Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    284s
  • max time network
    287s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    24/01/2025, 18:29

General

  • Target

    https://github.com/imperiska/lekers/blob/main/bobpaertw.exe

Malware Config

Extracted

Family

vidar

C2

https://t.me/sc1phell

https://steamcommunity.com/profiles/76561199819539662

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:136.0) Gecko/20100101 Firefox/136.0

Extracted

Family

lumma

C2

https://kitestarepatt.click/api

https://toppyneedus.biz/api

Signatures

  • Detect Vidar Stealer 3 IoCs
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

  • Lumma family
  • Meduza

    Meduza is a crypto wallet and info stealer written in C++.

  • Meduza Stealer payload 1 IoCs
  • Meduza family
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar family
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 7 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file 5 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 4 TTPs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Program Files directory 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 50 IoCs
  • NTFS ADS 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 57 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/imperiska/lekers/blob/main/bobpaertw.exe
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:384
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ff8537c46f8,0x7ff8537c4708,0x7ff8537c4718
      2⤵
        PID:3024
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
        2⤵
          PID:2336
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          • Suspicious behavior: EnumeratesProcesses
          PID:2140
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
          2⤵
            PID:1612
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
            2⤵
              PID:5024
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
              2⤵
                PID:3688
              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
                2⤵
                  PID:1888
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                  2⤵
                  • Drops file in Program Files directory
                  PID:3632
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6d7115460,0x7ff6d7115470,0x7ff6d7115480
                    3⤵
                      PID:3880
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4564
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5780 /prefetch:8
                    2⤵
                      PID:1724
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                      2⤵
                        PID:4584
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:980
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6508 /prefetch:8
                        2⤵
                          PID:4300
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
                          2⤵
                            PID:5224
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
                            2⤵
                              PID:5412
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6516 /prefetch:1
                              2⤵
                                PID:5420
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6804 /prefetch:1
                                2⤵
                                  PID:5496
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
                                  2⤵
                                    PID:5580
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6712 /prefetch:1
                                    2⤵
                                      PID:5724
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
                                      2⤵
                                        PID:5948
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6540 /prefetch:1
                                        2⤵
                                          PID:6056
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
                                          2⤵
                                            PID:5196
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:1
                                            2⤵
                                              PID:5184
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
                                              2⤵
                                                PID:1912
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6824 /prefetch:1
                                                2⤵
                                                  PID:3536
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:1
                                                  2⤵
                                                    PID:2340
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
                                                    2⤵
                                                      PID:5812
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
                                                      2⤵
                                                        PID:520
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
                                                        2⤵
                                                          PID:5688
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
                                                          2⤵
                                                            PID:796
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
                                                            2⤵
                                                              PID:6004
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
                                                              2⤵
                                                                PID:5780
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
                                                                2⤵
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:6096
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7476 /prefetch:8
                                                                2⤵
                                                                  PID:6112
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3820 /prefetch:2
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:2760
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
                                                                  2⤵
                                                                    PID:4508
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:8
                                                                    2⤵
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6128
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5556 /prefetch:8
                                                                    2⤵
                                                                      PID:2856
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2200 /prefetch:1
                                                                      2⤵
                                                                        PID:4232
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:1
                                                                        2⤵
                                                                          PID:1112
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7836 /prefetch:8
                                                                          2⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:3200
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7092 /prefetch:8
                                                                          2⤵
                                                                            PID:4228
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6944 /prefetch:1
                                                                            2⤵
                                                                              PID:5860
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7308 /prefetch:1
                                                                              2⤵
                                                                                PID:1184
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
                                                                                2⤵
                                                                                  PID:4496
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6208 /prefetch:8
                                                                                  2⤵
                                                                                    PID:1704
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7952 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2212
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7360 /prefetch:1
                                                                                      2⤵
                                                                                        PID:1420
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2152,4446666861570255616,10737174662607335824,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7076 /prefetch:8
                                                                                        2⤵
                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                        PID:1160
                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                      1⤵
                                                                                        PID:2008
                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                        1⤵
                                                                                          PID:2760
                                                                                        • C:\Windows\System32\rundll32.exe
                                                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                          1⤵
                                                                                            PID:860
                                                                                          • C:\Users\Admin\Downloads\bobpaertw.exe
                                                                                            "C:\Users\Admin\Downloads\bobpaertw.exe"
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:5176
                                                                                          • C:\Users\Admin\Downloads\otyhojpsedfjk.exe
                                                                                            "C:\Users\Admin\Downloads\otyhojpsedfjk.exe"
                                                                                            1⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • Accesses Microsoft Outlook profiles
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            • outlook_office_path
                                                                                            • outlook_win_path
                                                                                            PID:1912
                                                                                          • C:\Users\Admin\Downloads\noyjhoadw.exe
                                                                                            "C:\Users\Admin\Downloads\noyjhoadw.exe"
                                                                                            1⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:5228
                                                                                          • C:\Users\Admin\Downloads\nyoihjkawd.exe
                                                                                            "C:\Users\Admin\Downloads\nyoihjkawd.exe"
                                                                                            1⤵
                                                                                            • Checks computer location settings
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • NTFS ADS
                                                                                            PID:6004
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
                                                                                              2⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:864
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
                                                                                                3⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:2456
                                                                                          • C:\Users\Admin\Downloads\uthjasjedf.exe
                                                                                            "C:\Users\Admin\Downloads\uthjasjedf.exe"
                                                                                            1⤵
                                                                                            • Drops file in Drivers directory
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            PID:5596
                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                              2⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2724
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                              2⤵
                                                                                                PID:5128
                                                                                                • C:\Windows\system32\wusa.exe
                                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                  3⤵
                                                                                                    PID:5332
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:2328
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:3744
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe stop wuauserv
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:992
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe stop bits
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:6052
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe stop dosvc
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:2064
                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                  2⤵
                                                                                                  • Power Settings
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:2760
                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                  2⤵
                                                                                                  • Power Settings
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5744
                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                  2⤵
                                                                                                  • Power Settings
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:5436
                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                  2⤵
                                                                                                  • Power Settings
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:4732
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:4708
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:4964
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe stop eventlog
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:5604
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:728
                                                                                              • C:\Windows\system32\taskmgr.exe
                                                                                                "C:\Windows\system32\taskmgr.exe" /4
                                                                                                1⤵
                                                                                                • Checks SCSI registry key(s)
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                PID:6084
                                                                                              • C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                                                                                C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                                                                                1⤵
                                                                                                • Drops file in Drivers directory
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in System32 directory
                                                                                                • Suspicious use of SetThreadContext
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:4840
                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                  2⤵
                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                  • Drops file in System32 directory
                                                                                                  • Modifies data under HKEY_USERS
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1036
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                  2⤵
                                                                                                    PID:5076
                                                                                                    • C:\Windows\system32\wusa.exe
                                                                                                      wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                      3⤵
                                                                                                        PID:5592
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:1956
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:852
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop wuauserv
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:4216
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop bits
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:5564
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      C:\Windows\system32\sc.exe stop dosvc
                                                                                                      2⤵
                                                                                                      • Launches sc.exe
                                                                                                      PID:3180
                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                      2⤵
                                                                                                      • Power Settings
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1272
                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                      2⤵
                                                                                                      • Power Settings
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4660
                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                      2⤵
                                                                                                      • Power Settings
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:860
                                                                                                    • C:\Windows\system32\powercfg.exe
                                                                                                      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                      2⤵
                                                                                                      • Power Settings
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:4528
                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                      C:\Windows\system32\conhost.exe
                                                                                                      2⤵
                                                                                                        PID:5032
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        2⤵
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:4796

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      d4bc32eb841f2b788106b7b5a44c13f4

                                                                                                      SHA1

                                                                                                      27868013e809484e5ac5cb21ee306b919ee0916e

                                                                                                      SHA256

                                                                                                      051cdf1896c2091e9ff822c2118fda400e2de25ee323e856bf9eb0c64c7a7257

                                                                                                      SHA512

                                                                                                      7a4963ea09832503179642ee750b1c8024373c66b4fce2bd316b782d1fc670c1c77cdb31f9316b34c78b6f3f1c99d90fb50e0500b72f4a647adf7653c44d242b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                      Filesize

                                                                                                      152B

                                                                                                      MD5

                                                                                                      c8eb7d84aaea5c0c37cdce43d1ad96dd

                                                                                                      SHA1

                                                                                                      0a27d004b734e4c486372c6888111b813e806811

                                                                                                      SHA256

                                                                                                      27ec491fe2b7f0eb567a44deb50c74408376ff3addf6c88a2b1060adc4a5976e

                                                                                                      SHA512

                                                                                                      f39070a20583f7ff33b7b3c0e97c08da2a3ff36049e256bbe0d0031bf15579c6d9c3da8d1f9daac1073519b648a1d005a8fa195ee2232b2962516e9aa14dac3f

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                                                                      Filesize

                                                                                                      20KB

                                                                                                      MD5

                                                                                                      edff034579e7216cec4f17c4a25dc896

                                                                                                      SHA1

                                                                                                      ceb81b5abec4f8c57082a3ae7662a73edf40259f

                                                                                                      SHA256

                                                                                                      5da4c64f6c1ff595779a560e215cd2511e21823b4e35d88f3ba90270d9244882

                                                                                                      SHA512

                                                                                                      ab2dcd1628a0d0cadf82eebd123526979e8cf0a2a62f08f1169d4c03b567eca705bd05a36e5ffa4f6c3df393753b03e3daa18122955dde08fd8e5b248694e810

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014

                                                                                                      Filesize

                                                                                                      62KB

                                                                                                      MD5

                                                                                                      c813a1b87f1651d642cdcad5fca7a7d8

                                                                                                      SHA1

                                                                                                      0e6628997674a7dfbeb321b59a6e829d0c2f4478

                                                                                                      SHA256

                                                                                                      df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

                                                                                                      SHA512

                                                                                                      af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

                                                                                                      Filesize

                                                                                                      67KB

                                                                                                      MD5

                                                                                                      69df804d05f8b29a88278b7d582dd279

                                                                                                      SHA1

                                                                                                      d9560905612cf656d5dd0e741172fb4cd9c60688

                                                                                                      SHA256

                                                                                                      b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

                                                                                                      SHA512

                                                                                                      0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                                                                                      Filesize

                                                                                                      19KB

                                                                                                      MD5

                                                                                                      1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

                                                                                                      SHA1

                                                                                                      6dd8803e59949c985d6a9df2f26c833041a5178c

                                                                                                      SHA256

                                                                                                      af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

                                                                                                      SHA512

                                                                                                      b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

                                                                                                      Filesize

                                                                                                      65KB

                                                                                                      MD5

                                                                                                      56d57bc655526551f217536f19195495

                                                                                                      SHA1

                                                                                                      28b430886d1220855a805d78dc5d6414aeee6995

                                                                                                      SHA256

                                                                                                      f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                                                                      SHA512

                                                                                                      7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      MD5

                                                                                                      1f141e4097306b6426499335f3fd0845

                                                                                                      SHA1

                                                                                                      ae58db70b3a5c649eed2d3416202c5b33409d28c

                                                                                                      SHA256

                                                                                                      9b4ed803cbac8d9320140c6b5daf14661b865a22787034737816e375b0fc182d

                                                                                                      SHA512

                                                                                                      4923eb24be77cfa64468dc990085ea17247ff32b074f34c3a87ef50bbcf6316927f2527f85d122e61dd3747e114e7e07216c1cadc0bfff475a7ae39113864419

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

                                                                                                      Filesize

                                                                                                      51KB

                                                                                                      MD5

                                                                                                      ced352553fc5d6112e84684d4dc6d6ef

                                                                                                      SHA1

                                                                                                      c8126a8c71e9207082e8d9c5f970be0eb1531f9b

                                                                                                      SHA256

                                                                                                      b502852e3cb9a0c47b1b333a22465948942a60a1428701fc4c269cf6794fd330

                                                                                                      SHA512

                                                                                                      457845ca26c87a95bf98965f56a7c1fd443362d53562a00448ae4c70f6a08dad3e9055b75b7e2fb76c5d1b0563c5965c156efb4e7494679d6676112f6a4818bc

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

                                                                                                      Filesize

                                                                                                      49KB

                                                                                                      MD5

                                                                                                      1b826898f22699b82093d2a379eb6925

                                                                                                      SHA1

                                                                                                      efc22651c035173392cc36e528bcc61b44d713d1

                                                                                                      SHA256

                                                                                                      d313c1bd2f9c32e1374d9ea3fb688bd7635acc6429e14319ce60fb4d363f1cb0

                                                                                                      SHA512

                                                                                                      3fe396fdee8d85d94644f438cf12719e7d0be394725058da3611d2cfe2d11e448c9a9b8909d78501b3d57eaeee5fdaa7befd4ccc1ad0fd8e7396e5a98e598bf7

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

                                                                                                      Filesize

                                                                                                      28KB

                                                                                                      MD5

                                                                                                      1752326ce45c039f4c5e81ea24c27c35

                                                                                                      SHA1

                                                                                                      4a22a9151c3c94d170cd3d23659e8e1a5a6f0070

                                                                                                      SHA256

                                                                                                      13dac981c708b9d1c6d7be7666ab5ff34718fe7d1362428217e88c75530774ad

                                                                                                      SHA512

                                                                                                      7ca5eb8b11184b97b7ecfed373420f7b9926839edcd36ea6bcc37a09190478175c49d7cfdb6dcbf1ecc8f2570feec9a0ac8aae08442fddef7986330043ff2d08

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      80adc62d8e22de847071734cd2c4ca2d

                                                                                                      SHA1

                                                                                                      75cd3cef1a1b896114c8634b4d51d4552e9d135d

                                                                                                      SHA256

                                                                                                      3791ad2094e6335c1929b77033bf9f70a26b28e66ab58429382a340eb0b17c1b

                                                                                                      SHA512

                                                                                                      57b3e7bbc1ab3027cf7a35a680589682bb7d6c9c8dcf4bd986b2d9d8301d78104db2d202610667cea2823e0d79991f7c4f8510ce740cc5946105efcf04453c54

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      624a2b3c64a6b107784a8c5e2a5ec51a

                                                                                                      SHA1

                                                                                                      ababb418deb34450f9dc982648d9780adb798c20

                                                                                                      SHA256

                                                                                                      82429d9b90c7ee3467a4f8c06c262f38b677f89670b8170584d5f094235b0ca4

                                                                                                      SHA512

                                                                                                      3f60c3641caa3418e87f2a0839edf304a42b9a0dcf80215b041fb39717d8ebb2b7b015a4f317cd973d5240df620e4e824d7a6515b71b470e0b37c731e386b9d5

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      173ef8f9655aadad713622ad997bca44

                                                                                                      SHA1

                                                                                                      087997547b7e4beea245f1e329ee7de525ce9047

                                                                                                      SHA256

                                                                                                      f7831b92999b088ce44063b6a76a6234283bd1cce01c9f9f671edd034180daea

                                                                                                      SHA512

                                                                                                      4a3933c4178f7dfa9113c3176292943e8ddd804c67280c980cde5ecca3395737fd73658eacfe3e59a41c190c6b7fe3bc13e2690817c609fca4983078997c9e02

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                      Filesize

                                                                                                      48B

                                                                                                      MD5

                                                                                                      54ecb5d42c1d81fbb956d3c573be0ea5

                                                                                                      SHA1

                                                                                                      85b0e18980edccef010b82291ae79a4b3bfdbded

                                                                                                      SHA256

                                                                                                      82a91cbd4e2c7133696e6dd0790e1130633472de35b58d42e0f9a3c93ca36c98

                                                                                                      SHA512

                                                                                                      1bc7d2eb21fc1975408e56f0e2b29dde0fa09793c93cba3b4aa7726bcf6261c8297dddcb26041be2ea5918c823b54bdac389c1f0a57ba72cec3c0acc67166227

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies

                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      MD5

                                                                                                      0c5088004a84b091d0f2b24b265d8ce4

                                                                                                      SHA1

                                                                                                      890653b324b30de569aebb55c691abab83e79236

                                                                                                      SHA256

                                                                                                      395e6e8625d2f4d552012117e3ecd59e7f95c0fcffb412cee999bdd56f19f23e

                                                                                                      SHA512

                                                                                                      a3966c2b35c98dbf5e66d9660bcf8cd8c6706155122d0cc4ee8aca2bfeedda4e1cf40a418cfb422ffe2b11d5df023b3b634053bb1aa2d97fa821ca55e0fe699e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                                                      Filesize

                                                                                                      70KB

                                                                                                      MD5

                                                                                                      e5e3377341056643b0494b6842c0b544

                                                                                                      SHA1

                                                                                                      d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                                                      SHA256

                                                                                                      e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                                                      SHA512

                                                                                                      83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                      SHA1

                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                      SHA256

                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                      SHA512

                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                      Filesize

                                                                                                      124KB

                                                                                                      MD5

                                                                                                      cc6533ea87b3a3b26dbdd5d1c22c14b7

                                                                                                      SHA1

                                                                                                      b90b89ebc7e085f4b6b83605a3f557112fc1bf7c

                                                                                                      SHA256

                                                                                                      8ca0203b7e3c865864996144d6f391c074e7190b719bdc684fa6e9f7843ca1a5

                                                                                                      SHA512

                                                                                                      081cfd904a3cd9ab0a34dc7f5e6248b6ca26d8eb28910bd0d53cd85b3e39fb122532d4c31f267f520362737d1fb4cc01b6e440c27cf4b026a04619b74f28a480

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

                                                                                                      Filesize

                                                                                                      11KB

                                                                                                      MD5

                                                                                                      166c0cf54ba5098b1292231c9c2100da

                                                                                                      SHA1

                                                                                                      3bba319421ead1847c1a10c55cf5e9e9e18aaa91

                                                                                                      SHA256

                                                                                                      d177176faeb24e512574072e81ac0a9659c52394c516a7d66055c97ffba470c7

                                                                                                      SHA512

                                                                                                      55821e69b6ec7d30c1ee1406c2595047f3f4a4b9d357bfd84839a2a4a3d6d9fa52216ed0b21f8ac65685b073b164f2150dad717dc0b58763fab5e8681def8437

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                      Filesize

                                                                                                      293B

                                                                                                      MD5

                                                                                                      b732397fa17d512cbe62d5b5b3851884

                                                                                                      SHA1

                                                                                                      97d079c13f19bb62250497e434924031f880a69e

                                                                                                      SHA256

                                                                                                      8e52b385be6ebeebee46edc6e8cd635afc7e97fc6adaa5f0b16a72ab1b8954bc

                                                                                                      SHA512

                                                                                                      c158b47004eb543ebad77b8f47276e4a02596e8a57158a771d795c75dc7b08cf305a3cdb55e60b5c25e4930f884c88c831f0e0b84917fea587ff78a4db8c8f2c

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      4f7fe2dc336ebfc52f6c8f9238e70500

                                                                                                      SHA1

                                                                                                      ffa1efb163e9119680a6e709c0a52a07853b5222

                                                                                                      SHA256

                                                                                                      eba5b7884ccd9d73102d83497a5d5ca0010ac9358ff17d5907b02217c7dd3393

                                                                                                      SHA512

                                                                                                      aceb24f2f3f2d59f5c15ac86f0050c1b4ac12180166448d61a732f0639c12227acfb7f7261eb51a834c19fd847118376d9f5fef8c71d54834f55217b7b4bd3a5

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      8227ec18fbcac8e40005ab67aa6f61fc

                                                                                                      SHA1

                                                                                                      417bf04d038b43a016dd4438bfe5aedc641be25e

                                                                                                      SHA256

                                                                                                      3a2dc587f48f59efde7986f1ede7f9d476b9f31010429e3f018ad4733dae7505

                                                                                                      SHA512

                                                                                                      56703ef3c645459f4b85b52cfd72c156d01b580fb36611ea800955f55c076a9ca4bae7cf24c392e427dbffccbc3b0e8477f5a7114f153938d287eb3e7767f919

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      c8a41bf0555e3913bfcc44f2368e6665

                                                                                                      SHA1

                                                                                                      ab37e4cc3c5115c6d5cadd4344f3c8360d5c0781

                                                                                                      SHA256

                                                                                                      650a2fb49a05487c67d9708166e0874a0dbc2d6936e2d7690ded3a7b47eb5274

                                                                                                      SHA512

                                                                                                      493d80c23c66383e3577f011dce2e9407b1d5411b6c02f8a0fa2995a906dc44aa56d76b25265e56325065427ba01907ab52281afa5962339cca67e57f0761d74

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58be98.TMP

                                                                                                      Filesize

                                                                                                      59B

                                                                                                      MD5

                                                                                                      2800881c775077e1c4b6e06bf4676de4

                                                                                                      SHA1

                                                                                                      2873631068c8b3b9495638c865915be822442c8b

                                                                                                      SHA256

                                                                                                      226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                      SHA512

                                                                                                      e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      5b034869c3007c4a09b571fc74355901

                                                                                                      SHA1

                                                                                                      a8297a84b38bb408af943eeac7f10799bb93cfc1

                                                                                                      SHA256

                                                                                                      313ab301d73abe334c4479c300acf712440108db7eaecc477ddb626b5cd2388f

                                                                                                      SHA512

                                                                                                      e595332bf6fac3cac5986ba3f3659e1240409d93a10f8abe7f718937996409015341e5bb9277a65060f129b8312ded2e149a1dc4be98bd525e746371b14155bd

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      7328b8e1c8730edc9b9dd8bb906534cf

                                                                                                      SHA1

                                                                                                      573a4c69bb8c012bf425381dab32594a8d7928b0

                                                                                                      SHA256

                                                                                                      0651fcc90ab2f7ef8e389de0f9bd5b36709448525391deeccd14a0ad52069eb2

                                                                                                      SHA512

                                                                                                      6a2fae8aa7e92aefdece6e5af00273c08930437c55be8a4ea69e3379315fc21f460008a35bf2b6c376eae5a49be0dfbdbd37aaafe82653c2d7c681275ae43444

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      fd8d733216229ba010962176c3a059da

                                                                                                      SHA1

                                                                                                      bfac0247aab67aae077b1832c39592189c89639a

                                                                                                      SHA256

                                                                                                      e93e5dd5d697c637d05488d28015db996e3edbf407098c592e4b39f3a5c001eb

                                                                                                      SHA512

                                                                                                      e7d2b3303d1efe01caf1b39fc9d8a197a0c1947c37693991362a579120e87b25b14eb1d578cdef91b99c74593fb722dd6da6284e7a69976e83120ddcf5404615

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      3d21ad5678b4ef9bb7f2d39777ab1c4e

                                                                                                      SHA1

                                                                                                      5ec0456097d4a8c71677ed161c7dc3de31ee8883

                                                                                                      SHA256

                                                                                                      cc8f7b1b701bc435268d8f825d31e4a18a3f9da888c33364029850a67a52b14f

                                                                                                      SHA512

                                                                                                      b0396195190e83ec61faa2454011e6d83dd6e8611d2e10661a1d65ca2348c36aab6dbc1d7df79762b4b6102867335eadfb534bf9b8535dccc4ccf2d8c3b36b72

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      5KB

                                                                                                      MD5

                                                                                                      4e0d772f16e32cfa7baf71aba11f5542

                                                                                                      SHA1

                                                                                                      fbe770756d560fbf8ebe1939aa1e67029ad944aa

                                                                                                      SHA256

                                                                                                      94b03dcf5a59f3575b4d2927e2b1dbbd3f1fc031546df02b892e3bdffc11cc0e

                                                                                                      SHA512

                                                                                                      e418500cb777c8bf8c249d177765c313e552264958e26976d0922fc7337fc22aa1ba3b504ce2088b1b5bb82a3149d0fbe067a643bb078a1af1661dc9b87cc6e5

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                      Filesize

                                                                                                      6KB

                                                                                                      MD5

                                                                                                      a2a743eb315d62130b399772566ecb91

                                                                                                      SHA1

                                                                                                      f4a4f7cdf7da9ed78fdd730383558b08cf8b02e1

                                                                                                      SHA256

                                                                                                      008be67c1ad274cb55b6772214fd911547a6df7085f2c8f4e7bc5639c0066eaf

                                                                                                      SHA512

                                                                                                      b23a073e6db45e9eb8436c22554ef99d93327d373e90ca982e6537d6b5b3b0f83dc8cfbf167189cb5f29c1fef28ff80cad5369feed75f7f317da1a50ac476a24

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      MD5

                                                                                                      6338e51cf2d1cb4bfea21c7d81cb3dc3

                                                                                                      SHA1

                                                                                                      0049d2863f309423d889fed141ef1f146246ac82

                                                                                                      SHA256

                                                                                                      2636a794e74289532973b8f1f9c62a0009520dad49951c956dceba846835e0ac

                                                                                                      SHA512

                                                                                                      ffcbb8f086de4ca9b51f2a86ff75f283afd9a08ba7fdfc16b119f4b80e452579fed0c7d5eb02cda11e6d7c6762ca8d5a1e542e90e106020f530d755933fb3ea2

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                      Filesize

                                                                                                      24KB

                                                                                                      MD5

                                                                                                      b321aef296129848c0c2c5c77ee69951

                                                                                                      SHA1

                                                                                                      402afa01ec8a6990a78514994f9648aedead5817

                                                                                                      SHA256

                                                                                                      e44d575c1dfcf221b68c84c2cf1d4f1bea45a7e32cd8010228acff6120daff1f

                                                                                                      SHA512

                                                                                                      cbb689d400fceb2f59d67e9e9d28007d2bb7562cf18f806420a9adbb08e0be5825153a44d4199ed03fc8e87311c2f5d4ab9aec5f3667984572070487475e8642

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

                                                                                                      Filesize

                                                                                                      41B

                                                                                                      MD5

                                                                                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                      SHA1

                                                                                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                      SHA256

                                                                                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                      SHA512

                                                                                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      2b8e9d20a536b04a10cc4a5149d00432

                                                                                                      SHA1

                                                                                                      4a75f062d3d19a9024b896a281631308c9f7443f

                                                                                                      SHA256

                                                                                                      dba094869f5de2b5d7697155c908e5ab44578a62368e419a5b15bf740e32711b

                                                                                                      SHA512

                                                                                                      8df0a591af134c05342a98dd2f94a8ef088158b88c39bf9f5369c73368bbd33821f454bf1b012ed1df055928310edd34fb53f829bc84bf8b24a803a41a217da4

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      f20e2fedc68b3dda429749c6482d1f89

                                                                                                      SHA1

                                                                                                      de7ae3a6134f8fe1954ccb815f863f4485563bf0

                                                                                                      SHA256

                                                                                                      67f1bff828882ec58538285c6593dc63a3cb51c0a912cf949d02eb26accb620c

                                                                                                      SHA512

                                                                                                      87f89fe672f55a1a1d5d5262fc07ddc79f534d78716e6159ca375a470f552c6bb1d425c0d789db6e6a57ed39579bf04db083afaafe1d59353d88b958a5df7e8d

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      d4996dc23caabfc459512922c5419351

                                                                                                      SHA1

                                                                                                      78c75b8499eee07f2377ff97db63ad2cbded2a0f

                                                                                                      SHA256

                                                                                                      426929f49eea8b6a50b88995ba6b4f0da035d832593730144872af85724ab6c0

                                                                                                      SHA512

                                                                                                      b89cf05b094778736acc48749ba52379851b2ad482bcf2da6b44670c8b7d8b419be5f7bd23cfdfa7edaa278fe4686da8958cdbbd858a2a679c73106282fa3ca5

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      5a6ae8e5d1a59a9f6d31157c00e58bef

                                                                                                      SHA1

                                                                                                      3ad72dc1f814c901b839934a905c8ebefe57cae2

                                                                                                      SHA256

                                                                                                      55366195f0a5178e4a6edee91494a81479a6dbdc78a13217226d16ccdb628b89

                                                                                                      SHA512

                                                                                                      178cc9880252aca26834903decbc6b83c9dfaea8e28f6d0648cd2da234dbe73bd6b0ec8197df8b37142a092937db3a3bbd039085e6c099775749484bb96df8ea

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      4756b7e5f6bd476ecffc26dcd7cd219f

                                                                                                      SHA1

                                                                                                      21e4784e683ddc7d6aa8b325831500bcf2bd922e

                                                                                                      SHA256

                                                                                                      a75347befae1f060f45e3900ffcd290ba7b3920275d8e6d0cb8dd6ed917ea3ba

                                                                                                      SHA512

                                                                                                      a63c5765e9f27a210ae19907efd410dd1be54e96e30ab3b669e127b5e92313bdb9a0d7b260fe16eed9bed65aa6bfce5fd40ebbd84bec5baf8f1dec33439d6ccc

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      0c3e0e8f2158d8cdf8d58b1b9c16d6a5

                                                                                                      SHA1

                                                                                                      e5b794f5dacb1a81e9d5bb8b2c05688f5b082d14

                                                                                                      SHA256

                                                                                                      f411698a2d1e0106f5dd834831215f129378681e4916c80ed92ca9ba4053f6ef

                                                                                                      SHA512

                                                                                                      fc581a8a512ca7f0c8683d14d10fa46e5ca476631ed9fefbdd495e65eb9c727acd3e47d63b1a3adbefeb99eaf2f778c4193645a7e08abe78825815fea0be075b

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      dbabc050872e39cb130fcc55f84526bb

                                                                                                      SHA1

                                                                                                      6e9966aea3c61c27a629133ef6c456f35b15362e

                                                                                                      SHA256

                                                                                                      aaba15c91b7f2d2dcf05b7730a00f2ac5e80433a84d9c7bc247bd5b13ca6485f

                                                                                                      SHA512

                                                                                                      f919660bcda0bb6f7557d02a6f9c6bd49bcd427d40d01e06bde8ed504942ae04a64b3b0fbc0ddd2487071e9518492ade65353e9c0c67aa6cc5ebb638a858f3f8

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      fdaf75f791d26662c549378522975b30

                                                                                                      SHA1

                                                                                                      57d13ff640b73e35d39900284edd70750009ebb9

                                                                                                      SHA256

                                                                                                      24b3f2fee14ebb7ef1d366d60ac67cca380e223c2c7eff86435589224b7ddc60

                                                                                                      SHA512

                                                                                                      6804e84c73e4acdb7947dfb802ab173ffe2d8bd0f597d1cc1877890c95bb3ced8ac807caba10ce383560913f0aa54b578cfcdb1fc015a81d189da40bc0439bc6

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5802e9.TMP

                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      744ddc319f832b45c6822f9bc2f68c50

                                                                                                      SHA1

                                                                                                      82c61eaea9c096d328973cc68dbb8cab4b803495

                                                                                                      SHA256

                                                                                                      a1f76b4d7558e4c781fb04b05fc91c4c87e9a3237a83c83155d57167e8bdca5e

                                                                                                      SHA512

                                                                                                      de6dfd10ddbd49e8f86dcaf8e81ab83570bf41d1f1c15558da2972a46fe364b59293121b991f60922a0488305cedcfa9cb45b9a2df67ac2fa83816fcac18632e

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

                                                                                                      Filesize

                                                                                                      116KB

                                                                                                      MD5

                                                                                                      1efbf34179607c3b7e21b3bb7d6746e2

                                                                                                      SHA1

                                                                                                      29b381a18c03a4955b55262684fe62c418689393

                                                                                                      SHA256

                                                                                                      9b34e33fff996d7368d8b1224a7d848bdbd485db04cea47f21196a20ebb1ed70

                                                                                                      SHA512

                                                                                                      6a00eb219c68f5f598521ea1bb1d25a948dfac15c5d541f304bfb08b8bec278ed172abddd6321a5a7f7d283e15e6a1df7ad5c1202d0624f9b03f35a216385092

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                      Filesize

                                                                                                      16B

                                                                                                      MD5

                                                                                                      206702161f94c5cd39fadd03f4014d98

                                                                                                      SHA1

                                                                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                      SHA256

                                                                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                      SHA512

                                                                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      2bfc6fb183502467d5144e854df4f89d

                                                                                                      SHA1

                                                                                                      fed77bc4e8f4f66b3d17ca791244b1c4efbf84ba

                                                                                                      SHA256

                                                                                                      1b622df65ab29caedd561655054851e9f4adf93d6e94dcb31c65de513ddd400c

                                                                                                      SHA512

                                                                                                      ca1114553d94ac97565d7b13fee4400e309e4c8a27708b540926b5bf143616eb20dbe6092c153e499f9e6e4a22b05d7be388fc1480392764bb3b845d20fd1d37

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      11KB

                                                                                                      MD5

                                                                                                      922a9631716b0a30a785f15e10cb6822

                                                                                                      SHA1

                                                                                                      ace9ad465f742bcc9656be5bfdfc757d5daaa17e

                                                                                                      SHA256

                                                                                                      96c07eb1ce7700b0be8cfa5997377c05a73d2b5b290d7a30e285306d11929f41

                                                                                                      SHA512

                                                                                                      4b1f4c0b30cbab869254ab310f8e50ee457b8a23210b8357d3ef8fd0c438346d0ea7506328f3c1b609c13376858b4f52bda1d24640078b924062d63a27f86894

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      11KB

                                                                                                      MD5

                                                                                                      fdb44e21378f326a981b720edc2ffa7b

                                                                                                      SHA1

                                                                                                      72f616e1ea6724701fb5f3ff67244058e8ee48ae

                                                                                                      SHA256

                                                                                                      7cfd17614c336303679424c92e3df427108117fe071ef7eaeeddad1abbc39bc2

                                                                                                      SHA512

                                                                                                      66164183cf4e265a38aa6f509eafe2541ad98b85334505401de661be32e14cbaac8f38223f56c4ee5cc52ad3d70411e09da5437a31372d83d917c60d72bf26eb

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      5f2b0524edd6f49eb37721f81740bb0a

                                                                                                      SHA1

                                                                                                      807389e5998455821da1b67a55653d478df83699

                                                                                                      SHA256

                                                                                                      788300519def0298c3f0c5d164b2405eb478e7c2c12c8faf14d6ac0548927700

                                                                                                      SHA512

                                                                                                      525fd1d4e8798638292d1cd11c894eb71cd830a72719781cfc0662bf3c55a7d7071d82783b9d657393ddab204f9ed85b77939f2112bdf4e377c9a7b449787df0

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      10KB

                                                                                                      MD5

                                                                                                      d1093275427aeccd5ec2d7d1cc6a882f

                                                                                                      SHA1

                                                                                                      ba5b83b1a6dc7d87ebf591126f189eaf59b4649b

                                                                                                      SHA256

                                                                                                      24c34c8d62acc6177b227894b5d48f7e798ebf8d36981b23bbf3c776490609c5

                                                                                                      SHA512

                                                                                                      e4ee4a88fb7ed974f62aa8f79d214acbb9a4bcc01a57968990cd74370ed195c2673c7f7f94a79730b89d9a94f3bb7c97c5012b8d580bd2b5de3064a2c12f0064

                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                      Filesize

                                                                                                      11KB

                                                                                                      MD5

                                                                                                      d6e90029919ee33c130e53a2c295d384

                                                                                                      SHA1

                                                                                                      9880ab7b75e5f838ae47c706970eab52f00a0a4f

                                                                                                      SHA256

                                                                                                      197934ffc38b74ac7a0a3916d2dcf735ed6246b8e40121062fcb06314f14ee3c

                                                                                                      SHA512

                                                                                                      ccd895f1eb3a3e5bc9fa3664a25a41a6b9ccbe58cdba42f0017f6ddddc03078826df6481c0e15347df287435237d70687b7ce807d4c5d0549ca82d2696d03a58

                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjoykgbo.q30.ps1

                                                                                                      Filesize

                                                                                                      60B

                                                                                                      MD5

                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                      SHA1

                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                      SHA256

                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                      SHA512

                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      9c2eaa8054d4f30fc6805fc9f97b6850

                                                                                                      SHA1

                                                                                                      025b85cf22bc160a13d6eebe828fbad4d8897d51

                                                                                                      SHA256

                                                                                                      93b80a36ff929a992382c27d1d48b4d471d73f55eef9f6a0283325a1418a0c9e

                                                                                                      SHA512

                                                                                                      f0c9407f3c8283a5da3037db86d897976d47cab4980adf620450b9d5d76a8824fab7d823918de6e8677089170222454e9a957dbb86287cc223061e8512b327e5

                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                                                                      Filesize

                                                                                                      3KB

                                                                                                      MD5

                                                                                                      1a74122b046e8de29a5b5eb96872ebc3

                                                                                                      SHA1

                                                                                                      370e5f47e09249046aba43278a6feb1b76eaba33

                                                                                                      SHA256

                                                                                                      95c6659b23ae143f6dca9aa76d7652a84699146cf4333dfa5f3e341401bb001f

                                                                                                      SHA512

                                                                                                      670c24ff343c9554131e9c3abaffb30baafa2e651291829527d92b265ff4eacebfcdb798c4cffba4b33a62f3fef9a88ed843771285be74b5aabf04209428c45f

                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 178741.crdownload

                                                                                                      Filesize

                                                                                                      119KB

                                                                                                      MD5

                                                                                                      65cc23e7237f3cff2d206a269793772e

                                                                                                      SHA1

                                                                                                      fa3b354d2a7a4a673d4477ddcf1e1f2c93bb05fd

                                                                                                      SHA256

                                                                                                      a57a8a3c3c073632337bb870db56538ef3d3cebd1ada4c3ed2397ea73a6923fb

                                                                                                      SHA512

                                                                                                      7596ec7aeef7fcf446328dc928a835a54fa1060264b170baf2413252977bb0ac0b8da96867895530601cc098516e7bb82d1edbabfcfccd29d24619fe89f49613

                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 341403.crdownload

                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      MD5

                                                                                                      5ea1a7c969eb2778d356f08863626ebd

                                                                                                      SHA1

                                                                                                      240a8b380bdb18b07ab9c1e82c5f382f30433ab3

                                                                                                      SHA256

                                                                                                      2b06ceffdcd7df97acd3da6e93ee5e85a6228c0557d029c4d5e3b9357a2b7557

                                                                                                      SHA512

                                                                                                      f6517d923cbfd8bc5afd97a31e3b45b39ec2dbce4660cbd75fd788bd675479ae9414786bf48c13d945798d82f9e020f0da7fbc6e0533151970cd59ee1a2ea857

                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 551344.crdownload

                                                                                                      Filesize

                                                                                                      28KB

                                                                                                      MD5

                                                                                                      753175a2a378c1448b5e6946d2421599

                                                                                                      SHA1

                                                                                                      1a856255b7868a050cebc02845e4af6acb3912ef

                                                                                                      SHA256

                                                                                                      2a216550fb6ef956beb4029c2c18049a1c66cc271470a09c3b0b6103440e7280

                                                                                                      SHA512

                                                                                                      07e2c0c976c288d3ed0ffe370f6b5538df2c89edc52a21f6025996135d8e4143341e8a0322f7acbb83b9a6c7bae7c88a492aa39c73c88b21bcce19404f133fb3

                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 729418.crdownload

                                                                                                      Filesize

                                                                                                      5.2MB

                                                                                                      MD5

                                                                                                      6f163d9cd94d4a58ad722301cf9847d0

                                                                                                      SHA1

                                                                                                      ffcf6d1a5956dfb60a0fd7267039e30fbe2fd981

                                                                                                      SHA256

                                                                                                      827642649f28e190ac328f026c6c1a332d45b2be4af76bd8f6c8e85838c90b11

                                                                                                      SHA512

                                                                                                      5503fefd77a87f8030dbd468168abeb3b778857bd770720942f3f1b41cf498f79a3f9138bb1cb7b24b52f55d67724de31aeb42225ee21c8712719323d45e7d67

                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 729418.crdownload:SmartScreen

                                                                                                      Filesize

                                                                                                      7B

                                                                                                      MD5

                                                                                                      4047530ecbc0170039e76fe1657bdb01

                                                                                                      SHA1

                                                                                                      32db7d5e662ebccdd1d71de285f907e3a1c68ac5

                                                                                                      SHA256

                                                                                                      82254025d1b98d60044d3aeb7c56eed7c61c07c3e30534d6e05dab9d6c326750

                                                                                                      SHA512

                                                                                                      8f002af3f4ed2b3dfb4ed8273318d160152da50ee4842c9f5d9915f50a3e643952494699c4258e6af993dc6e1695d0dc3db6d23f4d93c26b0bc6a20f4b4f336e

                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 988719.crdownload

                                                                                                      Filesize

                                                                                                      1.2MB

                                                                                                      MD5

                                                                                                      82b458869553d5314ec2d7bcecd8d380

                                                                                                      SHA1

                                                                                                      541fc9fb1384ffc8e1f024695a7eace668ad5ec6

                                                                                                      SHA256

                                                                                                      fd4203e487f88fd893d2c2ce3dd1ddea934c93d8f29cae146cdadab813bee7d5

                                                                                                      SHA512

                                                                                                      6551dcdad84a019bedf104a8862a28c712ce8758c54df189583f0763ed93062ca2918cef290f619efeda15bd8091096671b425ea7f9f3e4bbaae47297d5529d8

                                                                                                    • memory/1036-1256-0x0000028D78F30000-0x0000028D78F3A000-memory.dmp

                                                                                                      Filesize

                                                                                                      40KB

                                                                                                    • memory/1036-1255-0x0000028D78E70000-0x0000028D78F25000-memory.dmp

                                                                                                      Filesize

                                                                                                      724KB

                                                                                                    • memory/1036-1254-0x0000028D78E50000-0x0000028D78E6C000-memory.dmp

                                                                                                      Filesize

                                                                                                      112KB

                                                                                                    • memory/2724-1222-0x0000015234370000-0x0000015234392000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/4796-1271-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1270-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1280-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1268-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1274-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1277-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1278-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1279-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1276-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1273-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1275-0x0000000000640000-0x0000000000660000-memory.dmp

                                                                                                      Filesize

                                                                                                      128KB

                                                                                                    • memory/4796-1272-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/4796-1269-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                      Filesize

                                                                                                      8.3MB

                                                                                                    • memory/5032-1262-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/5032-1264-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/5032-1263-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/5032-1261-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/5032-1260-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/5032-1267-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/5176-1161-0x0000000000160000-0x0000000000520000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.8MB

                                                                                                    • memory/5176-1186-0x0000000000160000-0x0000000000520000-memory.dmp

                                                                                                      Filesize

                                                                                                      3.8MB

                                                                                                    • memory/5228-1220-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/5228-1165-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/6004-1221-0x0000000000400000-0x000000000040E000-memory.dmp

                                                                                                      Filesize

                                                                                                      56KB

                                                                                                    • memory/6084-1197-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1196-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1198-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1207-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1208-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1209-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1210-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1211-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1212-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/6084-1213-0x0000014BA0F90000-0x0000014BA0F91000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB