca4835d60ea51fbfada47bff2
SHA1f94b8246a21b42f6c96144d6f4013546d3e46d0c
SHA256a3a7d2641a46b9925b5b2e3a0d5653e773dd2bb2b7d4f18572ff2aba0b35d5b3
SHA5121de30823128f4576118ead3695ada70e6b3ca74f2f596cd710648db6e9938cb0743de116e6f418ca7c9cad5f10cbd2beada118e1dde9479e29ff70f312f94ab2
-
Filesize
86KB
MD5f323ed18f8074d87a811329a9ddd8a80
SHA1ad9b1d9d608b827c2ffeee9ff72b93b1305aee59
SHA256353537cebe9855ada77d3cde73b50b2859e47ccb1ae5d4744ca7ef5309b6e4f2
SHA512f29a364b54878be586b3484f082768d38455a8d97f5f9e0f6c18e8d1232149a2814494dc8e3f6be365a335743cc9dcd1d828bdf624a8e76d1272a1755e57ae28
-
Filesize
94KB
MD5f7d3568391dbc10778fe56fea5a55809
SHA1078a1b1898a09aaa29adc7e2685ae94321454da2
SHA2560db3cbe5424ea879d039f1cb35f2923e3a0d140de95512609ac6c31aa8d225a5
SHA512f223dad70e79b694cdd83e6f8741e1e1a9939e47dbf9cd7afa64984e9d6b5bb91469c3fa56de24adaff2111fcc0db01f31f06c684fd280f3238dfef4664915e1
-
Filesize
20KB
MD59cb3cec9b3a432496fbc0ce11be39bdb
SHA100115957a8b680169c8177b14dc4d92940dd5d5f
SHA256a90c5d210a80560308b923438f102b54b9805279874da9508e7c2fd1301246d4
SHA512d4daadf5afdbeafe488b8d78af189e99abd67f1aef4a382e4d07f736937d6912a6d6096ca5e74639f79f99bd68222edc880ebbc3321fb41d2cbe16bd8305dbd8
-
Filesize
28KB
MD59ebf52e1e4c1627a5b060601ffb483e9
SHA11cd01bdd300ccb77571251dde0be74a907e2ec6b
SHA256216ea1737cacccb1a0e1a0c506bbfff5bd0c68aad94822fbf578cb81c7d72f49
SHA512b029afb97638d132521022952ff84aebe822a53fa0fbdfaa359c410b03c63c72a23a9602cb64cf927e142dde1d3746ab7e0420c8cf7ac0c02af09eb11818a4ad
-
Filesize
48KB
MD573a453ea5d4a2fb2916473737ffa7224
SHA16401625619addf96a9a64c7c3a8c3608b15233d1
SHA25688d6624cced4fc50d398d759513b1475da2c29dca62572afa65859bea2950dbd
SHA5128ecdda35045b2ecd76d08c985c87a065a152f7a2119fb50e5102a48f7bd098377ab2f772b19c6049269612a2b4bb3279de94b26f787705b98ad0d9c723e2a29c
-
Filesize
215KB
MD5d474ec7f8d58a66420b6daa0893a4874
SHA14314642571493ba983748556d0e76ec6704da211
SHA256553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69
SHA512344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348
-
Filesize
41KB
MD53bc2b6052ff1b9feff010ae9d919c002
SHA1dd7da7b896641e71dca655640357522f8112c078
SHA256483a3494759a05772019e091d3d8e5dc429d098c30007d430639926c3ffa16e5
SHA5120b1632b73fd87e8e634922b730f83b7950e9a39697a46a3429f0bebb3f1ebd14c815a4651ee8f663a437d00ecbeb6ddaa47b2fcad719777edf1b1de8a7cad0f1
-
Filesize
20KB
MD5d8ff006363de5d28efc4bc41cddd6c7a
SHA1b4950449bfcfde423c8fecc368257dcf2a346258
SHA2560f2f2c4216f85517ab2f608010108f32416a23607fbaaf4e2294379073fae161
SHA51211ad965b3eb86c073d96c808eb4b4fae5f6eafcf9ff0bccb74cf1aec7fc47154bdc16b2cd436a3c8ae069502b37ee24af78176344af0b6aa7b8de4e8896aa045
-
Filesize
60KB
MD5702819f8a9a39563e05d145e473c0fd9
SHA1b36c4ae38a4da6e7ba22bd04307763cf99fbc759
SHA2566ee45a6a9e396d5bcfa5325d9b5d9006146f66772763296473b603b4e4519a14
SHA512ee163d9d5966fd8ff081253da011030bb27fdc8f8ac23c7bbd5d5736b434e0cf9c2b743373b504c75f6781ad805f4e6343f52d0091f3e33a4ac304ea26f9fd26
-
Filesize
66KB
MD5f53b6d474350dce73f4fdc90c7b04899
SHA1b06ca246301a6aea038956d48b48e842d893c05a
SHA25628442a56b016bfade0e368929138aaaadfc36156734e8ec7a6325b3e58fddc25
SHA5127f275614052ebae8876ad28fc5d48e4f63ed9ebc610ed981f81377ea3ba4c49a2031ff771deb12adabcf33d4789ba35354c1e52524c067a9e7ce078703683f1e
-
Filesize
62KB
MD58db9e3d59e35425c9738ab4c927fbf7b
SHA1e69219212b3ab89a85c15c43915107ad9605bd18
SHA25610fbbc6d547c070f1df3554b1d6d9972c0a680ba3c43aadc962f9548dc0a2f2a
SHA5125d9e0fd889ea5ea5c84b085d6d368a202f3b7d397f921e45a6571df37f2f70cb6af82790ad817421af0317510db390d5d1581462cd85da45441c37da7ada7baa
-
Filesize
31KB
MD5befb4d1fef667b6025929f89799508a9
SHA1ba9d70abccea852ccf8b06d9bfce323a98e784cf
SHA256a715efef0572b88933579984309b85825a1305e3f358874bd868e8e8cc69f878
SHA5122210d93a925653cdc6432225b48bee1c9f51c5c593c7b02f88e462b1f726b0de147c33e1a4d6ab650f78564a7aedde136f46455224a81e62ed927bf4ecbe8acb
-
Filesize
21KB
MD535efee590a5abbfb96a546bf3f982a66
SHA13300cae500d40a69a48122b1e59fd9ba6c25c178
SHA2562165053336d447a267d3f503a7e72dac5c84d9a624f0b90393cbabf5fc0657cc
SHA512fa1469f31cc28f4ad1cf4da71e096eafaceb51e8da194d97fbacc1104e528e0efaab75d26476b70ec2dfc2c2ab31008e8dd7d4b118759b041997f7465ded56a7
-
Filesize
68KB
MD5107467a1cb06a462521cdcb8be392b68
SHA1993ac5254751c912753396a52f211997567b8ca2
SHA256b354343409d90e50676bf5fc33ad51de6e2618179d2642ae54b490cce1e901a0
SHA512690ac221dd4a5cd9c549a7e6f5a7f7ae3c7bfe4c2312aa95edf01d8d8af03f0f3f7b79b369b7f5706cba4d99f22e84b72d2a17e566fd0cc06f8af75bfe54ccc0
-
Filesize
23KB
MD50b3b368231e10d1de6809fbcbf5ffe29
SHA10d9a01da1dd2673e006c443920981fe5e923a334
SHA2567c1be7a5fcef164b57519a2fb7c8209347a35e2a57dca50b45f91fee621cee32
SHA512efb466f7773f2627f9ea4e974c7e5a2c67207c2d8ae6bd86f6ad6ba7ab26f6ed17da9a91a391e3e44c39cb840588b6f63500005fb014079e5907b1c744c45d8a
-
Filesize
35KB
MD5800d8bb5cb065d656c8b982cf5532fd1
SHA118aec4bffdcd1e7d77f859409552363d082f3ae7
SHA2567e2311fcad1f6e71b1f50019836f9fbe13e793f4424f1d00ecf4be2ec3d3a7cf
SHA5123e0883f783a14726f5c026b0111b3a79394af4d4bf0c084b542176e6935d5295b513bc50b4d614d3da60f33c6c5997953c4095825d1e9a6d0a7e2a7d1901fc63
-
Filesize
97KB
MD529ed7ec528b59ece05756bb35daa50ed
SHA13715b02f3de1b36cce758d3f83da4f131ff3a0e3
SHA25646e61e3bce2d5fa21e44afec604896a21b3aa3a3a980b96f98af45f9dd511938
SHA512f858cf9ae557350272627790a43acaa2464e8fd7345d3c6a1a48c10ecc308a275ac3bf54defbcc2263ae88f7451cf1abab87409fc12a3c81211285fdc1e3155b
-
Filesize
425KB
MD57620bdb7f5be09418935febbc6d482ef
SHA19c005bb851c57138693c9200f400ff1f8e9df1e7
SHA256a26f46529016778c40002b363c7f9f1053a0b60057dfa9d6a2d546f879f27a42
SHA51282f830fee5d18e54551e750b47598ed383110860aaf63ca0a96262831d7b5f670a8471df8fcc5c6526f3a45f5d03040e87a99d8ada9fde7820fea0a7fa872f5e
-
Filesize
33KB
MD51c9bbc1604b27475be69c2e95e38df71
SHA1cf6dd22b23186153b6b851e93763a6bbd5997a50
SHA256c5896fb0796e7fe8ce464ff22ba357f281ed971f632a756c647b46f646cc5783
SHA51261e267aa1fc9c3760e8fe6d1760d31b8a71cc23938b05e1e970b208346d8d251e38b724e3c13ea680663b587184b01777eb6e5d5d68f33aff0b8fc2df30a7a52
-
Filesize
23KB
MD58f65ea0a0590184339b4cb35ae36f6b1
SHA1d0e841080d18c165a3b4dd0cc2f7a2286feed7b4
SHA2560ab8379c6fc8d0759384265cdef22267c0ae82b82c14715e7688aad80d63f533
SHA5126e16386dfd5ca905132555bb170fb900fe9b7d6f900ec274459cb83df0c9e17580b30f5e1c4fce34b659cb0c2cab960b2a0725d91bc42c8792a5d9dc63647cc4
-
Filesize
108KB
MD57a1e161aad4e6f456da58d8f7f061835
SHA16de6d7b935ca11e53543b45957d2bb73a60c9867
SHA256e049cb71cb7749736da7d3cce3b57a34841e3441bf30ca721635d054cc1198a3
SHA51277511ef9574c835bdcef137a2a3e641c96b4f5803c3fac3830f266303bc87acfb78079d9a0cd52daa1ce4ffa02b68ce94b30a31109accd2b80d3e109cf4f8364
-
Filesize
138KB
MD5a9ddbaa0f15a01eca7b4ef43861ae227
SHA1c5daef1787d32c8b96b6025f90000b68ecab9a6d
SHA2566b590b55ce9e5cc39158e22d08c47444a106f978a3c68d5d89ce01ded276134b
SHA512726b829e68ecce5e892c30f87c1f9fb71faea465f38eadad9f74fa7ce70d740afd0a98e296aaa112c50c42c1b336e831e56c26ffc22fbb67077dbda34dc74ef6
-
Filesize
138KB
MD57f8e011c589c04a82125af9f6f48a428
SHA143d84ce341a8f5e76e543186c7210872f9a40a7d
SHA256278982a8ffb4290d26b456397c1bc1ebfd26f7545bd4d969dd162b87404e0653
SHA5129786162e8f009c0718475964bc6316715b3b97a8351e3fc7a5121058f9f517e6c998d94182939c3c77f8cd61cfabb963c52f72b343cc77a451e7611285ce4c84
-
Filesize
33KB
MD5557b7d224c6f8331c84db114b7fd2bf0
SHA18fec13e9c5696f9a579251012c356bf25acba25d
SHA256220351ece988123195044476890d2d3070755374436ad7e8b1a659e435f143f5
SHA512931b6686334ac205c1023dbe5c64061d7cd68c0f02a4e596b57464d36467e7cf4699b04da8c94782f6107fd0254248fc1564cced569d1560cdc45bc85afdb1b5
-
Filesize
64KB
MD5d9b4d38ff21e3c5f43f77296d1a62b2d
SHA1d3543e50753eb612ae87ef5b3e1497dc3e717801
SHA256482f11cd10d4c9cec5b69893de40d427567c11a5f125ee016a19067db6e76ed2
SHA512cd7493dcb2fc6314d59ffd0f7d147e84b0d90171d97ef9e1f9dfda4c4e07f73b37ce6ff5544a69b642a0c31cb98bbf468178048e524de1cbc2eea18ef872df57
-
Filesize
20KB
MD54c0e50267e16196f98c0817785a8c125
SHA123064de7af9d53d06a82fcfb4cb107731127c437
SHA2565e5dd8d3d067b5a50d9284de24e90b9538b96938d56b024074ef602ae7d83584
SHA51286ca6e9de22af6d21ac57a3775cdb4a287ee39c1cf656d9dffca64ed09f13dd54c30f324e2ee322014272d504e5a4c09297ba8b75a742f4ee67e314c80021e54
-
Filesize
35KB
MD57c702451150c376ff54a34249bceb819
SHA13ab4dc2f57c0fd141456c1cbe24f112adf3710e2
SHA25677d21084014dcb10980c296e583371786b3886f5814d8357127f36f8c6045583
SHA5129f1a79e93775dc5bd4aa9749387d5fa8ef55037ccda425039fe68a5634bb682656a9ed4b6940e15226f370e0111878ecd6ec357d55c4720f97a97e58ece78d59
-
Filesize
20KB
MD50289d2ca2b93affa4e38424e137799d3
SHA182a4775b9fb386f9705cf1f917149afe690623e5
SHA2562049fbaf83f6baea7539ba2b3693240013269c4b8d4926e727b8464a8f9d953f
SHA5129b5021df6ad1a73ae42a31a01aba7bbabffc56acab4e96e480fdec126ed19b148406b41c09c67ac9a165d6d25ed70bfff279f23f1d21c01a8afa8e7e63ea4645
-
Filesize
27KB
MD5fd5d636bb6990cb18affdd10005434e9
SHA1c867a6fc488ac9e320b9ee71ec42307a25503d71
SHA25605422a822364fcd6114e6ac572d642ef99c794a0c484f77fe52daa824adb4cb9
SHA5124e27c6cd5cae66e73830c34d0d450f754baf14e26b7ed019e86cf3f3399de54e32af897e045c34809a1105a56ecae71af1c6ede348580a2504e7d51492f8b1c9
-
Filesize
233KB
MD50c2b3c8409f0467ed95ed16178be116c
SHA1519056bd2e323ccea627c4466945b1b19dd7d154
SHA25612466e0e85ae1ee2211df1c664f313a0bdf8bebd8c32fbbb551eb814ce710249
SHA512e86a4a2be3cfe97e2a9ccfb90c37136f74d20ee258ca224959513e2dfdad69cf9d3a232681c0e1ab511cd32f0e1da83f477b159e4180db03f08c2089b25c7303
-
Filesize
193KB
MD5d50a03e013c2399aebd7c67536f954ed
SHA12d6545b6d169f4fa025107ed79c3581c32f44b25
SHA25654ec6e51f7d6afdd843b50ecc6d5748dd42d4d8b62ad25ca2074f031eb9ddd55
SHA512ce9ac035f414f8ab25e2d3b4395f005e0e7061cb86f0cef1a05a159956bc79e1751e9b46ffda3b92005e4e5c132103269622646afbe6d47e16acb574fe8685e5
-
Filesize
47KB
MD5015c126a3520c9a8f6a27979d0266e96
SHA12acf956561d44434a6d84204670cf849d3215d5f
SHA2563c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
SHA51202a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c
-
Filesize
26KB
MD58404cfed82d322c1be8e149fd9f40eb8
SHA13e3657246db3b889e68d520904ac294a230db56d
SHA2568f76526e440538ec1300aa89f671acd1b746925833f7160f6c0e29443008f97f
SHA51247ea700f6173773136f46bbe61563c1a7cc7314b6be85286be064c273927f48cc57fad00331549316b29ec42f89baceb5acf456d918842f6aa54927555bce7db
-
Filesize
53KB
MD58ed0d7d1f81b2f206d60c578cf5e46c8
SHA114f60d33f03f373d43cddda99b9b26c727b05208
SHA256440c3ea6eb4fb55012e777eac88bdbf4b06120e6bad01df062934322f8db2bf7
SHA51255c35e4c0bceb3ad1a5393cd3d8f230bd366caf6c7cf70d2daa7f451470c3664f507737bee371fdf5b41bb5108d6eb303a0f1b31fef2d855adc1b13a905e38a5
-
Filesize
18KB
MD5d22696fc31018072213b8c2aef043a74
SHA190962a45caddaccc9e48a844af6cdffb58738818
SHA2561ea411d80e886629b01e1ab91f67c8ef1372c41f9c8adb1c5a2aa93aa70c62fd
SHA51243cdb6807bffe47d7156fb0253318499a24c42bdd5509a690c68086cb030b367284b805361bb47f82e30bf8b7957c528ca90cd334e68dc275d9b3d22ebbde83e
-
Filesize
361KB
MD5caa7742c873fdabf3fded0e5f653df7c
SHA17dd5bf4d75f0745c82c3bcca91684026dcbead6a
SHA2562c988290a10b9674a5389bb05be9962c6804564f43cc3a5dcd016e582831bbdf
SHA5124b89572a70bf78d5b69ea01e5248b6e0a5d5a829ef7f6bf275e4f7df00834a6e8a520cc3b891b0d2d0feb54d7ac06e4b4f62fdf8c2a89863986e4cc37ea35b6d
-
Filesize
78KB
MD5bdbf611803b8d7326246274e7086f3f7
SHA1c560805d6e2bcbf7cebef634319b40b789601fd4
SHA2561d93c080779b78b0c406c243e889024f1521f34a73e4d4405b0f1e602c4f9042
SHA5129b8a7ae05fbd287ea7c4235a2922ed06c781916a87d81fc4b689c0ad3d73380b390ff970337c48dc6694946a1c6e82e8cd12bb79776de5a503d5e2db083656ea
-
Filesize
42KB
MD50c74385e7737386aa46ae9cf3aa09966
SHA1a5703db8b6ad7256d932cd528a55e9c3d23cc85d
SHA2567dc1e70e67a65dc2032e0fdf7ef3edb35c5cb1efee4ef548501ea9fd953601c9
SHA5123f7f85d4b52a285b85928683e3c36ffcc75e6c0ee6d7801f7afb2069eae6ea555378fbfa43e09bb46a192ca6a8d40d06389a453e94de2da7a290885065182caf
-
Filesize
107KB
MD5084735352ec7512aec2bcae2ce7fb4dd
SHA1ba04f4b34b2ce7b88e5874e500ebb35420baa930
SHA256d98a043c8e627aa7ca6a4ba708c692838eef20614d83ce989df8f4d2d83a7d0e
SHA512f7d6c092f5fdf258e32a912104a2e325cdadf8c3df0152a76d6d97e953362187e6fc0b3e777cc86553cce195b8c96cc77e60107ea339fb71f0b79cda90c97671
-
Filesize
16KB
MD59c6b5ce6b3452e98573e6409c34dd73c
SHA1de607fadef62e36945a409a838eb8fc36d819b42
SHA256cd729039a1b314b25ea94b5c45c8d575d3387f7df83f98c233614bf09484a1fc
SHA5124cfd6cc6e7af1e1c300a363a9be2c973d1797d2cd9b9009d9e1389b418dde76f5f976a6b4c2bf7ad075d784b5459f46420677370d72a0aaacd0bd477b251b8d7
-
Filesize
54KB
MD5036988a9475aeddc9bf1c155b0132f5f
SHA177fe0b821782846b2a53210f2105cb76a9094fd5
SHA256a61d62dbdeb6e02a93f523befb7efcd9323e78715c05d63041e2e65e4fd04b57
SHA512aea9b91fd52e4acf7eaffc958993d0bcb81882b743cc02a6274be04c9d9fda2dcf240373846a107493287c4185018bdd7ffe636253c787f219ec66fecffa656b
-
Filesize
289B
MD5abb67d5360e06de750a5e540062ff79a
SHA1effebc020aa0014928ed2daf86c661c53a281956
SHA256dfdc56ed4b6832dec8c9eb2597172e4fb80f9b82b616366a845f885462042008
SHA5121bb328de8e0fa9904591c4cde36865b2df15f4d026b04d30b20e7849c1171613f93ee46efc7b6ffade9879858f4c26acc5bb8ae5df13845319d56bf98c979b54
-
Filesize
334KB
MD5a21cd51bf3a001052ce2efb9e2b357b5
SHA1d74f71b702827bddf83dcfad4b4c30426a3db8f8
SHA256f739e346dd3e7a46670f736d281884e12d6c4a6ee36a5b73de9eb740fd93542b
SHA512155cf01bc7873091f5f0ec7029439ac2e1b51f0a283ea32015e68e4c971893cc96abddf97c61405d4312a0403f2c2d0254053724859bf6fcd2253f982a88e531
-
Filesize
277B
MD5cf9e438f3ac0be3a4e4e86d3e7023fe8
SHA114a16094ebae96561720fdbcbbde8199b25cdea0
SHA256b33fed6e1a417ba5f1d1c4d2c27a12d8ee32432979979dfd6c7e7fcc4f2d174c
SHA5124ae91d787829b8d6027d725c832d992c23ae809db32aad033dd696377de412e627b06222223109180c0baea5b29f1603471123b6bdea77d54c7c851a87e6492f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize10KB
MD5f28e68665d142634cddfe6faa5836881
SHA1d11030dc00d471110569acf2e81f89839b1ff2d8
SHA25692899f33c051497273666faf710db3a8fd86b5fe39c8cbdf343142df3d2db1bc
SHA512e6855fbf438db95730908e18b5ad5868f04d0d9299bfde3bea52ccaf2abe482b728343c791a95ffedec7f2d0b0c0238a98a77d019cb87292e32d00bae57bbe5e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize48B
MD5436f628e43e4c98c696773c01233da5a
SHA1a8a2baa1257675e88e0f985a5deacfaee1b1b53b
SHA25606657ba62270c37961f1de178e2338183bf13b57a2f61ec814d299956615f74e
SHA5124466e56acccb871d5f486528893c243f026a54ce83ad240f584de2975ee1f390a4a8f77a9b4fb29e5f9d023d672c7671dbfd0d27e842c8c97f3106701d6a0d40
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize2KB
MD50a7230b79000c4b3f04301b0de786228
SHA10cd38bc12ad54ebf7db9f50525bcd78ffd08d8ef
SHA256d32ed52cd6c539eeafe0c149bc9b9a0b50a91fa0ab67d272f2066275dd017555
SHA5122d6c3ea5e7ac648e78fc1784e0759c1aaab566c86a6ae9dc7c57740603d1aeec084a136d7b4818854f8b1b01add5e7fb111e69723879cc17856f0a82e3192a4d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize7KB
MD53af4ed96d0ecb77ab1df14518d6adbfc
SHA1781b418adf834bc52948918840ef95da1d25a4a4
SHA256c27237e517d73fdf6e40aea5c66f0d25246f03928609462c85f18f774a3df4a9
SHA512b72c5f02000313be48be8e865c1f4993588b624d6615b2e694018cad178d7518a6933a918fade18e2985cbf127492aa2a2b1de6dfccddd78d0c8c0ce69700685
-
Filesize
70KB
MD5e5e3377341056643b0494b6842c0b544
SHA1d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA256e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
SHA51283f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.xbox.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
24KB
MD5a49c9928eaf1249b67c20c8f2d964b3c
SHA1640e39ef785f22015f56e5c0ecfba676ff31ca80
SHA256b2b315dcce9741f15144ff55536d2f7440e8265bb9ced3297b99074e098e9545
SHA51270680d9787aff73ba4c271f737d3dbdc995524029f25c36a6398dfae08ebce842a20487288e587845ebb43ca06435668d3d5358e445296baef14b5f23da3f225
-
Filesize
13KB
MD5f7a4e9c16cf04815853e7280a5201ed5
SHA1c19b53b0570bf9e77ea0663dcdaee4916d8f02d0
SHA25629cb8956f33671507113d8847dbd666938b0665d32046496940b7d6f6432d819
SHA5121689c9b5cb00a79a215d1c27cbcb2813c265f0130557561c579465901024c6c06318740b3eb2699d7eafd8ac87e875664b6a1d00124217dccee030056aa44f66
-
Filesize
18KB
MD5835ac2b9c9887d7ccf9ea4f973a93b53
SHA11ed90c0aa1a671ec2c3db3c2d52ab1304a4f680f
SHA256edded928a0034791da10fab4b85e67d8ffda74ad1d13c5778563ab03e7d0a927
SHA51284eb452340e9329b5b6151d9a7eef3fae4e06253886367f522ffa2c8f4618c4872d7d6bffb886f24fdc18700cb36fd281a896d9cbd44311bea353596a6fb3d78
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5892f4.TMP
Filesize59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
6KB
MD53af1c2530f82fba63cfe38d43b96e2f3
SHA130b0cb40289e2696278b17beec5e04786d18835a
SHA256e634eb90953a562fb8286828985baa37deec032451401d1a4f45426077c885bd
SHA512d0d5fff9892cb4b86333cfa51c5e5be92d6ab69d4c9690e8ea059d555e89a3f886426ca1bef1e071ad533b9cb06aada20a042b5ff3cf05544f617b856e0b928a
-
Filesize
26KB
MD57f4c2740a8c04ea2f5128bd8724ee8ae
SHA1798c92c74379664356ce115769bd43ac2b8e7d21
SHA2567144c998ce2ec46335453f8c25d10cce10e957a3ff775421264993c6ecbe431e
SHA512f60b855980fa4ad8c1875a698a413d5e2978da903a7068df89efc3f7490a8270417b06fa9eefcedf298f93b4fa3d748f02ffb7f4eb9ba9abb0d05032da6db4e3
-
Filesize
28KB
MD59514b60dfb92349e3b7744f2a055fd6f
SHA120e3b7c63ed0471d885046b451cc4948b19a2c0a
SHA2562671b9de43fdc832cca5d54f3c10f292874baeec787a9e934f02018f49bd000b
SHA51201189b5a330d77cce775ccb0376f69b92b5b50fb5da6822b7b1522bae75f3e02e99c730a7d33693368d3aa918631a1eaf65ff143186b4ea5e01398b09893a1ce
-
Filesize
25KB
MD5d06f12ce92355b8ccd5edf9de3299644
SHA160a931e3566cc0c9e6d6f47f7ed99ba60bca10ab
SHA256a739ecac7cfb9411003d76c973f232ddb2671bd0fa904f088e42a534efede1bb
SHA512df674e10570bb8331e5379107f183f05b109f32941421b5692510df292776b2847e0c32be4894501f8f0a72dfb53485bed130bb753a79d8a62748943466e103c
-
Filesize
20KB
MD5ba3572129d342ab21b646580e6940cd9
SHA1659915d8d3dc84c94419a9378e9e4a0b2a235b2b
SHA2563883b3511397f64fc34c4398e242f24e7654b1416b60b8a17ce8480840d4b1fb
SHA512398ec1621c218a17f06339930a44ebe0ca560a5a3976ddc9e1b41e75fbeee7f54facfe7ae5ebc61528ff42046bbd5ac4bc49c95f299e53b114edabf7b6365a37
-
Filesize
19KB
MD5a4e5249fc258202ab3a1dacf34d53105
SHA100c337b438997479bd9a9ba4116604bbbe39b6be
SHA2561b0301bab23e3b89a2f4f5bdcaf1ba260deb9dea0d802c09a897cfc0355c0451
SHA512a8f529a010550531e7bec55e65a64cc662aa6aabb1b0691cfcc8949fc924ce45d05d42ce8ab07c6faa7119195bba09146869c0e9a4a08b767fb175a22dfdfb14
-
Filesize
19KB
MD50e901b18030a93ceafced303500c37fc
SHA13f9ae7085d5e33821fdf1f319f7887b36d4d7217
SHA25628ab470c29129121ea890317edc5bf19d3080d06b55eed12d86aeaa133e97194
SHA512ab5193758bbdeeb85059ff0725b0db92f20d073539a829c630fd0793449d48818346acde2822b66292fe5984ab5b359eac0a75867c62c1dacd4caebe69a9a0e0
-
Filesize
20KB
MD508525323a0b1ba8eaf5799c33f9a8771
SHA1d0e4d137c024889f0ece34090af3d57a59a5cb17
SHA25627341b57ef23a86428334c7b730cd896edb668170c58a019833fe7bd02180b7c
SHA512c4c4bd55a8517b6b42ea332ec8c14f46f1e278c449110b3311ff6b914f504cead0e6c41cc3a467e174ad9e21cc9aa03b2a5213ca89ad058c827dcba92bec1b99
-
Filesize
18KB
MD5364fe37a779622120046cad3dfe67c00
SHA1f912174b11a027a04aa9d19f5d62a508d962b205
SHA256acd1dc10890ad3e0044954fe4e1816e2def5438003d7a51446aa2b0d7f0757e2
SHA512cf7a94240459245b23b63c19eb0e9b329aab0b60e8728459f4444ed7d16a8412955d914d5597adf8d49e109748b6dc4d1c134463c28c2c8041e7e6f775ebe6b2
-
Filesize
18KB
MD5fdf27a991340e918f61b2e55a5ace5d1
SHA1fb3d8ff23f851ce2e6332c586ac79b9403722b1b
SHA2569c3b4ad6e20c0bf6867cc1cbc367f134107c0030be07e4f91cf72e0ccb05dca0
SHA5121bb6f074deeb8a90b029dd58df5a320e3230ab2c7d1aeef3e4434eb0bf61da2be82d090ef85af784b43151a2421af65eb1b730c880d8359428016618579cbd7f
-
Filesize
16KB
MD512c07a456012d162faf27c12f6038e1a
SHA1d998826178216513abe11bccc690dfc3820dcd79
SHA2564a740be9b5eea48e7a4c95d67d82fffc44dc59d54767252d094f54a7358435c8
SHA5126b37b74bf3f1f8b9e1d9207b3c7446de2ea315344620f1fbaedcdc115b77378740ed5761f40825fa6d920abf68f8753daf6b4dc76069e5ae9c4a3be1fd42da53
-
Filesize
5KB
MD57c0ef2648a4b9d7716ce134f716fd292
SHA15b30f594ed2558b003fdd97650f8f66f27fc81d7
SHA2561931ede49a00453916bc1b5b27f6460de45142a1fc12ac5ed33c1574296b9734
SHA512faa2db02206380141289d76113b52eb6dbdc164ad32b1ef38cd223044db9b361c6cdbe46d6bacf1599faa68b7dba25e544c3453c796807ff07a05b16e9ea3391
-
Filesize
7KB
MD59afa2234745e2cd6a8543615c7ca4b5f
SHA1513bee2efd40b5c0cdce5fceb4ea3daaf1faaf3e
SHA256311c5d86e70adb23d27b25d66a852559d0542cc96e1931d424a0e633e31935eb
SHA51210a7880cdc136ae207b98907c531709adf664f4a8e21b849a8fda341a27eb77be5daf6f12d3ec0e3fb11688a77a14f0e0040f987785926bfdb11be01349fa0f9
-
Filesize
15KB
MD592c5fdc2a5c9d977ef838fc11a662de5
SHA1c910f3d6b83dcd94582b649a4d81d77f5de72316
SHA2564f56f5b98c6138b6a02537475d86d90d472ae6adac935137ddee3bb52eb0ee80
SHA5123ea742ab1513edb8dce1a08cc7b66122bbf61953085a05ccd6df7414316189303edc99ac292881893842ec764b175bc421f905d79fae195593e7fdfbf759f883
-
Filesize
17KB
MD51abe190d01ee58a136edfd6cbdc9f166
SHA17c0ccc219899ab613099ba964299183401ada959
SHA256d0948add7afa65cb6dc86dbb2fa211cbd8b66f85f8d5009053fd0b40bbf72ff4
SHA5126b77b146b088b6d19540ae1d68ddac666b3220a0d86b84db23465f4dacba8c8c4e2a8435d44a2bdd2eeeced93dc3665b7b14c3f7c9615913196ad375d91312c3
-
Filesize
11KB
MD5e3d1a841f7ecd911eb49fbae910d462c
SHA17445f6d32e83ac1e19124374e775201d7552641f
SHA2569afb94ecd8d2cdd35d0683c9c87a57c05ebc6fc9319e225c8f89adde091a0068
SHA5124a3d14cfc7e751692d5447b87251b1f155058166d9c535d551c8338a37837bb8a928196a8635a3a7f6903180f51154e3e74e62bbfb8572b0f1d27a3e6aa155a2
-
Filesize
21KB
MD5227aa2a039942a66d42ee94a4382a11d
SHA11bc659fa9a81cbc1c52a6085e39530f7e99f4e2c
SHA2560c528f3e8f7c0fc506eec138f5b336957263c5ea926b6f956e89a1ee17e91d86
SHA51297d5af3e2ba063b88823b16f08d023cff02f613eb695b5f3e2243eaf2268035f0364a7fa24064269224b0d58e219e0680f051e4d81aca04611d307542e638ccf
-
Filesize
24KB
MD5185080eb3d5b0a66db58e0095f8c331f
SHA1bff8dcc035b163b0c9ec6e4407733b86affef965
SHA256113641bc7ae03411b69562ecb967139fd6193ce3f49251ec79449317ace9d331
SHA51275ff3e926bb1a6bcbb6cca5b735511a0e3d203e7fb90416c3cdb0b03aafc9db16ce824e0f018ecf721166f589ff8d5fad6cfcb9287418716d50256348572a790
-
Filesize
24KB
MD5ed5208c1f808bc3060ee268b37756402
SHA1034686621c966a7ffbd112d425fa6fd600d0c664
SHA256f1101bcaf7c09312f161e9ee88255a6869fef1a8ff3dc11a8a46b425d444e710
SHA512beb4d264aed90cdd73646f674b9a9d7c659b0c11994401a96ade73e807ebf04b8166471d35aedb0e41acec52576c3ca7baf2c0b20782f1e7fbee57ba701804f5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\b6c28cea6ed9dfc1_0
Filesize27KB
MD5fc042f928600a5f4d375c25f9d3eb720
SHA1cf58ea7168cd3af851f5659abd76a8ee57e8d1b1
SHA256a9fade9445d41bd845c7c725ff1cdb31f7f0f3078a0eb8caf547211bd994e6e7
SHA5126db5fc844bdba0323c4fe0e6dce9c9a161188dda3af685937800ee96da81cf615e82c08a07a4f721e09b3f07c5a9ef0a11a4c6ee1b86ed99ae384d5d0c15ad11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize168B
MD5965413c4310a95b26e7680a56726aa38
SHA18f3cd8274c120f168dcb1da8e89675b36d4590b2
SHA25615c6d9b7cfe5b7b1076e545ca94ddde0bbb8843c1431428113280483535e2b2c
SHA512bab27ea354fffc1f5ddfd65084b940c4bd580462308fdfb9bbf8e4dba87888164e0f859f8c905a092953083636408ec71e5d9e043fc41f88b6d0484f920377af
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize144B
MD50881d50a7789186da545e5977d2d3716
SHA154a82352b1317906c9659fd59eac86228786dee6
SHA256064974b92ae40d6909cfafec66ae6e46974b849b8a925c2ad84f2e328745e4b3
SHA512884ac88434fe4590be7f78b17bd89aa2c71a017a33bd3b9c038e391c9301c91d99259f54956b55899e165e3097acc1bf0ed26867869e914e8ac79028536d3036
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD54953c46ab13d9a5a6738bbb641cdcbe6
SHA1456a89a1da6018c234bc77dd7710a434f9972b05
SHA25679599d05b80c4c9c4696dbe2a2154f2fa9f99174e5f0142be6907ace6f75ae66
SHA512cb59f579a4a3df7fc19739e533aa99d7fceb96a992f42042e872bc525cb27c4048743937fb8eb51c9f272bf2181abb740774f7c9a430568ebb77b51c990a235b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD58064076a5b4428c7c4d45ae692e88310
SHA1635e95c83f26bbe69f5c90c5c507d58c4d518736
SHA25689b840ded3c80b068fff2036c91a96d4acdc07db77e3e0c4653937726e822161
SHA512cfb76b76617c7f991e953a0f842ed21686aefd92b89d8eb010db1510fcdd9686c2bbbb46199331295f22236ebbffae314857afc76fb5767ea30d0614f76f3dd6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57df63.TMP
Filesize48B
MD527d710160a16cf9b94d8aaf58dce59ec
SHA130fd3c8ab9877845433ab0edac84ac3b224bdd99
SHA256aa0aea72d398d84dc35ca9d759b78f30b32a223c8134c5c7f9100027ddae718b
SHA5126bf510b163fead99082661481edc8f6acc11e220889c4089377d92e7d5acbdb4e84ae064eb9674c32c6eea216b6e34dfcfcc2112478d5f6fa75f4a882e1f922a
-
Filesize
9KB
MD5b5382c9e0bafe24bcb71bfbeddb94f26
SHA1d8f1f8994f4314ca6ad6ac5115bea64f181d635b
SHA2565cf49325abf20d4437e06351a375ed0cc620a33ada6d75e0026604f8854373db
SHA51251348b0cd15b52e97b70a9bb936137159c440990a53e11c9efe1eb03cfe01f13610a492a848d15710f509d70b9fff3d6d36d5294e47d4c431dd5e3753e57d4c8
-
Filesize
9KB
MD5cd1a75defbf5ed2e9a4dc0ee60e61f18
SHA156f7b93cb8247366b5e7d3037b2642c117551429
SHA2567af5c5233755c3cd729913455e93657a0af8924ff9c99e618eb1ec7002841a3f
SHA512850b81d442594be5688650ef1963e8c149b8bd0744cffef225681021acf202f9f51eee47aceee567e087bf428935534e532293b2566a447936b744e332082a49
-
Filesize
9KB
MD56ec3e85920d4e488132cd185fe367b42
SHA1744275ff2279db6855d5727b6445413c0508fc80
SHA2564ad4b61a476cbdef9682fed215c36b33f0642ba196f232d4b7d2173afce07fc7
SHA5126ab61a30c8c715e02e95b9a88ac44ccc8674732a739037952c6f8b4ab714abf81a85743bae2d60817f75a587f16533971ab2bf189acb47b87d6e4ed141cc4a23
-
Filesize
9KB
MD58ba96999feb7a2cc0e89870049032ec6
SHA1f56760d9227bcb88a6a0fb308d5345ae70edbf5b
SHA256878d3f125c054a652c06a38d0a5a73ffe36bc4561a62a005675cccf04193150d
SHA512768c7bc2f5dbcc5b259c85afa40a29fb548e77c334e0cef373f7d3ed38d08a7a13f5ba8db159fa6cd254835c63744e777a78d863ed8f45242bec50e3503d454c
-
Filesize
6KB
MD5c847c3e3db04b3cbac2616999dfcc46e
SHA1cb8fc8adb1743cb672a7f9f07da46dba2cc2044a
SHA256d0ace7744d7b2a8e7a53ba4cc693f7e8354405fad371410b182a7d66719f94f9
SHA51266f588fa4ea3cec4bee946c752c4d509a26e3be3e72c4c593e30fa7764672f5f1892a9456857f62dd70c423074ee4cfcd8f2e1f4d20af9919a72748cb37f1f64
-
Filesize
6KB
MD55397e3cfb4831ce74449ee9c71fd3f49
SHA158f65389024d882a8a15fcd2124517380b575c06
SHA25607362cc011cae95d8c40a6083b2c1de2e4dc859cec1a5b18da9f78fc15b63720
SHA512e68d35e777e150a0202e594f9e855de557e39a1b71fad1faf168588231ea6792fb434ef3f0947a690961f34f34e3a2db4a7e30700de7b0e9753fef217630edae
-
Filesize
6KB
MD582f176e928faa86b0839bd234a9534e5
SHA1809e81960783ac88873687e7500d5a020f9a28da
SHA25677535d7a3abe83781f702d51b0012a588663f8b321d2b7f0b3510237f0c1f4bf
SHA5126a37b2f4e62103436540fe2240aa245dfe8bf4e5d1aa0e373f2c0b8dd5d573e92baefa56fb8dc7e2ef747f572b64a666bf7a57a3155cc5ddfe3bbb8257559bd4
-
Filesize
6KB
MD5350e90670bdbd63fe58b08c5d78196b8
SHA1fff73f1a96bd7a34088517e07fb98e452f9c7d3d
SHA256754c7acf26b7bdaf518280cb033737fb303f6f3d3f95a2846cdd8f9511d82204
SHA512f2e39289ff406459627a1f7ca850ac0873299db249f04ba0389b19795a0180ae1a719ba3f34db91160b185733441d24052f60d612f106974c9be429dcc8d766b
-
Filesize
4KB
MD59b9543b0f861934e8b8d2fd0e55796e7
SHA13a364a05cc0ab20b744a10056e04173ab723447f
SHA256be30e4f08a5bb190df9a1d6b7be455e24c575ce017bc6874b7371f7c875302d9
SHA51222731efea7665c45743ef89d94ebcd370acbe63507637617d3849a5f064b8aa83c3f65e0ebcfea06c85426744f0f09c4a9784fc63b05626abc73da9c635a5161
-
Filesize
6KB
MD537eea17ff69a4d409ceef8c0112d0654
SHA13643e8794f3120ed3692d4e9956478ed256ae94d
SHA256e04aec7f9282f324a055a4b9c25259032c24460c40dc21e4280443192250f5f4
SHA5124d71b5eaa3c25f3b8db96dbe27dbe52c250e9df6fb09fb153425a2b9e90e6d6b18220aeac44bb0c0327724e932dc70920c0f9a6d94142a5dc0d7f227161137f5
-
Filesize
7KB
MD52ae1fffaf1b65d9a2f3a3a12a3700cd9
SHA1db5e66f6edc0e15c2b22ccc4c32d5559df1a2d40
SHA25657d0bce07cf020c02093e5d31882f06a6d7ac7d394af0ab22bb6ba8fc3495aef
SHA512157916a8fb5342249927c9aad42b5a73a0e02cbd26f8930c261f162732b6b4b2cd85bd015744e06c6297544b6c7023d79f54e67df27ebe0ab6b020b5511eae90
-
Filesize
4KB
MD5100124d192d3abf4412cb349ddf92e00
SHA19748865f17dd98fbd75d9c3086d1012a0bab4378
SHA25697e5dd8ea7bf751b5f37521a19fa36834283ae4f83c9de2bbea94b057b734f9a
SHA5123534c63b855a48fed29034edbe9674bd5cc1b1ccd20b97d1ab3b4c59022d697ebb690a9f8ff116992ac9014aa93be7820151900cddc2e312751900492be51894
-
Filesize
1KB
MD53ea35ec6913393e449038d949b15c562
SHA1cd3b27a6a95ec7d7540847f89260d75698fa52eb
SHA25643493d6a0925d741b885a46b1ff04502198ed0b0b889981542cb5b32343754f5
SHA512bd9090c9d43969922c5f20c49ad5f38e00c093ec2c8dce4557a5a2f03c52859fce137a70f21fb5dbcb2f1f1b7b9c9eb2075f86da2733c3e9359898d16f6372a2
-
Filesize
3KB
MD50c52a3a600c0955540e93a0cd4d42692
SHA1d6899aa38f84f4cb54bc9a3571b7bdf996e47640
SHA2561b6bc99c0d0b1efb95718b597612f95b817155c4608d522f03510c77ce1de766
SHA512afe61d03f220d7a586c6ce77ffe51ece8bd832ac64814a4ddf48273f6bda11191d3a88414845a2ad74c11db61b56b917d19a4ea4d5805ddcb0b8bb44d25fa10b
-
Filesize
6KB
MD5bd206d48c3c53f5a4e5c236ab6651de1
SHA1c9c3ed0d3bd9fbaaee0d26a604e8357c1ea99e5f
SHA256306bcf486e8f75006ef9e04628ce56aeb43b104ff442070f8a7bbab7a5ebf670
SHA51205166c8b4e707fd30dffff41d3ca403443e97c262e239e72f4cebb33336b8e17343235f8fd672b3ff613027657c8e25f7b59563295448774512779e951f94114
-
Filesize
7KB
MD5d0634b1fa40b8d0a2af74ccfb769c890
SHA1e000c0ce7264161a0f5df0a481fa704d4cd51224
SHA25614f2cc556a9adc176616d9f697838521fc271ec3df7c124071c8a40fdd56898d
SHA512b64bfb7fb5a03d3d7a5955da34e7ae7ab7310282f0d9e144b54e07044c3113faa57bd07e1fa76ca1bb003a0fc122bcd3cfeafa6bb670304a1b7b99585432a6af
-
Filesize
1KB
MD57675665cba461d910885399634112125
SHA1b7fccb5c04bde5d00481656b7a33185b5ba23c00
SHA2561be283e7d41d7adf560d1e7b5c2c5095484d9ddb4a4068d251278750888cb64f
SHA5129686b7394f7d43b2705534163104aaf86469bf67ad598ce56f0f5c6033dc1400482f32524b44b1bae9757aec8e6574bbdd920da7a11bd7b7cceb21dfc05948ed
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
11KB
MD52460d047c0ef4a53c7ad4abe62cfa36d
SHA1512a01c8615a0945207f3da4c84995ef53a07bf5
SHA2565777965b3fcec42950183e6d72a2c82abe56d20ed84c69bada653ebf129a9b6c
SHA512c5115cff376a921324cdf311639210f91eefa5b756f711ffad707328d089beb73e156df52f1a06af90c079694a7696e8ac0eba8b43020d0c0a0a543a07bba57c
-
Filesize
8KB
MD5fea450f1103d42ecdb221bd044fb0587
SHA1d3a222b6cb924b4e66450875ceb6603244e3edfc
SHA256d16777a5ebb3e31775f21165f7ca1b99a1b726105b5a4ac4fdbf6d8070904c7e
SHA512257a2bf40d74b3501646c36591828b8e4f079c1d601fd5483b7e65d203db537111d9f5cc8f8911ac3bb29e1816b42c5d96a28dfb92878d5841c0de7111c14e57
-
Filesize
10KB
MD562ee35dfc27a7c61f6013ed3630eaa5a
SHA1f7ba3ff22a07d777cb5f7028b225e25662363e9c
SHA2568f63da8b96068e3404d25aaa9575f4f7380ab8a9db81961514181e680097e9c8
SHA51201d17a8d8d390fc745e56550f43b0f4bb09c7d99e9c000c5c7ed2a9c5616654b199651bdc82a5e37919df84960e83cd9d439342e24d40f14cfe04ab37c2408f5
-
Filesize
10KB
MD52fc5de4c46a53f7898f0b6ee2179687c
SHA110c55a147efab5163a8b943a55813542ea82b3ed
SHA256f8e16e3433ece94cd1387df771c36cce8100643626ccc7d1109bbaf113e3545d
SHA5129fe1d3364d079ce6cad07e70d95a8341478f937831426498085a7453b2358a5d60a9d16942bde1452f43a5dc581054b99fb6564896a262d2f0f39a51970bde92
-
Filesize
11KB
MD578bacc4f010d1d65ce1cca6c23ec3a81
SHA1f317f62a1474e636fa6dd276d2516ae2d9dcf26b
SHA256ffce72a3007f58d60d42f6031c2e3deb5825e41016a16ae15dd8b67e54333289
SHA512b45641ab15365b133662e19b35c3638acd4ec9f4e9fdb00b21c55088d6438cb3301f7105c94c632a8e2ebbb16091b7801007201bcbe49dca1688ea85906686eb
-
Filesize
36B
MD51e34cbf833d8dbabf3e6db4d12100b97
SHA1b3205bb6b943340dc5c30f1ed3bd5a902a4f9808
SHA256a532c57b3e4bb525f6f82dd17cfbf17d5101a14a6c54b73fcf070d15c0f7be77
SHA512021cd25791fdcbf8600398bbabe901947a9bf599452b83ee2f8ab3feec496387cb46438e1e18952ddc49cf6a3f26c81fb23b826ef6834750f88c05805c4652d1
-
Filesize
557KB
MD58a4e72a29c08ae2cd13bc8ec414b8fc6
SHA126f8d73bc6f5ace5cec6e3652fc6410a71298498
SHA2566513546697c3c9deb50d8dbb0cc9aa0be55487538ed482ec16b6264579de1539
SHA51277eba566c65de1327bcacadb1483f538b4e5da67c3607398d745173ade25e987f59524a5ecf065dd5f95e26654cbb5a48dc80fae995d5d2dd63c63b2cd98fb98
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
5.8MB
MD5c79bb78a0bad2559a7037913dd1f1f34
SHA1a5b36348ad93fdf971201f31136d8c9b056984a7
SHA256f63b47288af395ac9c02c980592691e2d446fe8b4d3813007433ae262af693c3
SHA5121bd81cbe784427e54903159225e0fd94c0fab1d9498c11db177d86268f34129e6835759a9a3e3822c717349043930e13168390fcc2f9a74f9699f14497cfc888
-
Filesize
34B
MD5d31cc067f585fcedecfd1c0717937ea1
SHA1de6cfbc40f02e8edbee2b3f9d094eb62470541bb
SHA2567af6c530c6538048cb17143bd35d34635db7991f9c1682b92302510aa38da5dd
SHA512080209af13c2402d994cb20aead7508ea4276811307c4a4d2cb6dd3d7c488e92896c72b928822bd0c298e54a5bdbee796fcb71e2a57715d971eeec1153f3943b
-
Filesize
72KB
MD5c1918d278ddb83dcd011ad14c365535b
SHA13ec573df51775358eba164a1118eaba31672b7d1
SHA2567fa9ae7c6ca9c58808af096aa15bf76b6b4b7c676594b1381526a16cefa3cbb0
SHA512da00922a434dba1c578666b01cfc702322ac446159382d48ac0f7a56ca33dda46bacf1ee7a8f552d930ecf86e7d10adf9a8fb7f85a535af891ca3c3d6f74974e
-
Filesize
676B
MD592ff3e51f55a2f70720c07f67acd3ca8
SHA14aaec240b744fa049bd6d2043106e9b5ca138bdd
SHA256607783ec67ab3cc77fc9298011d53f2c1bb6b0882504c0164a167f787599532f
SHA51247117d866fb6932bb0d6bf00e54a6e26517127be5f84fcdb9759372cbf6da2db4e7faf830793c215ecc94f6d080087b7a28663e4a358c9e1659e0986b3b1b93b
-
Filesize
2.1MB
MD5d21ae3f86fc69c1580175b7177484fa7
SHA12ed2c1f5c92ff6daa5ea785a44a6085a105ae822
SHA256a6241f168cacb431bfcd4345dd77f87b378dd861b5d440ae8d3ffd17b9ceb450
SHA512eda08b6ebdb3f0a3b6b43ef755fc275396a8459b8fc8a41eff55473562c394d015e5fe573b3b134eeed72edff2b0f21a3b9ee69a4541fd9738e880b71730303f
-
Filesize
195KB
MD534939c7b38bffedbf9b9ed444d689bc9
SHA181d844048f7b11cafd7561b7242af56e92825697
SHA256b127f3e04429d9f841a03bfd9344a0450594004c770d397fb32a76f6b0eabed0
SHA512bc1b347986a5d2107ad03b65e4b9438530033975fb8cc0a63d8ef7d88c1a96f70191c727c902eb7c3e64aa5de9ce6bb04f829ceb627eda278f44ca3dd343a953
-
Filesize
2B
MD5e0aa021e21dddbd6d8cecec71e9cf564
SHA19ce3bd4224c8c1780db56b4125ecf3f24bf748b7
SHA256565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
SHA512900110c951560eff857b440e89cc29f529416e0e3b3d7f0ad51651bfdbd8025b91768c5ed7db5352d1a5523354ce06ced2c42047e33a3e958a1bba5f742db874
-
Filesize
1.6MB
MD59750ea6c750629d2ca971ab1c074dc9d
SHA17df3d1615bec8f5da86a548f45f139739bde286b
SHA256cd1c5c7635d7e4e56287f87588dea791cf52b8d49ae599b60efb1b4c3567bc9c
SHA5122ecbe819085bb9903a1a1fb6c796ad3b51617dd1fd03234c86e7d830b32a11fbcbff6cdc0191180d368497de2102319b0f56bfd5d8ac06d4f96585164801a04b
-
Filesize
26KB
MD5d4fa24f021f155ce9214dccf812c3b7f
SHA1864001ab7d2c87af00b7153cd096e0454b3f4e9f
SHA2563b0889281ff6367bb736690229f461bb4ff34b7437f54a5c71b877a104c0f876
SHA512de1720af369890df89c8550d49b4e3e2e353e4a21ef30be5ebee9216e312a57ede9f7919e71de592d0bad6e482d48fb759dd1d1323caafa506634e9f877f6213
-
Filesize
126KB
MD52597a829e06eb9616af49fcd8052b8bd
SHA1871801aba3a75f95b10701f31303de705cb0bc5a
SHA2567359ca1befdb83d480fc1149ac0e8e90354b5224db7420b14b2d96d87cd20a87
SHA5128e5552b2f6e1c531aaa9fd507aa53c6e3d2f1dd63fe19e6350c5b6fbb009c99d353bb064a9eba4c31af6a020b31c0cd519326d32db4c8b651b83952e265ffb35
-
Filesize
37KB
MD5650e0e39808140a1da5abd3d27880c7e
SHA1b2ec540caf946ee5353f52227e8c9942cfb42f22
SHA256aab155dcaaafebe4b84a9aeec6ffbce9b484a99b316657ee9b7a98b346f9538b
SHA5129f00d912c123b1b235f0b63154693d294b7cf2c0571fc9bb462ba5c9ef350aa79680436ba4a094c9e28c867bc79bdeb96b0622d153a107bd8a9631d99e4fa6dd
-
Filesize
25KB
MD55121c566ac9315a53e558bf62600f9b6
SHA16da036314afefeb8c1dd88cc6eab0efb432a3b4d
SHA256d88e38df30887c722fb837278ee3782914574414c741cdfd3bd6126799fa3167
SHA5124f6de42af54cec8e63bdfc54ac250a5f5cc09081e9ae85d0cbbcad952f58727cc4cf68501a020474539c51a771537993bc12272496fea5eea924d7058f76fbce
-
Filesize
26KB
MD5c845234dd1e1cdf6f63ec1b025b75742
SHA1150dc042b54e3dc34172d5a2507125eaf619d14d
SHA256ca418ce0992368c09827a76b0cca14070b9c518badc95085c7d71034784fce5e
SHA512b08b899e523da279b9e56306b237eadc6fb91fe460b0872bb6a4b163d3c83480621d2e5e70d1de64fc9d751d8704dd4ab8400d5a901846e4775f4d34977ce605
-
Filesize
6.4MB
MD5f40c5626532c77b9b4a6bb384db48bbe
SHA1d3124b356f6495288fc7ff1785b1932636ba92d3
SHA256e6d594047deecb0f3d49898475084d286072b6e3e4a30eb9d0d03e9b3228d60f
SHA5128eabf1f5f6561a587026a30258c959a6b3aa4fa2a2d5a993fcd7069bff21b1c25a648feea0ac5896adcf57414308644ac48a4ff4bdc3a5d6e6b91bc735dc1056
-
Filesize
127KB
MD52027121c3cdeb1a1f8a5f539d1fe2e28
SHA1bcf79f49f8fc4c6049f33748ded21ec3471002c2
SHA2561dae8b6de29f2cfc0745d9f2a245b9ecb77f2b272a5b43de1ba5971c43bf73a1
SHA5125b0d9966ecc08bcc2c127b2bd916617b8de2dcbdc28aff7b4b8449a244983bfbe33c56f5c4a53b7cf21faf1dbab4bb845a5894492e7e10f3f517071f7a59727c
-
Filesize
36KB
MD5f840a9ddd319ee8c3da5190257abde5b
SHA13e868939239a5c6ef9acae10e1af721e4f99f24b
SHA256ddb6c9f8de72ddd589f009e732040250b2124bca6195aa147aa7aac43fc2c73a
SHA5128e12391027af928e4f7dad1ec4ab83e8359b19a7eb0be0372d051dfd2dd643dc0dfa086bd345760a496e5630c17f53db22f6008ae665033b766cbfcdd930881a
-
Filesize
93KB
MD57b4bd3b8ad6e913952f8ed1ceef40cd4
SHA1b15c0b90247a5066bd06d094fa41a73f0f931cb8
SHA256a49d3e455d7aeca2032c30fc099bfad1b1424a2f55ec7bb0f6acbbf636214754
SHA512d7168f9504dd6bbac7ee566c3591bfd7ad4e55bcac463cecb70540197dfe0cd969af96d113c6709d6c8ce6e91f2f5f6542a95c1a149caa78ba4bcb971e0c12a2
-
Filesize
16.4MB
MD503076700961c862bab2e80b2a4cce172
SHA102681dd25f5bdea817c9521d5a7ca9f8b8f85e48
SHA2562ffefb372c2d283200cdc3d28321c41a74505f62fe9037c6506879768b10d437
SHA51218aadbf6f072e8cb6d945386bc78e96cbe3a6fa9feba86be63ca912cab7676d8756c4f3955e8613a1f77bc57073667ef23fd5a4c7f430d9fa85c36db20bb7876
-
Filesize
295B
MD5c5199f9c2bf3ef2eab91521d51dbe31a
SHA1818de832a3a7b38c1ae7dc19a4ad82860a3d788d
SHA256cbe351f968259195b8b06b6eb84005f66199fe2d3753b272231e98309bc0f022
SHA5125c78f0688a2f9ec47e0b3f2d20202eccc6a71a71cec98ff1253f5f4c51d8246ad34507df67b433d585fb7d9eb0d061f2ba32b74b37d951b5e0fe8d33e50a5a02
-
Filesize
80B
MD51579c20d9fde5f86c0f018803add39ce
SHA177ac9a44e22bafe7fd8100c12b26cba5c524403a
SHA25641a91d07fc983893014d75c4da16f5cbf5e60a71bcd683467ad03e5f83410447
SHA512fdecbebca608cbe86c5638781de0d734773e0993ff549022f602a425fab965bcc09ab3510b395d5315b6c17caf1375d3822b0b6d7ed818516f5daf34d290f809
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmEU9fABc4EsA.woff2
Filesize9KB
MD57fd643e63fc847f47521a2604072ce9c
SHA13c94bb8e0036e871351aedcc91b1d53e9b1ca146
SHA256e6bbcc62f3b6a3ada1215006f0f6c04dbcc035efe815caf60e6a26eafc335b7f
SHA5124d5f543cda0bcd2bf7dff79e9332a5551f59a3d4a54d5cddc93f1d322b7729c8ad7147decc72f5df26fb8585ddcbfc5c517c5d69c0eb331bac8522875f342867
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmEU9fBBc4.woff2
Filesize15KB
MD5020c97dc8e0463259c2f9df929bb0c69
SHA18f956a31154047d1b6527b63db2ecf0f3a463f24
SHA25624369e1b2461af9dcefecaf9cc93d64cf22a4c5bac32506100b9e21014507bcf
SHA5120c2d5d9fd326a1cf4cb509d311ee2a5ef980e951a8996d6811d401b7ae154cfb80ae21dbb03adcb9171ab24d42a35424cd90c6966f584110bdd1c63dec099a13
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmEU9fBxc4EsA.woff2
Filesize7KB
MD5665639f6a0519416ad2904f1c218ea30
SHA1f4eed37334ad7da3aa91a555462d669cd5e140e7
SHA256da6e676db98d451a0d583e78cb5509bceab7b1b33b3b56f87cd2fd62be5516d7
SHA512972252b77c09f21580cd81f3d471f4e2fc381f2c3ea782de435bfc28f46beb81e78f52003b2a5cb00c568d42f953a0a83dc93bffe9811b6f751bb305c650b579
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2
Filesize1KB
MD50f80978b9a5916929ecd5e1e21bc4169
SHA1ec212b8b243aa4a9af8b1b04362bcfe7edc602e7
SHA256675b01281adf2cd36d2dbb9abda799bfa9dffc2178576654de53699bbfa09171
SHA512313f28d65cc4c1f86667fe93680b10722d9667653b4bbdd9ad380e8847a5b6336d18edb62b8d24bdf96adbfa0e87ddcc3a1d5905b47165d4dd4d894fa124b990
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmEU9fCRc4EsA.woff2
Filesize14KB
MD5378698af3b6776fd1e3ee0a51c3d7b87
SHA1194bafea8b9e842fbb94fc2edc5f4c38acc5592b
SHA2561f083966aceeee42dd217e2018d68b3e63fb9beea41f717ce4fa34a4df88b3a5
SHA512a5bdfcd011027ac1bfbee373b1e187153cef8798987c3c480b00bdce8ee77c46a228e89e14f35569c73ca91362dcdccc36afb296af99878725ae0f5b1c3c1018
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmEU9fChc4EsA.woff2
Filesize11KB
MD5b1b808436b5eafe9a683fff584d80fea
SHA14c64586f861b4a42528d33a687dbd4d562312cae
SHA2569c7063e4ddf4fb376fa7af3b9caf9845251f6224dffd38f1a369278c47e4b4ec
SHA512d91b6437203d1d34dbd6402fb74d5c960446c8397d47722850a5cf70a15bab71514a958bf5ab3fa0aa356cefda26b989165bdd28c8478ea387db42ceca6b2ce0
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmEU9fCxc4EsA.woff2
Filesize5KB
MD516423fb4da5bb6d54592839d6cd8e1be
SHA17860418d3d14f6b685b4d1635860be2b987d3291
SHA25666a6ef379881e3124e20f6dcecdc16672b1a7c3e415a305995621e40a075624f
SHA512fc7e0351f5625b9d47aff79171a5b2374d5618a4f68aa8cfd2ada66e635e3e90ce492570390ca0e3ce2e3a5b08686f61b7e2fb3e1d831216d661d17029a1acc8
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmSU5fBBc4.woff2
Filesize15KB
MD5ef7c6637c68f269a882e73bcb57a7f6a
SHA165025b0cedc3b795c87ad050443c09081d1a8581
SHA25629f6da0a8c21c5681511bb9b08663d3fd2c5d09c9bd8054ec354c563b8c8b7c1
SHA512d4e7de23aa4a93be278bdb2531122ef27d29b05d78d7c3223be712414bdd9562e9574d4f5187c93efebeedbd62a92c2e6bd08a4ddac035ce861df8d0ff169001
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmSU5fBxc4EsA.woff2
Filesize7KB
MD5f7059272fd8e0226350501393f4450c0
SHA1db1507e881285b8edd0304ca22dd8881e983957d
SHA256dd1862ad2a625679ff58e3992323a22aed59222fbba034f911a9a99afe76f1d8
SHA5124a05dec036f9a930e0a74e01a29b786677c68999546785a87c9107c616fe3470d1e9f1995a2e39ff34b93449b07ce5a99594079e0c4e47c53144c957dc88b257
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmSU5fChc4EsA.woff2
Filesize11KB
MD5e83b8f976d12362b33c7047c09ef586e
SHA1c384951b54b76b3fb5ebdaa6ab0872c42114cb8f
SHA256996da6758e09cf9382a091845b1fc4c5d786fac4f2825c2a2996270620c4883e
SHA512c8d699fcd4123ef8fb81846eb4fa71526a784efc24a10d683cc40213b81c855a7476d9e7487da917a1bb69e6d6a4d07d9e9035e16678af1faac9d3793fd844c2
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOlCnqEu92Fr1MmSU5fCxc4EsA.woff2
Filesize5KB
MD5484cddf4a27f89deb619b0c5c38bdcfd
SHA16b2379ecd2e6b3a47992dd34bb23f6a36f15928a
SHA25614b442bf8304eea6709138641397ce44aa9cf4bcd64d5ede30872cb64bcc9f7f
SHA51211dccd74b33972d71cfc543bb30dd99cb335a73b6baa7b584168b42da4bdeb1dd8ef8583d67bdcaf576103379966d959129f16cdf506f20d7ed660053e2cdc49
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOmCnqEu92Fr1Mu4WxKOzY.woff2
Filesize7KB
MD5c1e9793c84cb26c44ef2a2cf8b6f49ce
SHA116ac6efcfa07f298d6ea07f523d48cbbdb38a840
SHA256a223f1cb930ff49e86d7a550fb70d89526b89358f5649efbf5d0589aac159357
SHA5124b81bae4e9bfd128ae8869e6471abff66ffc636932a326d2766395898270b5e9d7254f7a29830401c93d0815fc5520abb609730eead20af26e66dd699ec821d0
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOmCnqEu92Fr1Mu4mxK.woff2
Filesize15KB
MD5479970ffb74f2117317f9d24d9e317fe
SHA181c796737cbe44d4a719777f0aff14b73a3efb1e
SHA25648c3fa6f86c54f1d9bb519220713d4b0a1f8cd1a589a3c03b9fa82e98ecb13e3
SHA51213f6b2ecc2407445c1f97109ededcc8ac64fae89fc90432a28ffdaef233b373089be25731718408c32ff3cf632afb260d0035f85fbd8b1b4e068a0d7baf9f6a8
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOmCnqEu92Fr1Mu5mxKOzY.woff2
Filesize9KB
MD58bb64952764a884d67019b3486296ab9
SHA17541837ef0d1a0e69be10243488c3f2141fd632d
SHA256491158614c16e4a767df0f1ddbb82a8462b6ba308b8774c698b82e850a425291
SHA5121eeb9c017cef91b6bd309bf5f9a1cf71ecef7d2fd667d66db2ef52cbf39d61dbd96c996d9c151742c628e0c28ce73c107a3071522839c0b8734168566c5c6856
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOmCnqEu92Fr1Mu72xKOzY.woff2
Filesize15KB
MD54743c758a952f2bd4a35d4e42afc002b
SHA1394a00a8ed0de504af13ec49be0f0884dfdac1c9
SHA2567aa3c7e43ee40c94ef77505e7da7dc587b0ebb3dd261a2c176a5d17cd0cdda5a
SHA512bcb9d877dc286dbffc397713010fd2cdb6926c3233a439cf4c6bef0c0e5c0fa62349dc621fc673bc0f415d8601b7f76164311106e1eaa96c1eeabf7baa0ef863
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOmCnqEu92Fr1Mu7GxKOzY.woff2
Filesize11KB
MD5455200cb007fe1212c668721d827c691
SHA1cfac52972c0f5bf3ea1152fe02ed3093c2217350
SHA2564c84629456a70df1137ab4bdcddba32050a2524568912630c2538746cbbcdc51
SHA512a1d5f9b2f52355648cb35fdb8aa58133a61a7a57769ae084ca109a0017a52b323e7300ed500f8ecf2ebf137994de067c6d47f4d1382197b84430704899622096
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOmCnqEu92Fr1Mu7WxKOzY.woff2
Filesize5KB
MD5a8be5b46d06bb541b0968196ee5e6bb8
SHA18bf73bc09e50908cdba9b5f808d26eeb083269ae
SHA25667afba35bed24f3ccf531a6bfd2c71ee2c6e5de74a3f28fe2b6188a8699f4e04
SHA512a29d0f79b7ff1b259e705bb118f21dea6f8422e140bd943e311019e6d09ce10422d5ac8d0a375740bd12e456d83485bbfaefbaf152efc837cc8e6fd353871b7e
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_2067535770\CRX_INSTALL\css\roboto\KFOmCnqEu92Fr1Mu7mxKOzY.woff2
Filesize1KB
MD5182ee6a4872ca8fa78048951b1561a5c
SHA1f8c3c7692ff285bac213ac0bb28d2b59ec10ad16
SHA256f2b770189d05bc3da6d684147175a1f2ab4f8f030c520f011252df8f7d6201f3
SHA512aefbd6f0b82d1cf81632b0fad08f2c20ad0bc3984cf30beb62ea25df115ab5c5f4df15a3964dd433e64dc6524a124af5c30dd67fa8f56b90ebb1fd03d879ce2a
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_231525143\CRX_INSTALL\img\common\extensions_page\icon_16.png
Filesize540B
MD567816b9f9f56727c41d64793d0eb4902
SHA199dee423dc2ec6ddb923208240b2fd13409c8ca5
SHA2567b9847ea5d27c37df0430ff4056ecf18b2248d18a10d7ee1cd7f8908f0a82d5d
SHA5126fab420866894593620e95ce3cd988e6a9525b6bdb0b4577f8ee5fe513f3ba187996ccbda9d0b54b493122136e52c7bd179da22cd8106725f24401816429a3c7
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_231525143\CRX_INSTALL\img\common\extensions_page\icon_64.png
Filesize1KB
MD516cb44c000c126b127c14cf9f3ed22c0
SHA10b4061114c152e844a53bc14ce862ebc16910757
SHA256a8498eadc5eea55439cd81c83413d3619a3865ad99dfc00f256acb3776351b01
SHA512cf4a6d0dc723482cf8eb78fcfc98e82705a00316fdbe697ad54224ddb07baa1deb429a771a36eb7932f0be1119846152326256abb567e981d93501e07a1c0e92
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_231525143\CRX_INSTALL\img\common\toolbar\icon_128.png
Filesize2KB
MD55330213b76259f66fe94259a0b1dbb98
SHA1f357c3f2953174f9bf8ab66e756559ad52753d05
SHA25670c7ce1ddcc12d93f9557683a7d3cd9a0a1439c6d07cfb4b572bdce393510c85
SHA512e759d878c37be6a538c850a61c425feedd56685c81ad8196181544d49d65f04c6931c338f331194d48a293b4989840764ff38c074305d437ec08db7c8bc17d99
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_231525143\CRX_INSTALL\img\common\toolbar\icon_16.png
Filesize494B
MD51873a110389e857c119e926275ac36a4
SHA1e8244c510448db8291330df48b84aa2bb3f15851
SHA2565e12acea6f4ebab557e98ca53b76db4d47a948110774732e2221fb65b0c37b8b
SHA5124867a0f741a8394d92455e7a442c8628d1fb59b92f1e99cb22d7bd47ec6386d195c1df7651a2cbedd8bdad6118705634f4b75e70aa8db45a98103d02406e3f2b
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_231525143\CRX_INSTALL\img\common\toolbar\icon_48.png
Filesize810B
MD53b3523979cc76c2ed6ac3109c1a8b999
SHA12d54f396901a69bf00d1d77158aeed7f7e6cf1dd
SHA256d8e879a8024aef06b1e8caa0cb51b5559d1336c3bf8e6a905749f269dd57c739
SHA512ab48dc816f042adf6df2bf2467865cb4049b3183554167e5379dd86afde77af95829050a786a992c80b2077ed5ae3dd08803ac77b07d560dc05d6cef84613a9b
-
Filesize
2KB
MD5953c970579d9c881d836db8ffd4ae32a
SHA1def328b478dc76b4789b4644cd414a00180b49da
SHA25698b8dcca165cc09ee441fdb1c0ff380b0de43ef7e3e7809886410f842bedc786
SHA512c74f56756612db80f449171cc8e620392565eb1d3102636c4751ba1eb5257034c1c66fec80b825e77fb72bb7d18932c0f38346a39202cc31b06b5b41eadab489
-
Filesize
991B
MD575113e2b7ec16b4e36617da13c47a28c
SHA1279b7de29a58745e3d58664442b7e618c6ca18bb
SHA256d39b6c79f656257fd2b5a0cf6afea3db266ebad5058ce6a418e60379aa871eed
SHA51231c4a18aa95eb778dc1c198a561c150d1ca8e24ea206f66936a9c7d05b5cbd8430bb42eeb11b526dcc96b0c29ae51e5df7dc90e805c6fddb90cc9eff666509c4
-
Filesize
1KB
MD5a783af36f1c31fc9591de76550355d37
SHA11de7131a58401fbf56e277d954fbf94d6439dfe4
SHA2569b5a3d098ba34fcf297e87363ca16af4370f8db6ebf21a179fa4e8128b80def6
SHA5126439e19c4cc53da7755820ea33f71c1de75a3904da0daeeb8929481fc5d8e6db5c5d5e6743fa9999ba5959e69b28002cfba760a830726d20c9c21ab55a832412
-
Filesize
220B
MD5606e1cd27be19689c174973a6098a1bc
SHA1541c7cbf60166653dd82c77d3e68dc9f416c12e2
SHA25655c2d883e21fd5ea754050412919cc5d87ca960e216dea38e9c788f10fc9910e
SHA5127908550179bf9a51602c86d876b37cacf17f8f5e86369d71cc3b13b41e5686577de4b5059becf6a7d4f45815f18e588e0d7e727aca8c4567cc9605d0f49b3e25
-
Filesize
290B
MD561b38b54bc7df263d8f69d0847a07dd2
SHA1d3531ebab6a0ff5793fbdb78498e62a3aefb9edb
SHA25650c43584efbdc62d2dbff5daa052ed93a6c5ce6d18da6bc011530519c36208eb
SHA512740632cbe82b6f4d2d4c0810466a035132054490b942848a8a263252f83442448eeff01639c5f4645f73facef2e71fdabd62b154b68b4b97a47ab0a6177434c7
-
Filesize
721B
MD5c64fc17d182fec45bc5b1f93f4ffa2f2
SHA17d3b4cb39d324df9231d72144e6789cd05cc4d69
SHA256d46edeed3f5a3b314038fddbf3561a065a82e2540cd7a67c6c1d37cb42c88bf6
SHA5124742c512ac052215e9cf69527e540ee4bb64feb92dc2e312d627bc7d5edc643bf19d962564d2b80526e002b5b07e718a6dbd47eb01eb2870861a464a477c3745
-
Filesize
863B
MD596cf823db162e34c049fc77fa96af44c
SHA173f419d7f7d0948d4a1f88076bdb6746c8831474
SHA2563b5c31dc22032a4130f9f11ea1ec9b1d0d1d9fad0365d29c3a7dce4beccbd5f8
SHA5128502d8e21bf73cf1e1b75f27588dc51dd7b15b2d2cdeea9ffd40b39a8302d87d4dffd2eb03180f0732a9bac585773f6c02da2ce19384e5e75de7bf49c5e13b0a
-
Filesize
7KB
MD5c0c29bcac4f13c06135e1def9d1db21e
SHA10f79a56fb5fb9b7ac0206a257d1b2120c43815d8
SHA2565740b01a67d5b1dd30f0b866a7a809a15adc2d6c7b8c2ad7bfe2242af83737e9
SHA512af66d4f8aecd5494426e343163e238ad00da7f7b067e791e7589311d923ce49a7c694be80da355b945b1943ff03bd84b87c428e32ad2ca0bc7c89fbfb1790cdd
-
Filesize
694B
MD5b135865a6825eaecaa607527df90b473
SHA1b8f257dbe6e101663819b295ca5bd673e07e9b0b
SHA256f5648f11234d0dac823962e5f658225258825fc5df08fbccada4b9714192b50e
SHA512f337b48fe0e2b783234c886716ccb996973370f47d930673f3c03d04a8579d07951345e0c348401b66cc4c334ab6770da5534547c3188da15fadd9edb7b1d15d
-
Filesize
1KB
MD54366bca21838b04da24c062b35c9f0c2
SHA1171ab2b35b3c1a39c17a43c76b560ebffccb8971
SHA256e48244c9458d8e3eabf7e42038cad12957677373a21dd0d7e5807484761bc0ec
SHA5127d2738e530dc38c6ef3dfff10552ba303e3817de410e8d59d480fb695e7b648deca452dac65036b1e24ba9444b40877b8bda5a9b72f6d0fc87ca0fe3b4bc58c9
-
Filesize
488B
MD5f5e7c61b38e320f930a496b5e3a399f9
SHA18f2673457d05afbb4c01ec9575379a90cf58a986
SHA256cd7e0886ce9fe16b92313fd37f42f8c9febcc7614da06c0f4347d17d8487c31f
SHA5124caab1866ec51e78f90b8fe42cdcd7cbe2325142a73a788a683eb83eb2d8aa5b5ae26bbebea17b923f1796bd4552e28e51abb626ce6ba0baa8c50492518d1de4
-
Filesize
1KB
MD5779db4785c2548cd52e5072716d7567d
SHA1897315287073eeb5aaf63a9c445cd0fa25aca2bb
SHA256c52c1839933926c66ac522a3d628ab543768a46246b7ff247add4afa37ddd59a
SHA51251c3c9169cbe40b4c80d1c347d73ae2d2f5797450e79f38789bc6b589b228f4378ba5cce688572b2c4e2251d503a4ce15246c653684b216f21b9817fcde78695
-
Filesize
721B
MD5aa727fd853cf4f6c16eaa38fd19c95f4
SHA1c220475c25299a223949d7616a8a7e20e275d734
SHA25647554b963dcd40b2d021b21896250442baa961a6e3a43bb84fb8d0b58d8bd85e
SHA51228a3f5581a291fd1c3c3fd9a760e50004823e56f83c9cec480961bef1eba1483789b3517bee226660b50095d0f278edf403d04370f3544b6a7ba8bfb016eb398
-
Filesize
824B
MD57e6849609d8d67c69996013b83ad0a7b
SHA13eb54a17470f6181e18a20445cb8c75ce8e9ac87
SHA256a43b337f018a3e72202df40e13424af75e1ee6be4b641640f5f6c90314d96c65
SHA51247db683a6ef9464ef8a9ae5a1c15f114efef1d64858edee47bcb95781618b190dbede711364e7136de50100091ca31855295e21e18cfa9c37d272fcbc6340ad9
-
Filesize
1KB
MD51946a69782bc8bd77b8fdfe48e3ce298
SHA193477467f1f7b56572223fbf1fee1ff17076eb9d
SHA2566ec901de0957e7f636095e1e195b620d02454fa8cff6b55875041d1360cb6cce
SHA512dcc61352b8df4085f62fc3e476a07db600a6f4f55a32dc8bc654a8a4e8cafd9abeca901c4d849b060d2ab31a3cb36ad9480e207c0964dc29031ef014634d18f2
-
Filesize
512B
MD54de4359f781e074541e4c3c58d6730eb
SHA18389a452a15264e2ce9461911381c5583ec62a88
SHA2560a1ea6c1b36473a5852fa3de8009eed63b8c7854c591f096ec93e3a60440aa53
SHA512a4f95cb5a185000ab627ca1170f0533a1e1009c6fffe42ec9ce809f0a07fbe451dc19868868ea9e3bbd702527df931d2c3b01c09a4325a28794c1ea3b89d41d7
-
Filesize
1KB
MD5cbf11794658c3af1c035a7f97a21adba
SHA1cae00e63392b086dfe73c2c5136a222663407229
SHA256bfaa3e6e45de0faa121a641563d4f202d7d66f8f52ec913a1a151fcf94b8bb79
SHA5121374e8f25f5271b645f5e74cbd0d7f58e530e0cd1fdff4193abcfbbfbe8533040c742427443548063d57dd321ba903cc618dfe585daeebea866f8d8f137ce974
-
Filesize
1017B
MD5b38c87363b1625844e706aa4e3c6d592
SHA1146d98b5db1e594baea999258ce8acd30891db6c
SHA25616567f0b04bced46058ad1d47d493936e961b048cb80b3676e9f34048d316aed
SHA512142fc4581bd78d02fb5325b1f62de61324248c9ea15c0c9488f584b77ca31305611770fea4353fd65fa6dc63e21bea768a7cbee2d1e8dd1ebf612c9d93dcefd0
-
Filesize
1KB
MD50d159cd897a44cf927685757b8614223
SHA196dfa19f8e85e1f770f7c4d560dc3c8e1a9313be
SHA2566ae57c267728fb7ae732f4f1a97be6842c6e42d1ce9b88f30e874bb27773c4a7
SHA512cc121f2bab4b6790b7a24840568eaa870d38ca31a3387623cb70d1a065a580677b0a1e95842e9a70d03440cd04a7bc068c503985fc93b273f1848335d283d847
-
Filesize
1KB
MD5787b3a29f168498aa4edbf268767e341
SHA15632aa34a588375bd45cfe91dde3ffe82e244733
SHA256febe3cb4c262ab6119c83d3368c2007371a3fa02bddfbfa7ea0e1cc30f881c7f
SHA512eeb957a316a560fe61f42a771a633a1b44dfbb079c74223a7b4cedd8a997eb5d41854cbc8040cacd59e0629bfd2b4bffb696dc908c2cc1f847dcf8d327237701
-
Filesize
2KB
MD5749dc8665ffae17a62324390045190ec
SHA1127276e4e1e9363e9dea99539e0cc29c42162a39
SHA256f052ee7d5ddc5dca8bef19ab7c3c2d5e27dcee200f69e53724a758b3cff34767
SHA512545c4330529c5618f9faecbdb2287f702eb2d269bdff2309a7d115423690bc9f0f85c1529e4e9e69e036babc9b4c7cb4cc51a633796aeb4570c1be94433bd3f6
-
Filesize
1KB
MD5e81022df088ff6ec76d1a156cbe7c91c
SHA1d11f1abc961dad32918cf3fa1201cfe2894ce139
SHA2563750424efa4a6c267bce07e1da497ac16deaf8761281b43fd22a34ea4410214e
SHA5122cf0a31738955c8c74daf7b1d86a4edd03921bd5567d11ec3874f9b17659b3f5387bd5a6f4e02940bd1333d1c00141184b4796efb5c1c0d2035642712bb14af1
-
Filesize
388B
MD586417d4909e6f38458ccd9b1f225d752
SHA1242f368bd90210ab93a16f350523d4db046039f4
SHA256d009662919cf03c3859e2d9d817b6553de2720c96e61d6eb662f70b06b8206f1
SHA512cd283eff0832dfe8ab551d5f9380eb4b57efc4941c3746eb51b1c0aef3e6fcca452651c22bd7bfacc1725eacb66ed298c7ce817ecb9279a046f2bf31c7caaddd
-
Filesize
678B
MD555f8b7f7db0532e39597da721e86023a
SHA13e34f65911f036e0c171813f681b810518dd49a4
SHA256be77ec4149d5d096a49dfbaa3f0f401aa3fa688f2e25e5167335854b11789fea
SHA512aaf28c1088b5385aa0b36fba5f6fe82ffef44de51638aef14008c1360abddae7bfc9db06bd8d220dc6693574373346abadc5d673ebc3cb1ee86c110c86daf2d8
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_231525143\CRX_INSTALL\js\popup.bundle.js.LICENSE.txt
Filesize3KB
MD5971f2937a772b71d1024b6e5edef871e
SHA1521287560eee5620301702c1b497f95e9994aa72
SHA25657f290af131c69c3ebe2d516b153c32d37588dcd227ecb9ac3bdb807106b6fe6
SHA512e43cc24946803e8dd9eaaaa631ac1aea73f2290112d0bca0cf204fa960ac963eb057dcbbd3e76d9cc8ac96d37fd3ee0910bf0fcdc0ca0d41850a3add57779de0
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_231525143\CRX_INSTALL\js\search.bundle.js.LICENSE.txt
Filesize2KB
MD5141b5f8d56daff063a60f8d5b6ed1000
SHA1b96b16f8985562b3ea3eeb255cac79a2614c9bfa
SHA2565bcb0bb4a0b6f940a31ae3acea07d209ba5d25d5e5494ebb88b5bc8da71f7d69
SHA51276d66910cb505e2a385b1e8bea6c8ffafd01d30614d5860cee94547a439aff068a520e13743febc34116914bb7186a982c16a9e79444ac2deeb42b1c7b884a2d
-
Filesize
701B
MD574d658682a89aedc22582c15fe8d8583
SHA1d0320a5c085a96d7f87a8f07e2045ffabb56449d
SHA2567f4b72bd4bb72d574b516de85126cb91d9e9492af939f3a9bae80a8ccfd53b56
SHA512cf62c3b790ac34bc07411ea158bd5a1d3e3549738aafdae6202fc37a2b429effda94ab2569f3314ad48d05c0fcf99ba97dc65b5faa1e5b92d9da41f548f0acb1
-
Filesize
3KB
MD575e461d8925e8468b3994dc838bfb68d
SHA140a05fdacfcc9f153cd3df62a95c75fe148fc0fe
SHA256fef31cd788c1845647cb739db304cb65fa21129a93500f51d8865ce52f75a0d3
SHA512880c83b8414bd441d20d61360b7018b4f6fcb68c2affd8b1e32b1d9317e86dda8f9eba925df31b552011d5158eee2f30970756b26b2e77f3cb91ae35c8c37cc0
-
Filesize
6KB
MD52ee58c8732aea4203ecb92e16e5ac68c
SHA1f8cff9d53e57833e10ad2cb2489fb75a57ea7003
SHA256cbd20bdea1a73d4cc506fbafb729d201d01fa08f1884f4495289672f34f398c8
SHA512f6deeb2e330be99e4d5ac63625f7b7f2a052ef2f778c99657714245e9b2ad912dae5029e8dfcd5affc13bc4c892d4ea508db471f009d6c550030c477ee98d87d
-
Filesize
1KB
MD570c7984777731215a65a737b98c49dfe
SHA160da2b4e5a80334aff5cab61d67fa0facc62f2f8
SHA256fbc68d0c4ed3346ae2a84580168d43b8ce12bc97564e04131ce47a0c3328f1b3
SHA5122609a01feb2f4aac8edb180d854dbb5c93e9b053791d2bfe9c1bc3d7baacb8fcc75c0953d7e150b2203ee1a2f4e65fffdd281bcbfc2fa29326576d7b887052b6
-
Filesize
315KB
MD5da8e08eca07f069aad8adfef803b37d8
SHA13222d2ce7d3e8ee38636860c650bda64c6abca30
SHA256b40d743cc3d46913e7a5b414883fb8976f8300a858d7c96aaf85255d1f1f1e41
SHA5125bbc87a39c7ffd704ab78b4e8deee8b79613a3b592dec0523e42152d459865ed552132b98f5dc67946235b5c4d3a4ac10c5907c1d846e9962424d3eb9ed380d1
-
Filesize
5KB
MD53e47b0e38d166b5928b6a59cada3a61b
SHA102071bc3bcb9cb6cd55a4cc31acd92413af799d8
SHA256da96876139ecff7bc411c18ad82f4d328c9abc06b70d8deea4da6c4851b9b084
SHA5120072caeb8aef881672bc4ec6b67fd4e73e8203afb48f2f772f62401f5acfb09e54f1b8e1a05894560cd8d13304927da434fe1f96dd877733d836d7844c57c69b
-
Filesize
6KB
MD59764406c182b5e377dc9e8023968e82e
SHA153999b0d5620d8e80f357edf7230560feec1d40b
SHA256d8254fc7b70c9f3f5e16176f6bfba0fabf44e10de59b4a32ad53a5fcabf15b2c
SHA5125b6595aec0cf73c52bb74f5b97ed92cb21fa68649911027328dfd89a0445d03bf26322fc98e410f9eaa748c01128058dfa55ae912ea5b6db6a73a433327efc8b
-
Filesize
7KB
MD5b8645df606dd756306208ec441e9c0dd
SHA18ebd4f5103dc792b6a563768d1c3d6e3b4729c54
SHA2566dde990f4e64d1ecbde90db9d3939f33b3b5c3d1b89704dbb8ec84df8f046de2
SHA51225b256e3ae975c4928d1ab696e821a4be3d5534090902573136f9cb9e3c8005e77e159918d418eb6d6a2c6c7156564d7e7846fb4ab923494ff0d2b0df1304011
-
Filesize
1KB
MD5659d696b05fd116ca3316067d7d3db92
SHA159ac6d66b9f37aca2d7073308a99809a14fdbb6a
SHA2563c7721fc41b7c3dd694ebefac4533e6a71e85cd0bb18bc66f57fc3910bcda8fa
SHA5120eae3e619e9ff32474b8094b0319066795c6dd5d4e4e757dbdae5dc1fec9fcb22b4e9d857b73e0adfbf710abada04a51e957184a107133aec1a3d9a8ae8c818b
-
Filesize
1KB
MD58d1763050160343e774a05ecfcecab6f
SHA16590bc6f21e90a7c7d0880201b40cf868de1bcec
SHA2562e9c44dea5527888048883f0558313247049bf86809f4a2fe86f5e86912a9916
SHA5127f5cf621a248aa3ece2fcda0c0820009a660b9f6d8fb781c9056527d75c236ee6b7330323f08746a85f48515a3f3b8a920fc1529f2f293f44ce6b81afaef5c44
-
Filesize
219B
MD555054c3a7a61162423844dd2c568bf28
SHA1c9ecde134d44be4d386f3c78ad3d49f7c453d3ed
SHA256fa374fb5a21037211bbf15277fdcd87c30acdc2e1cdc5f2600fea674f0394bd8
SHA512766c328ccc325d3852fa3503e3e7a4bf6f7e2a9289adbadb6fd19f53c4cf803bbe492315951d8401754cfc48a3b014e079802e27446466580e6d790661c95875
-
Filesize
1KB
MD570b8782333cd514d136052bd5bd11dbe
SHA1ed55be7868aad61d3bcfd626d439780b5afa8731
SHA256b3ab89cc16fbae38b4dfb36ab1f99d10e076542d5eb8c2edd9db3b1d1b721824
SHA5125c54e3180ffc13064eb8e744faa12ab5225a18da99dd54105c759c74175d6de1ec6f8ea45933fafdf3a8f6bce0604ac2e3a25e0a4a33df8fd93a9237d3649a9a
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_909499759\CRX_INSTALL\img\dark\logger_table_icon.jpg
Filesize2KB
MD5e90e5deda1c50ec222eb95e8a01b0944
SHA11a7b456677ce61aec40fb37830184af2f975e804
SHA2566f2fb146e6e7cac9c5634663605b6ca6318f5264587af5dd0713b04556bf53db
SHA512bf8213038767d164b6a9a8e73cebdcd0415a44f2ccd115c93f5c09e8213aae2f2bf38bd461bff87b8c331490b60d797527dca20b1746e79bcfd20591d6df700b
-
Filesize
1KB
MD516edb603cf8b20ac9fd88cef8d1c902f
SHA1680774dd3f5554b5f3801116532acf2a2e79ba04
SHA256c8a059b78c2e4bf67afd1be5bf217236136b37388b5b236168ff51aa77a9fa2c
SHA5127c66c9b0a6a3ef962ce12dd757a4fae4401219ca2e0c6551fb1e1da4f6686376bcab541b707352fa3383353d65be0477cd53ca1bfcefb4b0545e5ab2e680299f
-
Filesize
573B
MD5c5375879372df0cc99a68f5df816a231
SHA115bdaf45007394c57bd04f5608d4a029a045ca15
SHA2569342bc0b79fcbb310c8b87bcbd7c7b8fe2926de73d517e44a107c62be8d3e8fc
SHA5120417898f95b623e125ff76ba506a94aecfcb4f1c1dce0d9ef217741e550a706848a256efc0f251cf263d0da8313006dd6a27ecfbf0020bd743b0d96ef4ba1176
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_909499759\CRX_INSTALL\img\dark\table_regex_icon.png
Filesize915B
MD525881ceeccbc9c4811fcb3fd27f7293e
SHA111e7931e1b0a8a685cdae2b3322eece073b17195
SHA256438036b862d153a25a63e4681b87b3fc03201d1dac9278be0401ff6d27c69c06
SHA512a2c7505fe6b936af88b4787c0456cfab304832aae73017a69141685a2209a7288d3837c6bc950c49e504f327fe6509b21b718f00a60b055f99e940c8266e59be
-
Filesize
848B
MD52c5397bd7a1dfd8dabfb46bdc53a9203
SHA12b80882640e83038a377ad9936e842375fa65961
SHA2566f22c135d9518b7e2f5b19c2d12454620594cb6925e1869dfa206aa31abc7d53
SHA512431b3ca97bc398e341491ea389757f2c2694474be043ed1a639504776a99452d6e6f557c2dfecbe7f2e241533dc9cc3d0af0d99cda0387e1aadbc9d92728e75d
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir2972_909499759\CRX_INSTALL\js\background.bundle.js.LICENSE.txt
Filesize486B
MD59945d9516ea6d73afd16fd7dc2691701
SHA124d86c681055bec68457f4353553ebe5a13860e3
SHA2567bedb81de9bb9d9382b0fa036c6ba2d09d3583ba15b9744d58a5b3199d41f32a
SHA5126e3896324068130f2927e40dc1caf930bfebb2a274a86fdcf1e09ebbaf0d911b1bda1df34bca52c07a0c3ef1b72fd37f7ff43b5b47db5a9df17ea29e576c839a
-
Filesize
5.7MB
MD5f36f05628b515262db197b15c7065b40
SHA174a8005379f26dd0de952acab4e3fc5459cde243
SHA25667abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31
SHA512280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD5fc522f35fc222a5aeb639e719c44ec40
SHA1033d22f5c24a2d70c9b7f667a8f1a0fbb19522b9
SHA256ed91f2a410522021223f8f4f94869c0140d70f23e71f33812543019334d7684c
SHA5127ef552634698ba06248f5bf72d699927353462f9f4bf1c6d4e813e6839ec928659319907171dc4354e27370f823342af0b10f376a12b8ebc8327ad0d7258c6cc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD54f9166af1c0d9540ae69d383c208944d
SHA144671781a2856fd91c4f7568189e7d2a9bcc132c
SHA25686ed9d38398b0ef0e98f8b2708796c9a67a8c5be10d2daaacc293813a980400c
SHA5125bc59875d50eb29ff4e300a7c5114335368d4ed5d4e7bde9dec14f55cf8ac37210eeabeb0da10bb684ef74bb1b89af9bf2181934a70476128f06d4177de58573
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize10KB
MD590d2461e8820612775e12accfe1140c2
SHA1820275790d1e7b8f46a209afa808d82381c956d1
SHA25669427d695e50c54a00549b85e21f704b1d4213863a8d76162a9b7b8164b44075
SHA5124a4cb18253c7f8f036719fd1fceb337a0badf12ebb9b1b6afda8e24b36db94451e35b8e068804c77328c58f2b367eaf478a1be2f841d8eefd637beaf15f627d8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize3KB
MD574806d41b9f656a391ac43c03083c080
SHA1565db99fb621e1cfd4c884cc942533e13cb0904c
SHA256d3a5e2018c38e2b9cbdbc735fe56bd8306d78ab11fe9446fb7e243b5e1eed7b9
SHA51298460dae45c6867122acee3ccfe1a68931673dad2834e7c9acd5c978053bf245c9bf3cb9373ded1b26de3ea7a9ac21e4325e1dd9c19e253100738a3fdab6f0a9
-
Filesize
32.3MB
MD54f02ac057355b5dc73ea28aecd2d56b4
SHA132591cb75779a3e308a44e75a76f821e7dee11e0
SHA25683a5f942b2a15eab4826ef1709ec6a7f9637a7ec0fce16585776848797307fa4
SHA5129eb08f85559df6af9192bec8904097d4e43a832ba9e9cc1c7be1a366af8d103c3a6db3886f00927ae5eb62055fbc770c7b5a3d2a122a0b460b51136083015368
-
Filesize
5.8MB
MD50dc93e1f58cbb736598ce7fa7ecefa33
SHA16e539aab5faf7d4ce044c2905a9c27d4393bae30
SHA2564ec941f22985fee21d2f9d2ae590d5dafebed9a4cf55272b688afe472d454d36
SHA51273617da787e51609ee779a12fb75fb9eac6ed6e99fd1f4c5c02ff18109747de91a791b1a389434edfe8b96e5b40340f986b8f7b88eac3a330b683dec565a7eff
-
Filesize
47KB
MD5310e1da2344ba6ca96666fb639840ea9
SHA1e8694edf9ee68782aa1de05470b884cc1a0e1ded
SHA25667401342192babc27e62d4c1e0940409cc3f2bd28f77399e71d245eae8d3f63c
SHA51262ab361ffea1f0b6ff1cc76c74b8e20c2499d72f3eb0c010d47dba7e6d723f9948dba3397ea26241a1a995cffce2a68cd0aaa1bb8d917dd8f4c8f3729fa6d244