hxxp://poki[.]freegames

Resubmissions

06/03/2025, 15:29

250306-sw9ldasmw3 10

06/03/2025, 15:23

06/03/2025, 08:00

06/03/2025, 07:24

06/03/2025, 07:17

06/03/2025, 07:11

05/03/2025, 18:34

Analysis

max time kernel
539s
max time network
1052s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2025, 07:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://poki.freegames

Score

8^/10

bootkit defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 3 IoCs

flow	pid	Process
191	312	msedge.exe
224	5656	saBSI.exe
284	312	msedge.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	memz-trojan_MjqN-N1.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation	UIHost.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 10 IoCs

pid	Process
4180	memz-trojan_MjqN-N1.exe
5792	memz-trojan_MjqN-N1.tmp
5108	saBSI.exe
5656	saBSI.exe
5104	installer.exe
4868	installer.exe
6284	ServiceHost.exe
7120	UIHost.exe
6068	updater.exe
3492	winrar-x64-710.exe

Loads dropped DLL 10 IoCs

pid	Process
5792	memz-trojan_MjqN-N1.tmp
5656	saBSI.exe
4868	installer.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
7120	UIHost.exe
7120	UIHost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	salinewin.exe
File opened for modification	\??\PhysicalDrive0	salinewin.exe
File opened for modification	\??\PhysicalDrive0	salinewin.exe
File opened for modification	\??\PhysicalDrive0	salinewin.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-zh-CN.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-ko-KR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-ja-JP.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wpssubscriptionexpirydate.luc	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_msgbus.js	ServiceHost.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\eula-fr-FR.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-pps-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\icon_failed.png	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\eula-ru-RU.txt	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\wa-res-shared-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-checklist-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\searchbehaviour.luc	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\wa-res-shared-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\webadvisor\wa-ui-dialog-balloon.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-es-MX.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-es-ES.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast-risk.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ss-toast-rebranding.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages_web_view\nps\wa-controller-nps-checklist.js	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\eula-el-GR.txt	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\wa-res-install-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa-ss-toast-variants-checkbox-unchecked.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-adblock-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-fi-FI.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-score-toast-nb-NO.js	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\eula-es-MX.txt	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\wa-res-shared-hu-HU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ext-install-toast-cs-CZ.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-de-DE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\context\wssversion.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\balloon-arrow.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-el-GR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-cs-CZ.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-de-DE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\wa_logo2.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-upsell-toast.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-da-DK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\dailypingmetriccounter.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\logic\smart_toasting\selectors\smart_toast_search_setting.luc	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-es-ES.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-sstoast-bing-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-upsell-toast-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\events.json	ServiceHost.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\transport_aws_apigateway_v1.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\builtin\icn_mshield.png	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\MFW\packages\webadvisor\wa-ch-store-overlay-ui.css	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-overlay-tr-TR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-pscore-toast-ru-RU.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-fr-CA.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-uninstall-sv-SE.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\uimanager.dll	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-webboost-zh-TW.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\analyticstelemetry\events\analyticshandleonnavigate.luc	installer.exe
File created	C:\Program Files\McAfee\Temp1828546995\jslang\eula-fr-CA.txt	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-dialog-balloon-pt-BR.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-oem-ss-toast-variants-sk-SK.js	installer.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-shared-de-DE.js	installer.exe
File created	C:\Program Files\McAfee\Webadvisor\Analytics\Scripts\uwp_storage.js	ServiceHost.exe
File created	C:\Program Files\McAfee\WebAdvisor\jslang\wa-res-ss-toast-variants-hr-HR.js	installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 12 IoCs

pid	pid_target	Process	procid_target
6052	5792	WerFault.exe	158
4476	5792	WerFault.exe	158
4148	6220	WerFault.exe	232
7844	6924	WerFault.exe	234
1144	6388	WerFault.exe	231
3368	1212	WerFault.exe	241
7300	1816	WerFault.exe	223
2772	5444	WerFault.exe	229
3248	6132	WerFault.exe	202
3432	3544	WerFault.exe	237
5760	1200	WerFault.exe	226
3760	6924	WerFault.exe	234

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memz-trojan_MjqN-N1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	memz-trojan_MjqN-N1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	saBSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	salinewin.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	memz-trojan_MjqN-N1.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	memz-trojan_MjqN-N1.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	updater.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ServiceHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	ServiceHost.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000_Classes\Local Settings	memz-trojan_MjqN-N1.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\ = "McAfee SiteAdvisor MISP Integration"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\x64\\WSSDep.dll"	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ThreadingModel = "Apartment"	installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32	installer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}\InprocServer32\ = "C:\\Program Files\\McAfee\\WebAdvisor\\win32\\WSSDep.dll"	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{21CBFEC0-E728-420C-B4A4-A58AD2089ABA}	installer.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
2708	reg.exe
5896	reg.exe
3808	reg.exe
5868	reg.exe
2492	reg.exe
5028	reg.exe
3184	reg.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 040000000100000010000000e94fb54871208c00df70f708ac47085b0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b81900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b4200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 5c0000000100000004000000001000001900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c040000000100000010000000e94fb54871208c00df70f708ac47085b200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	saBSI.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 630002.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 220616.crdownload:SmartScreen	msedge.exe

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	206	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
4112	msedge.exe
4112	msedge.exe
2572	identity_helper.exe
2572	identity_helper.exe
3568	msedge.exe
3568	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
1300	msedge.exe
6132	msedge.exe
6132	msedge.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5108	saBSI.exe
5656	saBSI.exe
5656	saBSI.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe
6284	ServiceHost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	6412	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6412	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
5792	memz-trojan_MjqN-N1.tmp
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
5792	memz-trojan_MjqN-N1.tmp
4556	salinewin.exe
3492	winrar-x64-710.exe
3492	winrar-x64-710.exe
3492	winrar-x64-710.exe
3876	salinewin.exe
5584	salinewin.exe
5672	salinewin.exe
6132	salinewin.exe
4612	salinewin.exe
5716	salinewin.exe
2820	salinewin.exe
2844	salinewin.exe
4640	salinewin.exe
6204	salinewin.exe
6060	salinewin.exe
4604	salinewin.exe
4488	salinewin.exe
7160	salinewin.exe
2676	salinewin.exe
5948	salinewin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 2104	4112	msedge.exe	87
PID 4112 wrote to memory of 2104	4112	msedge.exe	87
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 2652	4112	msedge.exe	88
PID 4112 wrote to memory of 312	4112	msedge.exe	89
PID 4112 wrote to memory of 312	4112	msedge.exe	89
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90
PID 4112 wrote to memory of 2468	4112	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://poki.freegames
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc55f546f8,0x7ffc55f54708,0x7ffc55f54718
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7328 /prefetch:1
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7312 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6132
- C:\Users\Admin\Downloads\memz-trojan_MjqN-N1.exe
  "C:\Users\Admin\Downloads\memz-trojan_MjqN-N1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\is-G7UBG.tmp\memz-trojan_MjqN-N1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-G7UBG.tmp\memz-trojan_MjqN-N1.tmp" /SL5="$E0290,1598543,845824,C:\Users\Admin\Downloads\memz-trojan_MjqN-N1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\prod1_extract\saBSI.exe
      "C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\prod1_extract\saBSI.exe" /affid 91082 PaidDistribution=true CountryCode=GB
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:5108
    - - C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe
        
        "C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe" /install /affid 91082 PaidDistribution=true saBsiVersion=4.1.1.865 CountryCode=GB /no_self_update
        5⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5656
      - C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe
        
        "C:\ProgramData\McAfee\WebAdvisor\saBSI\\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:5104
        
        C:\Program Files\McAfee\Temp1828546995\installer.exe
        
        "C:\Program Files\McAfee\Temp1828546995\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Modifies registry class
        
        PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.fileplanet.com/windows
      4⤵
      PID:4856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffc55f546f8,0x7ffc55f54708,0x7ffc55f54718
        5⤵
        
        PID:4832
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 932
      4⤵
      Program crash
      PID:6052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5792 -s 932
      4⤵
      Program crash
      PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:7084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:6872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:6768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:6908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:6444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7612 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1748 /prefetch:1
  2⤵
  PID:6804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=936 /prefetch:8
  2⤵
  PID:6912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7968 /prefetch:8
  2⤵
  PID:6384
- C:\Users\Admin\Downloads\winrar-x64-710.exe
  "C:\Users\Admin\Downloads\winrar-x64-710.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:7008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:6968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8148 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7504 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:6636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8704 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9008 /prefetch:1
  2⤵
  PID:6336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8908 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9428 /prefetch:1
  2⤵
  PID:8104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9576 /prefetch:1
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9644 /prefetch:1
  2⤵
  PID:6612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,5723052476296655257,16614863636824557124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:6108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x398 0x3a0
1⤵
PID:5440

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5792 -ip 5792
1⤵
PID:5892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5792 -ip 5792
1⤵
PID:2548

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6284
- C:\Program Files\McAfee\WebAdvisor\UIHost.exe
  "C:\Program Files\McAfee\WebAdvisor\UIHost.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:7120
- C:\Program Files\McAfee\WebAdvisor\updater.exe
  "C:\Program Files\McAfee\WebAdvisor\updater.exe"
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  PID:6068

C:\Users\Admin\AppData\Local\Temp\Temp1_salinewin.zip\salinewin.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_salinewin.zip\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4556

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5104
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3184

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4880
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2708

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5672

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5896
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 1376
  2⤵
  - Program crash
  PID:3248

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4612

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5716

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2820

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4640

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6204

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6060

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4604

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4488

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:7160

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2676

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5640
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:3808

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x398 0x3a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6412

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:1776

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:1816
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 1100
  2⤵
  - Program crash
  PID:7300

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:3656

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:4220

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:1200
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1200 -s 1188
  2⤵
  - Program crash
  PID:5760

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:2336

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:2188

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:5444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5444 -s 984
  2⤵
  - Program crash
  PID:2772

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:5900

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:6388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6388 -s 1084
  2⤵
  - Program crash
  PID:1144

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:6220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6220 -s 1076
  2⤵
  - Program crash
  PID:4148

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:5364

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:6924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 1048
  2⤵
  - Program crash
  PID:7844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6924 -s 1188
  2⤵
  - Program crash
  PID:3760

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:2264

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:4664

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:3544
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1188
  2⤵
  - Program crash
  PID:3432

C:\Users\Admin\Documents\salinewin\salinewin-safety.exe
"C:\Users\Admin\Documents\salinewin\salinewin-safety.exe"
1⤵
PID:3852

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
PID:2164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  PID:6864
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:5028

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
PID:2592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  PID:1580
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:5868

C:\Users\Admin\Documents\salinewin\salinewin.exe
"C:\Users\Admin\Documents\salinewin\salinewin.exe"
1⤵
PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
  2⤵
  PID:6352
- - C:\Windows\SysWOW64\reg.exe
    REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
    3⤵
    - Modifies registry key
    PID:2492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 1888
  2⤵
  - Program crash
  PID:3368

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:7532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6924 -ip 6924
1⤵
PID:6296

C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe
"C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe"
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6388 -ip 6388
1⤵
PID:1684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2336 -ip 2336
1⤵
PID:6656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 5444 -ip 5444
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3656 -ip 3656
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 6132 -ip 6132
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1200 -ip 1200
1⤵
PID:3524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6924 -ip 6924
1⤵
PID:6212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3852 -ip 3852
1⤵
PID:8052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\McAfee\Temp1828546995\analyticsmanager.cab

Filesize
2.3MB

MD5
864d55d9ee7fec0beb78278f58d4e1b2

SHA1
5fcf940d5474ce9adcb986a4442c9a3e4faf87de

SHA256
85569b3e71b983863687d3fa48c45ece1d3282ef3aa9989f02552923d5a2d83d

SHA512
502a9f037d3bd620671f96bee1e5aaf6b1e1147a9af77360f3e07f4f21c43e34b9c26e86438ae88b803fb337cb097da627b64f6a95a6c2d7c625765d80d93622

Download Submit
C:\Program Files\McAfee\Temp1828546995\analyticstelemetry.cab

Filesize
51KB

MD5
55eecd40d5105e22fb75edd5a8dbd005

SHA1
5b2e41e0430c176daeab4123c0b304a55d89ae26

SHA256
09ef9fd9f988227e646478d43a60028c1e89ced52d0a30a008eac757819d0be4

SHA512
4e8d79478fe2b148ac6d8e15ce0746252b53b617d89cb7be385e7355d759d448c9d4e6492eeb319351487c1abd97f4ed4a386279d28e787ed180ec639b994157

Download Submit
C:\Program Files\McAfee\Temp1828546995\browserhost.cab

Filesize
1.8MB

MD5
3d7a0864f4a1b3a8e87c0d6506c500ea

SHA1
5b6a914698b033becb1751122d69bb4c45b7e92b

SHA256
8ffaeb8a14bda1a438f7e3ec2f0e5b821ebca73d1fd7f12345736350cfec2d40

SHA512
e4ec5d3b1121b770b839304043914bb2b6e27ece9b1a59b2144b7df824d965a6e8a77ee7c19a2050f882bcc9068e28f93cfef327540b3ee25c5a9e1feb701c51

Download Submit
C:\Program Files\McAfee\Temp1828546995\browserplugin.cab

Filesize
4.8MB

MD5
8eecbabcbdbcd8ca5c65515045d62a47

SHA1
cc938aab2c7dc76abc0cfd0ac4d10a50d08917dc

SHA256
cb532cb1e01c889bbb63ac8f23e863b87592f6dfcdef9f5558c75eeb898fe672

SHA512
f70cf782f1c0caa5307ed9abe5ba9bfe6b6ae7dfcf15ebb9163a4dd6418237fd69a033b71c27582cd743c79065fddb0c77bfecbf02ebcb8a17a8755a1115d034

Download Submit
C:\Program Files\McAfee\Temp1828546995\installer.exe

Filesize
3.0MB

MD5
8e9953b04910c76f284f0e34e1f9921e

SHA1
7723078a62198c0e43bb48f6a20bce16d3752cff

SHA256
8db3fa3f2871b611bfcbb2a0a148b6780ddda432b415a9c4efd1241c0b9f6152

SHA512
ec6a9b7a4372cda8baf8fc3c9e3c2120a1fb30f5ebbaf5cb97f4252fc2f4754e37547a56e2f8df6c08a271b2e0f5706ba211d7386e058eb7dae25885ac57dcd4

Download Submit
C:\Program Files\McAfee\Temp1828546995\l10n.cab

Filesize
235KB

MD5
4f3c2534f38d68f58af803eb2d9daed0

SHA1
18d6200a4ed76e1e6d75320cb3fd4d8c600feab7

SHA256
58a45834076f1daf03689c58a3e91b6900086d882414aa568fbc17750beced93

SHA512
c8b9131afdf9d82b9d5ae393c55fff3655768a549875da7be4fb4ef60be07406aa2a3b5a28a3cce263294226fbee79cb40d1e2d3ae97bc91fc90adc167d731c4

Download Submit
C:\Program Files\McAfee\Temp1828546995\logicmodule.cab

Filesize
2.0MB

MD5
8afc657959a193b215286a805c6120c1

SHA1
9df7c78fc53666a6f155e1cb625960afbb10fa0e

SHA256
c955fab377dc972dae8f4c81f34609562a98bd1b197e247b0399443946f6ccaa

SHA512
ae1e57b87655fe89f97b33403a5faf374545459fd93c7ac5ab529d157d4ff8bae80adbf627a49548bea96410ea64d8e4c951452ea278a8a2d19a0fe6347494d1

Download Submit
C:\Program Files\McAfee\Temp1828546995\logicscripts.cab

Filesize
53KB

MD5
4a1e091a0ca2936a966f2e9f52d465ce

SHA1
23427b1a73f5608da0bb384872f5aca0fd719ad6

SHA256
c159e19b01505beb35eca7a263eb3f06bb9e0035bc5d1fe3534105a63f9dd7eb

SHA512
d17cc6b80f3f8855ce45d189224179d3b963d4bb3695197b7e523067bdb491e2b1e041d2c268eb9ac7110f6c933a51392c36b081f756dddb2c222a2a1f23e336

Download Submit
C:\Program Files\McAfee\Temp1828546995\mfw-mwb.cab

Filesize
20KB

MD5
4d4419863b2d75c020653bb143fd7414

SHA1
d1ac1a13f40a55598120986d594a2a91d4af9649

SHA256
ecb54bf81181dc3d1ad96017aec97a20006008ac98d42e373f1f070eb827c2d1

SHA512
36f7bd0325da60a447d79ebfdf274456e30c59043e961efc214de8d11ac88d68e8b4350bdd1055c646516dab24d417712cee5d85fe51c428d3c418cade9a4e6c

Download Submit
C:\Program Files\McAfee\Temp1828546995\mfw-nps.cab

Filesize
22KB

MD5
1645fc9ea5c2b87cf909b7d48eb9d770

SHA1
0c9eb83b6125358bfef59dfd1fd198e93fbea0a2

SHA256
33122a2e9a4a9f30ad8705d48c17828d5b88add5eabc7fbcbd45986077c3bbb7

SHA512
d8584ccd4e6f1f8017458ead45642c3f8c9a58fc1f407aca565e9e57d48ff5e9ae4cc53b06348b6c5dbf628ccc18a124b8e5289a2917605be265d0828eff1c16

Download Submit
C:\Program Files\McAfee\Temp1828546995\mfw-webadvisor.cab

Filesize
722KB

MD5
94336d133378ba6a0ccc361fb0ee7351

SHA1
c3e24a05aba27821305fc374a2fb911881543a2d

SHA256
fe7c259bcdc9afa2b1acbc4e3ecd5d7257a76eaf8bf7cef1b338cc484600be76

SHA512
f37c34b04ef151835437ce4b5f1824df095bb2a66f89af3a10389795ecae36c7274237b26b74a1312106e29dfe44178f80a30f6c7c66fcf67d407e1276da40e8

Download Submit
C:\Program Files\McAfee\WebAdvisor\Analytics\dataConfig.cab

Filesize
75KB

MD5
9aad505f4dddce6466dcc8b2c3aec2ee

SHA1
82a6057951c1e7acc5f2d409db067e940643a25e

SHA256
3caf5e542ad5e1afd5cd922ec581f4f80987bb011f4a4d45f796a65677309820

SHA512
0eef8e346b19fa78917e11bd5b0a81178d66d2d0c116dee9f81db906fd35bcb53b1ae7715e7a878a90097e5bbaad12c121d49e746fb1162415571c51c8bfd97a

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
748B

MD5
2882eb9b977ef9fec3c3ba09297906fd

SHA1
aad3bd8eaf97f5a1fe27264e3a015eae0ddc1ac6

SHA256
bdc4e90a8738246e8c2113356ecdc49c5b64b22a05d521af6d523ab76446070e

SHA512
97beea9fa4e0642f86d62a5b28c26bfe9180137c7d3ff9e012820f32aea9b0565d683c53f3cc8c80aee8626180ee83ef6bf3abb264f4c71cf204ab2d05e2982a

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
1KB

MD5
2c2f26f198dcaa002d0b6829c1c05f34

SHA1
f263b1ad8033556be99c3d95de2f598eb6d50261

SHA256
7cf00fb3a9b645c8e2f24624c388c4b04b3a1606b0823e31c2839d3fc7e709d3

SHA512
cabf6a20d44c90ec275076988adea15635bc5452956c2717edc551d897f049b27d8bfa43437d32e7c04cf3edf90fed538341868ce495a381ceab87681a24282c

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
2KB

MD5
4cf88bdd8049e55db133bde2777f6072

SHA1
05dec1b50ef3fdec18ecf20bbe4b626103c959a9

SHA256
035b78d7a05960e4fae00604dcdf0c4b08a408d058d39277baba709194c9c615

SHA512
801fd630fa424884e2cce6f0b33cadb4f88d23ff4e5bd542919d1d607e211f51097162a1a88d696f416961c7ea49b0c70d36f1195b8b902d9abb1121b79bbdea

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
3KB

MD5
c43736212c07a8276fa80a9b7aa38574

SHA1
3986245439307356b2f374867bf203f71deb63d1

SHA256
d9574a9c26ec8c2bfa15cdd245ff0c133c8115a3e5251ed66bae23b67a083be1

SHA512
1b9e1c88ddcc48d673c2f4964d211af20c0b5583e4ff8b2c4fbe9f50c98d399873bcdc1d74cd9ace7c607053cad4c679fce9fc883c321fd54f8617c46ba7ecb1

Download Submit
C:\ProgramData\McAfee\WebAdvisor\LogicModule.dll\log_00200057003F001D0006.txt

Filesize
4KB

MD5
bf59ac9c815487ad0d393d439d5e3d99

SHA1
b8d7500fdd4bf3e08104e15c8b8c8cb3c1429264

SHA256
0747dfc6d8cd7ecb555b77346bd229e3e8a9d1da39ccb3211da228179caeb49c

SHA512
8c5003df3a78e9b2f9223baf8f4f5d78d5251a29eb393c12cc27d2c2138fc838bc4af21d3a0ccdeedfe79f9db75024c20c2b4c66cef8e4a218572b424615aa97

Download Submit
C:\ProgramData\McAfee\WebAdvisor\ServiceHost.exe\log_00200057003F001D0006.txt

Filesize
4KB

MD5
2d186ae28af2cac565dca33404f60a69

SHA1
30cc1287a5a6da6be2625759c8084f294d621e4c

SHA256
45dd07b5a7089ffe33baeebc337c1b97b2dbe87d3ebd7141a35160e0500aa239

SHA512
462a1c29714c4d1292a3d1b7cd5b8c92ff654f92cd890237b0ca97d9d7f15361d74e29bd3119aa5b1f211a2544c5b9abb364ec2656176b4d5539f4f324f593a3

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
652B

MD5
fbdc38a39b70b5d9ad39abc0d9c704f7

SHA1
d1793b5719f170a3a0164f400efb581e68b37666

SHA256
cbe36185b48e9ce55e479de95e423d247b277c706234b14865ae9630cca4d2a3

SHA512
4e712363e9f7f338839a7974481fd907611fd70e4b88a4b200a07ccbee644b6c130f31eab1aa446d362fd184db769513f34405bed1c78769ef4bd9bc5704761d

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
1KB

MD5
81d34339967adbb6e7983ca747a63a8a

SHA1
5c38d72a7b6104ad7d740f385088ad21efec17b3

SHA256
03c59ddb07e369bce880f516d22037e371fcc9f530a34d814f0474ced99f1068

SHA512
04d33f1234b39309cc88037604fd02cbc2595d66849eb7a5913c3de5d2e272028a98fe43ad0563584d70e1683af136f62aee806b305f9694dd5511ea5891309c

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
2KB

MD5
e79a6c603e976481576d0509c0f69fb6

SHA1
f81737e979da7d76433275b48f05cb331c5e4ee0

SHA256
6f8b362a6f924a66dca8e1af6f2c72bd9615ba6d44766e10ad4682d8bad80e98

SHA512
c297dcd8dd6059fb7d0d2db073f7645870cbcc247b1a03a164642d73141357fee03f2cc7f54df12ff33eabf1aabfc1d0e8e369ee4309dd415de7e4bea64701da

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
2KB

MD5
ee9b923536f93c9fbc3376faedba6473

SHA1
b348fa99c407a9941e55b6deb2f5c09ad1c05495

SHA256
c33045b2057ff8af42a6598995f703768bc6a206e72589198f9040266760a4b1

SHA512
66f48b59d8e891619470cba87544eb690649631c0ba0ae852b1b41028caaccfa760792e05b0addda73e320c1b483124bffb1de6e74d1ab00889030f4b36c0655

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
3KB

MD5
1ce92ad9cd0120a08c99d6e7a8e8cf30

SHA1
bca4f77955ce525c140411debc068c0a13b16854

SHA256
65e0cb76edb1ce816eae6b3b4a5c098dea9a801c4c7629e732cf4de5c6671d69

SHA512
c39689805084669da2884c8fed4c75ba4af49d37045cda4ff8e24efb7c128576d16f5d8961ec712c620def327c54cf33fc35e976edcb06310d359d38b24bb9f9

Download Submit
C:\ProgramData\McAfee\WebAdvisor\TaskManager.dll\log_00200057003F001D0006.txt

Filesize
4KB

MD5
d3a749dfde38e227ca9daf60489f47e7

SHA1
e4c888b297bbdda7709b352c5f27650437be346c

SHA256
5fb9300e4470d15c731bbc83a303a31365ee4b036d1c871b4640c93b54caaa4f

SHA512
27b099a151ee1cfbb3115c48a98969daa2a5f6c795564716fd516aff2d43ca04d26be2522bba299ccf2cfb48cd0e9784e7bc0ab85e57c2b657d9ba24248ef9ae

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
2KB

MD5
7fe6683f87fde9aa96333b8c91ef8dfe

SHA1
34a1db425bdccafd52e25208b8d2bc1dd10f9195

SHA256
e4be30302ef6d215535d4d8b4a9fa66a25bda75dfc7e163b9ff54dd70ef30fe8

SHA512
87352f292ae260f9c0f971dc19f273fe9e54565f554a990b160e05837a312826e1a017846e50f67785db927254ce5d87a1ad58dab1d53fe458a51d45615b1b7b

Download Submit
C:\ProgramData\McAfee\WebAdvisor\UIManager.dll\log_00200057003F001D0006.txt

Filesize
4KB

MD5
21413236ada26f60eb6fc20eae2bb381

SHA1
b5d9357c26ed579e08a10c9701b8cfae47ff958c

SHA256
a7f271fecd8a9d927db8c66e24988732a0107f9b8b52b784a54e2c77afb596cc

SHA512
e5ad868112fb875949ed4dbc3061eb949ebbb1bb53a67beafdbf30e9e192bdba099fc6aeb397776837ee368bb5516551c5c961e9c09783f3e76f8e5cf31b6adc

Download Submit
C:\ProgramData\McAfee\WebAdvisor\saBSI.exe\log_00200057003F001D0006.txt

Filesize
302B

MD5
4d419f97002e68ebbfaf1e868afd4593

SHA1
88b84b4d497769550f3c498b7fb646588bc1eaef

SHA256
2764fabbc77e3c623a62ea2e53062a474824faf65eb07e323f499f3fc04dadf7

SHA512
0be9c6a01d776367b5183d2abc1c16ac5234000492718bcfa596e11869961ee2d32a788eaf7a87d806426257b899a57807b029ebddb4fd42ca46ca51169d7f64

Download Submit
C:\ProgramData\McAfee\WebAdvisor\saBSI\installer.exe

Filesize
25.8MB

MD5
bdc856946755585518b19ca8411aa834

SHA1
a209dba1af78bff725f90c40f7eb140350eafd73

SHA256
76ddfa53f14675dcb2e1437115190afa04bed37691bbbd1c50fe81823d731119

SHA512
3785ff7eba7fea955b035aba0c114902d589a73ae0ab47c18aeb5f811b08f4398d523968d8fc877559fddf6c4ac2820cc3f48a09258b548eb6d68a191228e0cd

Download Submit
C:\ProgramData\McAfee\WebAdvisor\saBSI\saBSI.exe

Filesize
1.5MB

MD5
7a1b6316d5d64a740b847d8261ea3e83

SHA1
e130deed179693218679e09f0eef6fb33c369146

SHA256
5ec42b168f2541dbb413d6f87aa5569470a2b0c6c574c3e655242461a4524763

SHA512
355f190eb5c83b14ea7ca19c901ff9124962a25f78ff03f1bc9f09387751f8def203e47f017ac0bd295c70ace8efbdc5f193d92d67207329aa1db4dbd0cc7183

Download Submit
C:\ProgramData\McAfee\WebAdvisor\updater.exe\log_00200057003F001D0006.txt

Filesize
1KB

MD5
7bc17241213cfa3a4fbbbd526aa8971e

SHA1
1efd2cb7ae324d8b577253d1ef2fa690b0c2fd45

SHA256
181526467eb971595d28f2504ab5b1c120ae69b3a194f3b05e7bdd8ad9576d55

SHA512
d5c6c8cec5a8b9222873da152b027bd37b6054cd65b0e7b38bd09114acb122fed6ce5e17259d26cc3b836d858c2b9d95e1fc91f2c3509f9bc7ab28b992853477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39c51e5592e99966d676c729e840107b

SHA1
e2dd9be0ffe54508a904d314b3cf0782a9a508b7

SHA256
29f29a3495976b65de3df2d537628d260bc005da5956b262ff35e9f61d3d9ed3

SHA512
b20532d0131b12603410c3cb425cb5df0ddc740f34e688455eff757802ffc854be771b30c3ff196e56b396c6fe53928a1577c8330b00f3f7b849fcf625e51bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
39e376ee2f541e6b1ed0bca701e8fb59

SHA1
bfe3cc2eed8721339d433533aef6e18e0a13a9a3

SHA256
80eda1e4d8c05e257ff17ef734d606e67d8ab70b3e351430b2b231631eed5e04

SHA512
a3f082c32857db0e3dec24394a259fff85e21b6a7b057ef55933504c23ec38cbb3237eb519d38385fc53cbc584c52aaf66291f44231245d9afee509a108a3350

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
48KB

MD5
df1d27ed34798e62c1b48fb4d5aa4904

SHA1
2e1052b9d649a404cbf8152c47b85c6bc5edc0c9

SHA256
c344508bd16c376f827cf568ef936ad2517174d72bf7154f8b781a621250cc86

SHA512
411311be9bfdf7a890adc15fe89e6f363bc083a186bb9bcb02be13afb60df7ebb545d484c597b5eecdbfb2f86cd246c21678209aa61be3631f983c60e5d5ca94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c813a1b87f1651d642cdcad5fca7a7d8

SHA1
0e6628997674a7dfbeb321b59a6e829d0c2f4478

SHA256
df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

SHA512
af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
67KB

MD5
cc63ec5f8962041727f3a20d6a278329

SHA1
6cbeee84f8f648f6c2484e8934b189ba76eaeb81

SHA256
89a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1

SHA512
107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
63KB

MD5
226541550a51911c375216f718493f65

SHA1
f6e608468401f9384cabdef45ca19e2afacc84bd

SHA256
caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

SHA512
2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

SHA1
6dd8803e59949c985d6a9df2f26c833041a5178c

SHA256
af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

SHA512
b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
26KB

MD5
e355eeae241a7810b41135ebfa4c8fb0

SHA1
42c33a01c7d4927cdea1ace1fd3784a5fccdf56b

SHA256
31ff0740ab9252be56eb754108ff51b3544f72c5bdda4e2c838816cbeb928ceb

SHA512
e93bdc57c6c6ff8fba683140f5b0ebb5093247506c04a3320e5144dc9d4641bfae773dad7cb81d1add2fc54e9572ae61bdd6af1e12ccd59d330b2ddbe2637a87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
38KB

MD5
adf2df4a8072227a229a3f8cf81dc9df

SHA1
48b588df27e0a83fa3c56d97d68700170a58bd36

SHA256
2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

SHA512
d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
21KB

MD5
8e01662903be9168b6c368070e422741

SHA1
52d65becbc262c5599e90c3b50d5a0d0ce5de848

SHA256
ed502facbeb0931f103750cd14ac1eeef4d255ae7e84d95579f710a0564e017a

SHA512
42b810c5f1264f7f7937e4301ebd69d3fd05cd8a6f87883b054df28e7430966c033bab6eaee261a09fb8908d724ca2ff79ca10d9a51bd67bd26814f68bcbdb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
21KB

MD5
e57281fb8bf6cc80e051f58143ca0c99

SHA1
da89e189b61a6c927882050131babe34f895a74b

SHA256
593d020f73024cef160189b05386b5e88e231062c12f2f21640fe48afa6382ef

SHA512
4768a5a5dc6f2022956f9af6249d397bd8199cd6a81283e8ce8c6de90d064ca68809ca79d7abbea9c727eaf064017bd9ed4c73e4f7f1e0130706cc8f1a08760a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
37KB

MD5
a565ccff6135e8e99abe4ad671f4d3d6

SHA1
f79a78a29fbcc81bfae7ce0a46004af6ed392225

SHA256
a17516d251532620c2fd884c19b136eb3f5510d1bf8b5f51e1b3a90930eb1a63

SHA512
e1768c90e74c37425abc324b1901471636ac011d7d1a6dc8e56098d2284c7bf463143116bb95389f591917b68f8375cfb1ce61ba3c1de36a5794051e89a692d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
26KB

MD5
398c110293d50515b14f6794507f6214

SHA1
4b1ef486ca6946848cb4bf90a3269eb3ee9c53bc

SHA256
04d4526dc9caa8dd4ad4b0711e929a91a3b6c07bf4a3d814e0fafeb00acc9715

SHA512
1b0f7eb26d720fbb28772915aa5318a1103d55d167bec169e62b25aa4ff59610558cf2f3947539886255f0fa919349b082158627dd87f68a81abac64ba038f5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
18KB

MD5
8bd66dfc42a1353c5e996cd88dc1501f

SHA1
dc779a25ab37913f3198eb6f8c4d89e2a05635a6

SHA256
ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

SHA512
203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
18KB

MD5
217be7c2c2b94d492f2727a84a76a6cf

SHA1
10fd73eb330361e134f3f2c47ba0680e36c243c5

SHA256
b1641bab948ab5db030ec878e3aa76a0a94fd3a03b67f8e4ac7c53f8f4209df0

SHA512
b08ea76e5b6c4c32e081ca84f46dc1b748c33c1830c2ba11cfeb2932a9d43fbb48c4006da53f5aac264768a9eb32a408f49b8b83932d6c8694d44a1464210158

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
59KB

MD5
677b60e336250eeada06d8327fc60579

SHA1
42dfd2a0ce32ab65e7451f49fbca24a197678b5e

SHA256
236fb6e6ac21ee7db3076e54681bf23d9c9ce9b9131af61e946cdb05f9ed208b

SHA512
61a7cfc0e6ae0b9e98bcb6af4eeb3e3c43226260fc0b9e1c48d9197c9f0f09e3eab908f08763da99ab91549859f9ff26e06bcfe941e52337dac3f4246e26b8ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
45KB

MD5
cc7b30ae62433f845908e12848641079

SHA1
9a5610f29f54562a1e54e4c0bf6fcebae10bf241

SHA256
071d94ff3abf84cdf65e316f4f5b6b9dfcf85f07329a08b6ec0ca22f8f252a1d

SHA512
6e73d02012e4d4c8aa2e8281fa1af4abd14d2558c1d2b73774bc39ccd2a4652c20a3e1cd9331a6d34effd1dbd2c29a22e98de718f331216eae3e50fb7ffb7571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
55KB

MD5
92e42e747b8ca4fc0482f2d337598e72

SHA1
671d883f0ea3ead2f8951dc915dacea6ec7b7feb

SHA256
18f8f1914e86317d047fd704432fa4d293c2e93aec821d54efdd9a0d8b639733

SHA512
d544fbc039213b3aa6ed40072ce7ccd6e84701dca7a5d0b74dc5a6bfb847063996dfea1915a089f2188f3f68b35b75d83d77856fa3a3b56b7fc661fc49126627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
16KB

MD5
dde035d148d344c412bd7ba8016cf9c6

SHA1
fb923138d1cde1f7876d03ca9d30d1accbcf6f34

SHA256
bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9

SHA512
87843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
87KB

MD5
65b0f915e780d51aa0bca6313a034f32

SHA1
3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

SHA256
27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

SHA512
e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017

Filesize
109KB

MD5
c4ea54408ec0f9e4fa1b5088be611555

SHA1
c4f43c099d8704d576f41c1a8768d2d9f8b5b540

SHA256
4419ca856acab73856ca62b85eb2a0ac121f40d941b95e88f77d896714b4b2ea

SHA512
1f0c6cdf5037020ded233fdb1796b06ee61e84d4a8100d4d5a11e0be7b7825b6b1dd930895152d50c8da2243582e4313335f0b3fbcdafd627c0e2bdf5907d85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018

Filesize
16KB

MD5
58795165fd616e7533d2fee408040605

SHA1
577e9fb5de2152fec8f871064351a45c5333f10e

SHA256
e6f9e1b930326284938dc4e85d6fdb37e394f98e269405b9d0caa96b214de26e

SHA512
b97d15c2c5ceee748a724f60568438edf1e9d1d3857e5ca233921ec92686295a3f48d2c908ff5572f970b7203ea386cf30c69afe9b5e2f10825879cd0d06f5f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000019

Filesize
40KB

MD5
3051c1e179d84292d3f84a1a0a112c80

SHA1
c11a63236373abfe574f2935a0e7024688b71ccb

SHA256
992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

SHA512
df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a

Filesize
53KB

MD5
68f0a51fa86985999964ee43de12cdd5

SHA1
bbfc7666be00c560b7394fa0b82b864237a99d8c

SHA256
f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

SHA512
3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
34KB

MD5
4d4027de72de3ce7db3a16d2a2d24288

SHA1
8e281487d1d9c1e0d80117235a6e98902ec035b7

SHA256
aeb7f9f3c793227eb90c29dab8c9c2716335dbf5d25a0962672702fd674b4f2c

SHA512
ff362f1aeaf35da15be6339469ca1a333d130bd038ded5142a3d494d3c630144214630a952082bca9e64ff06e6763cb3c8a994ca34f03153865c0d763835a66b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
136KB

MD5
20dce3e0f7d7278c9116c549f2806913

SHA1
d23d62cf85782e6087127381a8611ddfcb7e339b

SHA256
e44212229f5f0456ce1aff0dd7b1b3e20e3f4fb9aeb20a085d4878096a36f4e6

SHA512
0bc871a2d84609d0eb7e368db2fb35dbf38a088a0649b7f8d0fa280db5765e48528452616b62688877645da2ae785b47cd86f1cfd298e5b54307e8f22ebd1b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026

Filesize
43KB

MD5
8cc6059930f8bb6bb5dd8c18522e1177

SHA1
29276b75f1e3146e59a75c4129e248d818eb5611

SHA256
f316db6f92f20702094c8000d1c8c6d26b241553fb25c7206cd0604d449a1569

SHA512
f4fe3a76a6052077c773558c242ae4dcff51d855176be8bb453fa95fa7c0d7a54cc576f67f073ad6cd918c08b46785d45b9a24a691069803200dbee920788736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
132KB

MD5
90c3aa8426e60516a28ec103af08fd1a

SHA1
65f6da5acba21d620fe29fac28854360b1706226

SHA256
49597c4a96feebd062e2acc21631474f30f77776d8584e0d8678195ae7d5da81

SHA512
4f03e85f5770e280d65aaf756cdc006d5f50e9d22fdea1d7f268dd879ae50c6c5485b24a9e78fd7848920133a21929063aed0eac4121e842ecbaa8ae4540d592

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
39KB

MD5
9a01b69183a9604ab3a439e388b30501

SHA1
8ed1d59003d0dbe6360481017b44665153665fbe

SHA256
20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2

SHA512
0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000034

Filesize
20KB

MD5
74e1628359e644301903a7b480c6f30f

SHA1
f08d27b5eb569f606adbd7c962631adb8b5edd30

SHA256
5693cef401f71a7d8cc5584ca9903dfb619ad5e616ccb13f99e7a75fdba6445f

SHA512
90abb05c3b52b14b4a617964e88823d462a6699fb27c2d6808de666c86b2c0003861ad4ac5bdab3dfe04d39d2df245f07bc55151c2b50f39094fc523cbf9643c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\03eef0e77feb64d4_0

Filesize
6KB

MD5
d2a05ea2b1f2f2a19e4a6e55094ad506

SHA1
19862ef2d72eddf5d698419c684aefb6d9119f4a

SHA256
6f8dd5296309ef8ae0f1b3971590cb0dc55220cf812c3dc35d04df3f8848939d

SHA512
54b42e416c8222f7a41886dafad7173e1a2bf2ce28e2b3dd7196167a52477708b5f5a790871088fd8de0ee1446db67f95a7ade905695091854e372bf8654d817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0bbe00d9bf7b798e_0

Filesize
2KB

MD5
5cbfe350f924899fd1a8ba6a01d7e1ed

SHA1
150f19c9134c9271bb07e7f4ea41a473caa52d20

SHA256
661b6da0b2d99b724b80e4a0928ac9788dac9702df657ed7d1d2789c5efbc513

SHA512
edda111d0db096859c353ce84c2bef4814cfa8ded74441e99510d2a4bbcdc05240737ce9c58682ef3e821f0f892ab407c1c5f409d76d780815dd9a605d91dfd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\163cfbbbd670a71e_0

Filesize
4KB

MD5
e61f34c7f4b1088151f6f3fd5cac7b05

SHA1
7ea2550520d41b08d661bddcf86bb1706422201c

SHA256
21754d6955384a24929b52147b5fb0539130ba8faeafc520c5c1b42853be4546

SHA512
78b3471cfdafddaf8626d41deb511fe3a6454e95dfb3bac1ca9416c1c56b5b72d4b2cf62e8f7d0113707c1c9dc81fa17bcb236f5c75f3fc0429fa7824b615fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1a914eb5fc51fb84_0

Filesize
5KB

MD5
99372fe4e90d6145395d37f0e57abb5f

SHA1
42b01519670971e1b98d496a2cc586f203912d0f

SHA256
33174c6d63f55983f12f4ebf298e41eacf3e0fa802fe25224540efe08b16b5ab

SHA512
67b4856b076c23e686ab2856ae1e4f4839aa0e5ae996453266ed3a3646bbb9499ae376c1d6acea9ab7a6add7373da65e099e8f8af92145c38aa0159b02801305

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\1e3673adaeed829c_0

Filesize
12KB

MD5
7b3e243f6547ba42d82266858e64d2ee

SHA1
7c9b8328ac3ed5abba3af813599fd5aefa98f858

SHA256
56cfafa9eeb7a2597ecbcaf9519f7a74525dec72c4d1cc3411dfdea5bb527bdc

SHA512
a6dd2f37571463862cf7049fd31ac50c005cb8386bab8388d9f25d4cb562db89b14a256770884fb9247add65bfed8de6495e0d78d549c8527295912b7016fa61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\242d87fe25e8b258_0

Filesize
2KB

MD5
5f5da1cf420ff507ffd0ea2227e8f696

SHA1
d2b4af39479c3bf10612ff17e6d5eb58f7066285

SHA256
2b15005e8d7bff263ed424a8c8bc3a8e77be1185ab2199495890a459a5d8f338

SHA512
965b54f2ceb50dbaf9f47428455a2676f4b963ea676af01058e446514a86556a9bb9d9206f99abe20bb11d429d46f768750c6278184514933d330c0a2b49085f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\25c90b4fb1c6ef85_0

Filesize
1KB

MD5
6365a948fde2c96cc135aa6d4b5eba93

SHA1
f69670c055cfbcee3b329ab09ba54e3c12f007c2

SHA256
de61e2a524121125267624d192274ccc7953935d6a7a8b213e35722e42037ce8

SHA512
93a45a9be9e3ae976d8f8a09ea8f4323ddfb63a9ab2dda5e9f6501d486ede06870c2f7ad0af0bb9e78cc0b43e3abbafb00164e9a7474513a176cd0d8ab04798d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2692617678c042d9_0

Filesize
3KB

MD5
6636e53ec3142da6287f111577538f15

SHA1
0f989955ce79eb546098f61e28f21555df658332

SHA256
f7cb34665394add74bca77d571045fafdff9e8ce8f9d30dd7450f56ef023c533

SHA512
2993c8c79b543481e3c84816b9236f759cf583e2433bc22dcfe27b2ea4455d2aa125eb9b16754a7094911e911c22a2c20f50e9d84051820ae47311a29bd1f75a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0

Filesize
9KB

MD5
9a36282a7711083a3a1cb2c8953b7e49

SHA1
be6fe80f8cb102ce3216f525423f3ac73ff38e73

SHA256
12ac720d6dc88d7076be2db5bc196721a94fb8bfc70e69cbfd038443365002df

SHA512
58f05beb2ef299941cafe92a17eb43c078f8f395b6dfb75d73a12733df39a67b076926dc76ff2876eb31ad59743a1869100fa6b0ad97c1012cdf94d8a487a7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\324bc895b98d990a_0

Filesize
262B

MD5
576a06fd238545278365953c81e4b987

SHA1
264135106758bc68e532a6409ffaf2acdc3ec744

SHA256
075e572c55791c6c4599cb1c21cf7f13f90f882daac9a267d8e8833fa3bc3ee3

SHA512
efcf0c37c2c10413fba7be46fde297f9e991afbdfdff669be687945dfda983f92439342c243209017ddd6c59ab0cfba4350a90cadca52b53c19d2eb811172b6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\36b64af6f1adf90b_0

Filesize
14KB

MD5
4b1284761ff7f50292a5f3073c997307

SHA1
30aeba22dac386f30f28e5d64d8c83e0f4764972

SHA256
10c9203dc29e2075eaebb981e9aece8a24ddc94f7cd83b067b61dab2178157e9

SHA512
684fc667031a3ff011d0dceee9068e541835cd270a6787c96831387c598684f2254e99dd82582f08e39d8616dc4354c3010d4d1a2752948f045ebda0bbd1cba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\39954c5b6b209ef8_0

Filesize
14KB

MD5
d1e6be9950099c8c99fce40b3f036207

SHA1
766ef8d9914d290a685e4e20a544720e21dcbe1b

SHA256
5f2f843cb90bef86b283b71b1d448aeb5de08f080c059b05f3cd35b48fb0e9f4

SHA512
1e8f857ba32ac4c9f3bdbb45d103be43e17852adba0ad54f79270b9f79744ab65fc375651972faea47f81de6f3560dc53fbad36eab4807b61dd554581927b5ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3a4259a0181983ba_0

Filesize
6KB

MD5
fc14f9010003f30297df83b77f94631a

SHA1
a38c046357fd9e54d163be04aef9b36e7943abbb

SHA256
5a4633acf50cc570eadf766385345f0c39839758c5ca9f015ebf8c6913d9cea1

SHA512
4f626949895f631ccd5614e6b4d9e28500aa8fe3051a4bd9e6619bb07cc3ad0fb642fa9e78e6bce5c2d6bb5fb392c19dd8f2612539addc6f06f716ece5588a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3f0bbdf59c77b467_0

Filesize
200KB

MD5
0fc37e209143bc53d602d067826248c3

SHA1
112b0b173a09b85a24608961815484e7b531617d

SHA256
88e047919a778d98f563c4c11ff46829cc523404c7252be2d9f3b2daba73f0fd

SHA512
3d775f5060af1559293ede963a2f73079032d9f0b113a567382caca3ea98624d4082d9e16d1042090e062a6423f41b7ee60a169c52583ae9c24f09823d2982d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\45a16ff6d0d9ab5f_0

Filesize
1KB

MD5
4dfeeb82cf5fac9e178e12c0825b4911

SHA1
07b4382ba9f6fc8d89b3668783edf12b951b229b

SHA256
dcea477edb5f08848a18e637350ed87d1759017806eadb73a8d457e0622feb97

SHA512
a917c3063f37c1abcc52d2403a6a0ebea9578e8ca907fed13050ffa5673f267c1f4791e08d0e26999280ee659022f88022a0d080e259d9c322f9288f15ea96e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4c1eef73cd89b9fe_0

Filesize
289KB

MD5
448961fab49d957dbcb1171a679d8c0f

SHA1
604b7ef1c988f2ab5baadd05183096fb8abba76f

SHA256
3bf5a488cbec619c1e5c8210cab3cffe5c02c1d2c6b673acdcd93cbcfd3b09d9

SHA512
5b43b9d1dbc03e39c3d0277bc07127b6bb4e07c7b0af885b26e4b2b70797f6ca91c23083d497b77a84f0502c5afbc0f645fda4487d336d12f00714a04db006eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4e9b18b0f66a7183_0

Filesize
1KB

MD5
87768f6c571c36d315579b2727d5b5e2

SHA1
1a6c2ce239deb0173b11824bed56d96475e390fc

SHA256
fd0a27dd65622edfdc43bb4ab3ad2f402453d79477509f905cdfbdb4a9319904

SHA512
21eb4a6d9940d2b2c3c4b134268a445af5a0b95ebe0a3c685e14272fa701fd31606aa20c82657ca5ab0c7d9c48dcb239d303dd2f1129ee770ff67fde6cc7b5b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\4ff4b179c1c05fed_0

Filesize
1KB

MD5
8b017b5537727e01f550db1f643c396a

SHA1
f05938804ef85d0b578aab2ec2e098b6f479e846

SHA256
fda03a481487aef6ca76c634d62b1bdb5b19d57019458abe8ef35aaf54647252

SHA512
57b45824ea66e1504d73909655538f87e3ef017379d0a8a40eb528f60af164d92313194a96e3d56df04c0756bc29fe6ddc83492f80cee644ea37cd583794eb59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\53ac5abc87e80789_0

Filesize
2KB

MD5
0369fecdab81313afc1ed21e30df02f5

SHA1
e671567d3709dd2aab544810b07876ef8e0f33eb

SHA256
82df8b18cd53b196ec9f3e10447d2c6510584665a9952dfbc2df75c1cabb4b41

SHA512
51d100f910ecb5fd2e6a08aed8cf48d8e9a95f43aa343cf148c6d7a5a68c859f3bbaf452e1aaf5a124f9630fac5b5c98b8143ba4d9cfbd2fe23b4198ee1262ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0

Filesize
4KB

MD5
f63d43190a8ef7fb2c526adb7631b8b5

SHA1
8a96791f67b60a1d0f53fda09d25668884d43954

SHA256
54bef9ac3c5f508e941d74452ad88962634665f2cc048360516f3e80df58540c

SHA512
d6ea26c4d627d0977ecb13669353fa4a4e663235e5d5bcc3e3d3d92c9a868c78035df18330092bfb841780f9cfa21151faa138eb552a1ce7c2d332067ad60a7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\624c9bd517fc9c91_0

Filesize
1KB

MD5
7b36ad037ec13ef23487dad2ecaa20bc

SHA1
1b90e75aef8b7c9f4e85cb3fed60718bbfb31ec3

SHA256
6712dc23505a2ccfb30f99e7360f798ff367d9c7aad6a1e49cf82a2892706ad5

SHA512
e9f25d648db5ee797332872a730151344de83f6f160b418af72e1da7590b201b2b0830ed06efe7b928ce3819e54f5f0ddad050a35c3c83f1a2e70c249eef6b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\635e64b37935c888_0

Filesize
1KB

MD5
f0b308e051c32d84769a7234ef60909d

SHA1
12db458cc5a51afe6129ae735610dee354d03d24

SHA256
e5ddc43cb95a2f115c4f8c1cf00780312bf0a939534ae7b3e23092d60a5e965b

SHA512
c93991bec0755b680685a9b1bad35eb35598d0df2ade9ed34aef8c675831c11b53995f3703e2a591dcb42330bb2dc0b7482e8f8d7bd56cab7bb7b46611fd75bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6a5e8bb53a565b9f_0

Filesize
2KB

MD5
7ba9282a784bea8c37e8f4a1e936a9bf

SHA1
077fc7adf152bf4a822d95aba2a4c4a2a10f40fe

SHA256
c47bc09c87b2ea4b04c84822852b87ca9c65374c95dd19114621417bde59b9f2

SHA512
9b8e7f67da057a78dff985ae5fd34231fafbfa86ad1a48dcb20418b35dfad13961d83c272549178cb96451cce1393fe17f6163d2026f3b7a0df42547b7f90a10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6aa9a2943612cce1_0

Filesize
2KB

MD5
0c368bd94679584549db38c8a6671e35

SHA1
d65e17748b984f5624675c020f8e91fac32375e4

SHA256
c25e62eff6452cd0d1ed88fdee8ae2f4ae333a35c56d707fc193ea889ad9ba5f

SHA512
2137cbcdece4509d6357927415e9dbcad0d3f56c1f76bb28e53593d677faf6a08cc0f14df36a0d8a302b281fe2aedc8687cd5d9ffc55ecca93b06f3991439f19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6db290dce274a012_0

Filesize
4KB

MD5
9b276438d47b6571abd4dca314370430

SHA1
ac5aa87d5a0326fa3ff1c3f2cec5bc682b67d663

SHA256
e446788fbfa01d78529fbfde1a751cca9d4afbb941b4cdda288ea892e792cd21

SHA512
f7d56fafd14d2ae3e4d492b0a5c7af57973f5f086fe231d6dd22a315b96ec78d67c591e0bf585dc5d3ca9096089130a2bf0089bfa2ba1bc04bff550c3c79f979

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\6e40c3c7af86aa2b_0

Filesize
74KB

MD5
8710f1033438d451e379979d1fe81761

SHA1
3f87ee9759c6876902296a2a8565e23b7a62982d

SHA256
df9fc7ba036c7310214b38c887ca7c00d1a9da7ccf0e0fd5f1cd35dc7eab84d5

SHA512
667cd4342d5da148ebc464b87b5aa951b7e0f3193ab137e5414da7098def19784dd6c5e669286b339dbd5a15bf4535a622a391092ac7d5fe1fcaf720d9d9e541

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\71d68e68ea4089fe_0

Filesize
5KB

MD5
5b5d610c51d3085272f7840c8350cbc2

SHA1
8c737e703580706eceac1a169ec188d066332359

SHA256
8d994609417aa0009b03c464a8ca9ef960da631a82e9c7ae6a2921a88771241a

SHA512
a2dafedcab7fb7a9cf4a7395769d67016205ac21a02b96552fde1f54913c8477475637411f5e02fbbfab15cf4a39101f6d3fe8c4982f8b152e501af8dd545f0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\73059341d1ca82ab_0

Filesize
18KB

MD5
49245277637d369c004c771c043b0576

SHA1
809074301746a13104bd3910f97e117b8d6d919a

SHA256
8df61b29a5f8ff946e3e2ad36917f19f475a83f1eef52bd522df462140d15b75

SHA512
3b4e5aa224130bb366fb98f9723025a626e6a3edab6e9e4fadd7c1f5bdd745bcc811ee8c1ce857392c9cea092fe64f49bb0528e6567871bf7d70b2cf577d2710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\74b88724f60b0383_0

Filesize
1KB

MD5
0c947da7e7227560a7657b80247221ef

SHA1
a9ff82c9891980c7ebc06b0d122654e9957b94a4

SHA256
e5ebe19fbf83397714e68e052fb6908edab6e01b1c9c2d3e8529427374f90be5

SHA512
98a7481765ab7db0d2d183db83ad1289b8725215dcab5d6edc22121607c5cbd7246d681457544a3efac50560fbda4dc7cfa74e1262c31c3d751b4a9dfbe9c4e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\766094f4b47e839c_0

Filesize
9KB

MD5
e562ceb05e5846f5b56e5ecdceccf0da

SHA1
3e1acca95216c78d62d7715252e5e29b3f90f1bd

SHA256
30e4b1da6a27a25b80e68b60ecb8762fdfeed05b909a6b0552b0e19957f9dee5

SHA512
fcd730d13c8b1ccc3990f671250863a83a8801ef6d18bbaf3681ef32ca7c3eb1edb94343899dfea73cfcf393233c81697a4c5ef88db49681d2de46d05fc5b7c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\78bc646c0524ce58_0

Filesize
2KB

MD5
9485d3fa1e03cb49c66e3dd73f74a91a

SHA1
0772820a599f74998035d07eb270482c42511c87

SHA256
189b80f61a05711f54ff1428b1e42d3a129ac7955a2759895a10d9f327a51c31

SHA512
b3dfaa7cf7d22170b5e0b8c8f15ccfd50d4ab5198afdf5d792db410ad981ec5cc97d61efab7e04bc50586103d98bc9c58c20796a29f0865686935b7350139aa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7cf9843337c39c04_0

Filesize
1KB

MD5
b425f149d7e8d051bff5510ea8218ae1

SHA1
a9f6137cef746d3d2b1cc30f37368eb53cc165f6

SHA256
106eef641b7ded09285f099c3830b104c5d8d63cc70b9c59d82212f7ad31beed

SHA512
d01d1ed53a89e6a9c02d4f4d8d2e7e8ce9d2bf85f4dbeb9be1fe472ce2af4c00ceb3a80adcbf469d90ad4c6d168a4fdd3a562a40cac2ab2807bfce649f9fefe0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8034151cc44dd4c4_0

Filesize
29KB

MD5
c4e88b166ea29395529f130191403ded

SHA1
050d5934297612ff429b0daefcb92adca5825b29

SHA256
2f96c4aaff7534f0c80cc0f80a45ab6cab434ad48d02e66d4054a5e2293fc8b1

SHA512
73d078b948cb1eeb6b4503d409acdd5a2f0c307c2b1fdf50cdc05f64585676fb02f261bc98bd15c925bcde29d41deb952f6adc4e17c846361dc79807f7f575f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\82af833e9b5cc26e_0

Filesize
2KB

MD5
44857c47b0ca352ae7c202f50a1a3f5f

SHA1
4abc61aa7d4c2b0c91deb9fe2934d52b038700de

SHA256
dfc9b4a3018cd0e86d0827461f68012edc83d81d2579e81cb137740ab06aedaa

SHA512
98faf21826917cc9a6237f7100cbd3e5835935bcb107d78bab48d6ef863954b5ab073a873728b0932c9dcaeb3943a65060f44a524135daf2429e99a71e688fe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\86b9cbd77d05d034_0

Filesize
6KB

MD5
1c97ddf06c208e3788c054f3a6b299ca

SHA1
78a2b179e094c6bfa1176e06d24b823cb8b29c8a

SHA256
eef744af55a4f4944dd7b5287a1572e6628c325184ac98cab29b803e775df956

SHA512
d2d265e099bd87ea5a33508e333f0d0cb1f5406fec6a7609db133fb1abf3889fedce943006087e5a6b0208a6987ade95b3c53eb8563d4a23a8aab6041b0bd169

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e5987d08f7b6e11_0

Filesize
1KB

MD5
e4bf22427d7d1dffe9e9142d2a8802c3

SHA1
2234307a66c019b853dfee4be1db7c9bc4a0f68c

SHA256
f99592867a09926a00860d6a33b4bac6bbe92df40199a975907ed715ce107f2e

SHA512
5f2c4ac65788ffdf26b9fb6df557c97149ba8854f050568e139c3008deb94dacaa54050ef5657106fdcc7a5542f89c95115224fd5b6da7ca2f7bad672d9c40a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\90d7d7591a1b39bb_0

Filesize
262B

MD5
1230b4f52faec211c5574502331ceb61

SHA1
589fd1d7b5edecfe9a7b2f4c4fdda56d51a6ed57

SHA256
d7ff592be50e14fd0351b3b4d22dbfcd4cc91929eff60424597c1dde7cfa4c98

SHA512
25c0dbec99478411571bf325e99d2f6ec00607b2c6e7208e0e0f0f7c34f8553ecdff30889798d47b57e95ebb162c972920584f3758f29428b6aa56593a336be3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\96bc766215a93e35_0

Filesize
1KB

MD5
9eb2bd3cb4d022a88c535ce143d3a7aa

SHA1
075ddf27da6a2b3df7c8140ae8a467488cd0e6de

SHA256
4ed9040f434a35e271b895fd34cd1994bd452c9c4428b5e562d61a761b2ead9c

SHA512
c355c25d78eab98ebd4a206ed45a2b32c639a64d64d174fd20fb50407f34a12a6f4fb506e7f91e1e4711bd1b804988572b96909af1f2dde53b403b9cf9a8fe69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9dbb949d27873cbc_0

Filesize
2KB

MD5
3f47a75b44085a16c94fed589d201f42

SHA1
81d5bb81965e5803b608b9e29c9d4fc0dc10e4e8

SHA256
aef051c01b87136072d90d431cfac6b24834ff02d2810dd3d9b72bb92d6dcbd0

SHA512
42b83549a4b9aab08f644f5a1ce58bdf41c7c3cd66407e21df00701db3c8887064c2843237c8301e8624087e882572196e46370f355df16f6c2aed3ec31d2a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9e4702b67122dcff_0

Filesize
7KB

MD5
0eb3d4af2ff622368f0ceb2345b1c3e1

SHA1
29d2cbb93dd80b68004a3b2d6fad097e8602b912

SHA256
790a1fcaf5c57b64a4dfc723b4575798588071a3cdbc0c063298e1df94674965

SHA512
6a8311cd3495c353fe35a69c80c049ea8b41ad52efef6a6b9f156a4d9f3fcc6134da7d4cdf62e8cae84842e97253926018133d7a5710a250142309046e9eea45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a28b766f2e67bd61_0

Filesize
11KB

MD5
ac87ca717dedd4a74f8b5e93b67eb6b9

SHA1
213e405b4524d3246eb88dd6e6442d23c2f63f13

SHA256
000247e39772d9d31d04aafb215b6e9eda9011040cc206634beb7c6d59c2150f

SHA512
1eb7ca02349dcbebca3ab917d37409101287ba58861bb3b76bd110a933b6e7d8b9e1d6cb9e9c5ddc1ce5cf9d97871eaabd38fcf0aa2100cedb7e18fcec783b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a32177b879c14f19_0

Filesize
175KB

MD5
931778b56d341269f2bb0c4c0823d037

SHA1
a5dfeaec0b318cf7accdeef3b364c2b810519b41

SHA256
ef0f6d72f8494d1c5c4bc2e474e4282157dda1a0bcfe00855eae0c9672a802b5

SHA512
b784fabdc01ed9ec008aa641b849fb8ba24cad41839511fba95c2229d1e604887c9f91ff32867f6737729a4883e07f2a1ff889c6df5ef7f7a33a08da34cfcf86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a8491f153f9a8de0_0

Filesize
3KB

MD5
a7937d90fdaec843d583edeb7bf45470

SHA1
23a507b7852891827e0a0bc698116f9a7aed4d02

SHA256
36d3ebf2dfdb9e04313230feef01b8170814e4234c3d330b09e777fb3321c342

SHA512
45c4cf91f945cf57cd74abee2ffa23cc647a0049f25820bb9f929da3cbbcb9bdfb0f991151857918e466f4373699d49566c41970c536128c6cc9e1429f51add0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be6d12311ce2b399_0

Filesize
1KB

MD5
0cbcffb8885b881f9494a85d6c7e3b0f

SHA1
8f6d94cc533256ee34734dae8dfd49a67e640873

SHA256
85f62871a287c04e05f34ec8edaa5b7308ebad39b73aae751196df3bfef02826

SHA512
9233e3fc644a1fdda1c539f45389245e2f30dae21eccb1419d021cb74fc8560037e3d8991a8c1894264d8783f3ee7b499488657eb6fb4230b52fbf94a2418658

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be725838b2e9ba92_0

Filesize
27KB

MD5
4109aac0f5bc3365e6ab94f6a668a86a

SHA1
8e0615177f9131e1319a802f63af20e24a00d70c

SHA256
01722da406fcf4663cad122822b75e078120636424ab06d451a6c2cfda687d80

SHA512
1d4db1c189004d03b75d21089104963110cbd3602e1bee65a79199866a6f99c8ba967febc1ac5abd202726727e5f1d6857f224d1f0ba0bb0a72fd5857fe7dd30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\be86542aba922d64_0

Filesize
22KB

MD5
d934d819a898c881788640d8a73ed24b

SHA1
badac2d3cb217c81214ff18c1279403d1909180b

SHA256
745d4d8a21b55e82cb0afc4e652259263b77f729fe08c63c4070e5efef48c82a

SHA512
85b4c399853eacb172ca242feee1b455a496d8283a28f53341d3dfb9309c5eac6de20d12aafcab6c53d0ed2a3bd590d2f434d5eec155e58c3f83e7179bf3cc22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c211c9dc68f4bf01_0

Filesize
2KB

MD5
1e4cf50c64637774819f37a71b3f65a0

SHA1
c917ee001b5cdd00910f6fc79051f69169776a7e

SHA256
b7ab9e476bdd0dc04597680ad9a0ab7b7bbb729fbfd6ef885b26ffb66ee5234b

SHA512
f23bf5b1589766109db85eb29ffa1412eab631aff28edb00254b6b070f8710aad56b231d05fda2cf259f12ad6f842dcd6a0e5108ca12455e498a4d5891aa4c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\c7f07f67850840f0_0

Filesize
2KB

MD5
94dd6e88e4390d62b57754f00a3a855e

SHA1
96a4bc216de614d68ebc1a669a266bcc485bcae1

SHA256
84d76f3c7c3a251c6be5968e8a4348d69244d5f14e237b8ed49c55d40d383a9f

SHA512
4c93070481f4a973d052e8ab8802daaf9ea5f7ca6cf94037f335b466cbac2921113b561daf885c52bb8384edc936e68409af150d65e86e6416cf6871901088de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cd9a47d844308cbb_0

Filesize
6KB

MD5
f5d8e27c84481b182e4857ffc7ce8fef

SHA1
e72f553f44c66a5b04ca4c2e2ab7c96b3bcf20b1

SHA256
3beb6fc5c64a83566c165ac2d7f14bc9dd54b0aea45f94b80aed2cecd045919d

SHA512
fcabde3f689b8e3e993109d632b5ffb935ef6f4181cb0d5610765ecbb371b12c7677395b07c3efa6f3039a74e08b417c703bfdf3afd76623c6ab5dbf5c22453c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d45aae6d8d9c9ff2_0

Filesize
2KB

MD5
7dfc052c1536ca957306f7bfeeb5e80a

SHA1
d921179ff58db2e643ea1e00b52298fb896b5999

SHA256
52b08f5ca28521d83d58e37d89e89bd8f84c68da54ac780aa32e84401a25583a

SHA512
0c2bde1841de9babf3e3c85b294d849af8bba7209a765819723337f06441ad5738475115b6775db2f9fefe0a54e67ed5c86669b98a65978815a26642212b10f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0

Filesize
262B

MD5
3ffe41807027d6e512aec364c903f8d6

SHA1
26b39898d28ff13764f5cfa96e31de87bca66ed1

SHA256
223c80ef3d287ceb7cdd34c757eeb22bd97a5ab7eeb0e335fcc3fdbca3f06b7b

SHA512
2e73aaea8f610dd5a5ca7a0868a53e732ff521f6499a6c9392f8a930eb4b3b54fdb2692d1126a0dc1737aa06befb8b317d3040314aab892cd3acc3088ff7cef4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e146fd968644d345_0

Filesize
6KB

MD5
3cde9cbe779e46d406192757867b394c

SHA1
536d4634c9e2b452711d9212c7ba0414db96c38d

SHA256
b59b94eedf7ec05a7fcce0a8ba05412029cad30e14a0573c421ae83e5e6664be

SHA512
769ccf19de93688fd1430ad509cdefe53245541acac0a3bd469007c2268a4fa68c67b1019d7e68a23bac73a474a23fb5042531249cf345fa691c442185706a81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e4827d4ece590143_0

Filesize
294B

MD5
2fc1ed49d42a52b7ec4c16750659a386

SHA1
d7ab8121aac4b7099ae7a7396c6b5069d84e97ab

SHA256
44ea013d645fc0447ef8f649ca929ca716d549643b80a11722677601641257f1

SHA512
ee8dc409fde03635675b20f91152044356e96f4b36b3b07587c0d106ed9f0c3ab7cfe1eb2f610dfe1d1e12373bae0376006885950abd3a7450daac7d5f38788a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e8c8218aef51a783_0

Filesize
3KB

MD5
c606cd9584fa5d1cac736b5b922c8197

SHA1
5e442d790192a1fafa589178976dadf69e52d8fe

SHA256
f9faae61ae436d3a742514bf77bdd9a1cda58e1b75f066b24bc8c08bcbb6254a

SHA512
33752b456c9aa25622476c17e4255ece924806d2f8edce4300d5cdc669d3852d393c5af41e6c90247fe3eab43c3d79779b2a5e674c835e0690c5769b25807ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0

Filesize
47KB

MD5
06138665823fe7f6261d6e60eb833093

SHA1
89f82122ada0fb97a3f8abc6443a2859fcef6128

SHA256
5b374c12780fe707c963fef133d981e982210385c87443dd0540644f2cf614ed

SHA512
9e48566b8b279f9edb0247e33e99f3808357d924f0923b55b40b93acbe38e3e06e4965114f669d7742bad73d02fd1504adfe7e60631f0fdcfce24ebcbf664081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9fab0bb8039bdf7_0

Filesize
3KB

MD5
ce4c05ad3ed7a6eb7dc22af1f89f2aaa

SHA1
5e79a3a96357ad97aa363535003629ea32f61186

SHA256
ba49e7926fe23fc4f303601297a57e24ead1d3670eb78a7bba8a5ba1234b4aa4

SHA512
5b43b5a1d49a2dc6ed22bb35b6743f64ff36be5f669ea2d003b4e7dbad16b27619090a8d140a561db2949f82b9ea637296834f9db441549505ce0fb4477a7dcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2076e2a98754e97_0

Filesize
2KB

MD5
434cbfca3b7355783d6cff1d52279426

SHA1
25dc66d6ce426e47ac0682583be940caa92bafbc

SHA256
b9cafff0f553f466cb620f643a060ff560a8a50bd3ab3cca4aae3eea756c67d8

SHA512
eea4fa3c448583265dc8723d224efff5738fb00763c53eff98c62bc71af926beac21ddc0ac318d5605681a285e5b9bcae09bb2720b2e63b96c2f03f505efcb5b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\f2e4bbad99a372cc_0

Filesize
2KB

MD5
0dff10236fdc56d6f1e1d4ae3795b528

SHA1
e5781d24b126a2009c0ce2df19b2fe367be2df15

SHA256
ff8e78b22bff360fe3dfe3027f2a50644358ffc7e969749b977bdb2365e4d4a9

SHA512
ddc8371f142737c05ebbc151d85a8dccbc8e28d8f19efdcb79ba454bb53556f86702281d268c241815b4b4eda1a550e8f5e8abfda87408672845b562c42f8011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\fbd11ea5cda006cc_0

Filesize
26KB

MD5
1fe2ad88f6650b2a72507d8616d89223

SHA1
9c533987f47d9fcad02189b4a4a55c6a6cd27164

SHA256
19de573be14587ea3fbf5e98f5c8723e78ee4c9eada7b8210375dd5f8839969b

SHA512
e08eaa4a5046c1cc14f04678d54801b7a7ab9714e4c89b6b192c450bd0ac89777b6a0f77739584b467a422cfb4bb076301110bfc5f14ab3a941f2c8d9b5172a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
7c7419198cb149349aa04ac65bda0a60

SHA1
e306ae0651bcdb5a35566c1c1f54254cf3ad9ef6

SHA256
68b33fbc1aef283c9c3334f17237d118e70ca5d9d7a34dadb9d1b6f705070313

SHA512
31b4fbed902843a70c97831f0535bb1223f9fa581d5ee938947df547140341a5cccbfd09b013eacd973bb5ab1a58b04b88505aae0100089595b863cc854bfb5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
55974940fe22cc105cb0ff47e2b51657

SHA1
1a19862b08e35c26261b4882042c8fb4b911105b

SHA256
30b5717162070cb2a00dfa13053970421c07ebf5794938c504e72258df7ad126

SHA512
871b46b76d176e68b7349b3e906e79e2478fd5e5cfe01b1d80b19fa7edf8231cba53cd8551da1c0002f459d2a2f42734254ab28f3d63ffffbe6cebf7e3daba95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
ab9969de6785e728718a67a65c18af53

SHA1
b872232689c08fc2c3d6a5dc4eef91aff447e72f

SHA256
2d991cf3dde8108ddd07190dadb9d144b5fb433dbc00ab6e0d8fbad253c30d84

SHA512
cc2f61fb3aa7ae0df3eb7ac5085eb289f88285c736d2ba0adb834d7e458b65e70b5423f30d862b7ebca993944ac090a0973facef139c3a16ca39eb1074501491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
822fda1974e4d2c343c2c366473666b2

SHA1
6c9998b578b4ba6f02a7e9052ba1edb7dfb91e53

SHA256
2f18f2dfeff2b28aea3dd79b8ea20fde64e6794daf31b58b4021ff3880809943

SHA512
8a5387d8463573b9f952cc72df299328aa3eaefab4caba0d278dfa11390ad2cf51745df21a5518f55eae99e3fd2b03b85c9a8d8950dd515ff2b1748d077bde8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
cbbd834f643ba3705b85fdefa71cd9da

SHA1
a83a5509268c87fdf13102a554bdde0d32c9cf39

SHA256
954a028952d96112e6936f8cc38e1890b364d7dcb13cdae75be8758a617142f6

SHA512
7de8dd34d810ea6e57c26653d0240a865421296cc9909133e4fd9683a44548fac2a1cd2b18fe4e6f5e08b88ea78f3d8651f007f5886ae21f8e5d859249ed0a09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
b6122b6eb94ec712de1f212b038dc7fc

SHA1
654206628d8d2fae6f5b580f9ea92cddba7ce926

SHA256
94710da047e00f0b45fb96d0b70aadb301c5da9476e5e2144e7bdbd8edc7ce12

SHA512
e0ca542706f832e57bb9854eae6ae869de205b8222a0671b11ef5d151616c974ddf00accebfed423fee28bc23142804744e610a630be26c93cc5d814073d2111

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
692114087d24e7238ad270c5117d2f86

SHA1
d768933df82afc43e2e8b6633a0e4f365c4469a4

SHA256
57d600bc2a52e9446c35290d9bb3d833b0fe40b3ef6747fc4d145ab14616f860

SHA512
9efca406bc9bfadf3834cb5805586baf2a88a72b9556d22877e1c9c284300a899c35a06c2ca3c03504ea8ccd56d8f62472313dc1a86c9cd6590941b953490346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
50179bae774314b594261cac20d4af53

SHA1
4a97ef35026becdf425c5ef4d2a277beeb6ce31c

SHA256
62d3fe02cc84584ebb3782b369d672ce22c6da3644eea295bf1974de73b921bc

SHA512
81640ff292b70e2b311b1f3f6c8172af397ef3e2f2844a991ded4ca4d8930492584479c7a0a79984d575aaf9f0de7b3d5130cc9fa7ef3d9e7f16768db9e0ad45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
a6aef2f1ff6a4501764010739720bce1

SHA1
2c752061886ff19b93127de1503d9b75d2577d5e

SHA256
52e342ac6ad31f0edc97e13628f9751d2ca3218a7c66ef82093d570d3ca52752

SHA512
20ecabcad6666a2e012458e86a105302b33bc36a8c6cf5259b2e19a12a91983de6026677304348197416356a3b31491deaf4a8c6aec9881c9f14554626171ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
10KB

MD5
196d361f45d3672a6695316adbbf9c0f

SHA1
d78d0eff70c2c1d5287c28a711afadef25d1dc8b

SHA256
36d2343e0ec52462cf448d3645ff712b1d9be2cd752e302cfd113c40f4b8962d

SHA512
5a3ce309cc275f5ccc8b856f15f675602f7052b4561e3cf8ac6f99ccfe89e0d053cbacf38422ac679150869a798173e584883755eea455740aacc3d8669ddf0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1008B

MD5
190cb2e73798fd65c8dea185977760d1

SHA1
25f22427cf78a45ad36270fbabb79defa437440e

SHA256
3a8ca4baf7dfb19b938c3301529b28be91bd8db9eed20cf9efc83da12c50a4b1

SHA512
b9e1e646df6a5a48a1d3ebcb3156afd2892f532e506310f541882704405836eef7180b5d6f9f2994d0c50e7fdda49c8438d8633f2d4f2b3a275154c6f7819725

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
cb67eba5c87d910391cfd2626c51ba00

SHA1
0febd29627bb3d52e636dc5d09f219d96d6d0dfe

SHA256
3ec9331e1f5b45a856e093c7f6a88197504732a9711d6dfb0a5dfef8ff8485dc

SHA512
0b14c1f7c17d49bb2c7ce1966b942609b4761a2f2a21f2181b28ca0b204ae2eb17009a5c2d9ef4b6ca4bffc2474aa192cc42b4829ad96c43af6e28fb4ed29398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
6c60685f6c78032ace89f671b0ef56da

SHA1
151f68b88d116f3a03265f422c018110d3bf2ea8

SHA256
4ae4de7c91a091d904bcb97f5aa7148c01630e5188831b1a02020339d63e76c7

SHA512
29aba7af20cb81e2ab4c9802f0a335cdb89282b6a5536de56429ad4869b777febccb0ead873555ed81d0d664c2d697916ab9cc89426cbf3042b93745f2cda3c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
446acb04cbf675539b87d7341bd6c038

SHA1
87bc74b7fc0de80b348b60e96e9a338aa5b72f08

SHA256
7e8bca9f281dac25775172803ea32af018f7af39941da5bda3bb6195cc36cea9

SHA512
fdc96c5122ef5ad5a89140757185225f2c469650c1a5ab4d27a4e672c3917e9cc39f7c7b56976e249569ab45acfc62acbd81ed2524f294c0e99e34ce242dd353

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0ea738669e37f93638fd15c2184544d

SHA1
2f4d338fd4ead5378b4e4d58e1893df85a470046

SHA256
b5386dccf64721a8520c3319d8a6451e21f06fb19bac07c348d60b67e093e5d1

SHA512
a6a5d9cb950dcbecccfe48f6e74fb5bba3a63e3bf9a4eee94517de42db9751512e6089af8d4212626ad2f9aad94c1278d07dbb8462edadeda17a166bf6fc7e2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bf8c94d59bd9f70beebef2e43c72dd5c

SHA1
c22176d5a00757ab9fab3f4271e374c552f91ed2

SHA256
1fca598c377fa991766d77ce924ccc2a11ee008aafaa769752f83a66be2c6bf9

SHA512
dfdd4b44e94f02ce15329974a2ef7c5403cd91b4f314b03d78965cb960fe46a03817d0e880bcfafbfdce636a32bed217aef96d005d6cfe3feef77ca91426399b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5dcab3f367e7744c530ce60105875dd2

SHA1
c5f4d8e8a260feeb714e85225862589dd4e739e4

SHA256
a6ccd3496ff5bf5e4ab02f22d88c05c65c9228d0b060acd22f55626c3558ef67

SHA512
eae92aa98afbd6fbc35723ec0bd1f1da62d48f5b483205d104a69f9ea710b86f1711a77c478ac442784e618d771026ce80b2c8ce17e55402796e07318301c59b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
308278b7be7f6dfbd9e00452f0b7b06e

SHA1
33b4174dc154635a9f5156b77ef255eb7aa9809c

SHA256
0d099e6ca536de650bc4da606b6d5e1060f100c9c6e33449493ff507f7499e86

SHA512
08a909fc97c51407173ca7b68f0305adc7f999f1240ddf00075ae7f2553a3a00f3610e367808a57546e69cf322a147e4abfde5472e7d05ba1697652111dbc751

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b4761a468643f941118e2fb9401da112

SHA1
3656b6ca19ac4c9e3bbd6a9bf837dc753e6742bf

SHA256
48e97a73ea0ee97cc2ab2e528fa04bcd281906dbd46fcd5bcafb8dfff61019e2

SHA512
c85be97dba04089d455db374a52d4a860ab9e763163dd2ff0cc75410aa3441f6a18a7bbe34a7250d2064617b83c8f1e02dcdb788df55b3382e0f789cfa2aca4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
fb304e3cc10f6ad2ecb82562b43ff0ab

SHA1
0e79291c613cee7b3dec2c1c7b73c2c999f50181

SHA256
0617c7693b8dcc85c3bcab84b64e1aa8d6b2561f84c7c618a25ebbadb1bbb9a8

SHA512
c9af1ee750136b3739a28a4e49c919a57de71d4ad50456f6ef41287be8359a06f5fcb7ec2ee2c056318137a6749debc0dacdcd709c63fec77efb218c3d5906d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9ae7d70e1f293bf06c6c676a4cef2ebc

SHA1
a303fdeb1f6308cb90356142f2e143b2073cd4d2

SHA256
6593195c6d98c2fb766d4065550c8b45078b2e41745cc39c1ebd6e02ff7a1e8c

SHA512
9d6a9fc6596210c9e12a146b4273899baaa1334c2a3e11f06572f43f13aad8423be259e2972db4ebceab963ad21d18e92c9191b9743f314b8e55e8f5453f1dba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
7718e8c4887f94cca3959ce0b74dcb15

SHA1
a44bdc5498de29706ef2948462977b65c3b19ad2

SHA256
2f3a73d0b0e7680451ced9238c850a20688c7a70e4436909c2dc741de0981ca2

SHA512
78461c95766da7beda0892fb1431bb3ae56448ceff00b27f7dc45102ba3567d7321ccc9635d5bd5bb3135e643d8b139db116ecbed6b02d7cd30b6cbcfb396cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
63ad4540c780e3b9ef02124ba1b8bbfc

SHA1
e7e67504604386836e73a8cda3cdcc14b7f2f69a

SHA256
a6553b4e6dd9c7a827dabc241a1a47bd7f7680d14b543fdfb5a6564f8a8aba86

SHA512
93665ae25d4ee41b8b044017c5c5da7aa87547431181f29f9144caca9ad4e2107cfb7035e778a645a8a9de635c02585b8c8bc8a2fcba6cda0d8edb1ac1c7ddee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
c6b7140fdbbafa2ee2e13755d5a4add2

SHA1
8f62985d2dae24e20b901b197c45df61117b3e4d

SHA256
d8389b5bdee60efe794e11f431ff0fd6a66b85741bb6098d0b1dc0c0e973e54a

SHA512
e4b937f9dda13309e49001e4003c4d5ebacf0306fc6199dc5465fdb653d34cfcac0e6a482f368ae8f277381df6a2135367ef7de32bde868011ffd5ed10322f12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1132f923b923b810e048d8e9e8c555e7

SHA1
b37e49f102cc3229caaa907097fbf454913391f4

SHA256
5bb5c08c45bc18cbfc4589a26d9fb76b66d2865d979a81c9613312266552f9ac

SHA512
2e661a98734c192748db3c5bcb055ab91bd1b4b6fafa7855198a595c57b8cb1d5d2889a0cd1a882cc1965e4c9b1dc1e5d275576b291488aaf879e367ecf83baf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
f94a35117be2977381f41b92488f436b

SHA1
6fffce0aff3b5dc2fa3c69af72a28b330208009d

SHA256
552256fa9a6030a31cada60ff977f7f2ff7693de584ecb1f89565b451124f4db

SHA512
b1839d0afd92bc2abd83765b75ad94227c2e4e92869271de8527f528c086c5c6bbae9ebe9fcfdd4120e3351bc82edbd66f5f68d5d346254eb0cd4d655c601a9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
0f6f4631298fe737294a3f5d1c50f0f3

SHA1
5922d75c96e6d63afcf415fd36304f4598779d2e

SHA256
3413ea2da503ae3155d1787202c2934821c2b0b13c696a9ef682eb9beba00947

SHA512
17ebee68a5d0a642b129a9d6a148fe8ac9150d402dbd9c766a5ce826c75910a48e35e519120c0f3a84a4db851f609ac08a21653c55f3cb92a18e7013686c30d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
c37ed2451fad37459bb1097e952adc63

SHA1
3fe490cb4653f60259d824630b8b96f4aa3fd5b0

SHA256
d89888f38006462a027c744432f41b566993ad67d7212bb206670a8f70a9d0c1

SHA512
55489b7d8a9a5f5f76c62a81306bd494074b70799994503d3332e0d7c4b3b8e724ee9d4e2d25136805c3b29dc0140f614931819339657d95eed3e97c741c7dc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
564bc2430c0abd4f86f5286a4e847b89

SHA1
b52a27c4d9866620fdc7718bff7808ad81b45843

SHA256
b8f35e23f3735f590d133e9a2799dad87e2048689a17e6d84fb83cf7613e4a8c

SHA512
2c3dcd1c7e245c9f316a2df9ad1ac744738ab99a3248fd85b33ce30e76db64835b855a0292e80e74b22ae1efb1fdef9fc5d9a333066efbc6a8c25cec5cbf3082

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
77b7129a41c923118d96110b77fe6309

SHA1
c9ebab3f226e4b34516b813c1a07d7e4350898ac

SHA256
e239ec01826b0d751d179a360b75f16228551716f8eaee3f3da1d8c4debb8a41

SHA512
6e6ce6e6f2819afe1e373e5f1ee1382cb3f7837556b5a4ae3089773192b427216a7d0b0dc497ce01622b1035935d396d4685deb023d65865c94f79e4ced6f723

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
bdde10f8301798c21ec50e10ed0a2044

SHA1
ca3c582fc751a5690678c9bc5126e6b5bed17e0b

SHA256
eed37924f46e32e90d83fcfbf2bd0a838645b2e7a673d01556d371857597c905

SHA512
064aaf223d4451190bb3149fe509a779c41124515d85f26d34c8edc26b9ebf3c321238dea807ccb0a60550db77edbad9b25a64437345543445b83a041f82f70f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
3030196ebdf55884b734c90ded4616f8

SHA1
78c3a8ce04bac3ff52a35b214ae156fffd8a4d7b

SHA256
0ce036c54743bafc552b0ec7e39ff5e843e286e38583f6d8bc5dd9d0001b5eb0

SHA512
7073967543b217c270a5df3ca3199374866ca281b1b37fa2d2f131f03b53c361a539d00d275ab53f8cf253a3805529df33ba07c2033b55bdba2da73bc75e0bbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe62364d.TMP

Filesize
48B

MD5
2f2f2ee59afebeb40a70df80186d16c8

SHA1
73d4782475aedfe4c74325d8b8bf26cce261959e

SHA256
9d7f3045c4f45bc90b3a9872c6a78ad73f1ef7734213ca3f8a1c3ad19859ddf1

SHA512
7ef86d08ac0532afb298c027a2d7ea4d8458075358de16b20319f2eba182f9046866cfb5af6771c091ea8c140a484a89b1b801bee55361a16f27e68095275064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84b7a09798680240336232e21450e592

SHA1
d485980d0c2a35c875e86e6188ef23923f28b9c8

SHA256
8d71674c562827174b918335c4d9fda05a8d591eeecc8d6e99565da09794db93

SHA512
f9e877dd3f197a1e40a586ccba239bae9f243eb10d0e463d9fe5b299978b13c1aa54fb20d6dae2535bf85cae84dfdeb14ad7b85fb358f83ab7b0dd4610d53881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f71c3ba51a28c7c35deb0829f4bd520b

SHA1
9feb0838269f4dd9a6995f1636cd943d7c6d707b

SHA256
e3890124da38b8a1312dc0f2a1e249faa0ae1c1b145d9f700a2a3f61533e6ce2

SHA512
603a203988a6c4c0ace140ff680770c91c6318099f7ea38bf3f79e050cf01ba05731947f66c1bb2ec0d2ab4c564f4ac968252de52715490522d6cae1392a25e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
74a1f9fb1e8a6c98dd174afc04f14b65

SHA1
09e2031358c9c135299b9298922bef933c4508b1

SHA256
b81f503ec433fbd651929d5096cc3a148220b7a99bf528150dacdeb3f5a4cf5e

SHA512
d95357d1c941e3c03b566d9c428b0ef0b0eda9329935cf8a243114d7c9f0461719eebc86cd50be801ed2e6b3382807a1b6b63f460553bc58194322b1e66c613b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2360d6542be0d44dfa4029603187d00c

SHA1
49fefc68ff7bd60ea0661b286405448896d297c7

SHA256
6bdda07de33b17a2b0fd624772d3df7b991cf0b7df030a11cbce951a730e1491

SHA512
214d75533e057613fe9dbef27947be801ddd399e7f5bc692031ca14ff288763cb8f7dcfb637b405cb64756efc3f267a868c11f602a64c8e4fe8ae788e60146f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
fe31560c384dbeb30be1837a59c9277c

SHA1
9fc14d906432e768aea00190f776cb781835bb5e

SHA256
361f2aad86fad503788b4fbe8c97219f5e294e7c10dc14330b21b0d987e881e0

SHA512
c41a21cb3c36e5609c750011a240e08b39b1dfffe87e3b17fb61595ce78879defce89cf11814b6009a8d45d81bd231bb5d8a2cbc7fc2de7b592c8e06ea3a7deb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
36180f863e0ea304653a6a177cf53411

SHA1
c9ccbeaca4fbb720e47538369c1813b989363544

SHA256
3c3ab16c50b49b3181e25dbf88f9a22d03010dde5b9d46b1de7b85cad4bc948c

SHA512
c40f67787875fdf17006397a90c8d12abc7106a44b12da19f9d9e224ffde7d05c658e71ccc7d06ce05c608bc75f88b70e3de86a945dad62c4d7fd7a7e2f5096f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
ed6193a923958caf30e43043ade3b266

SHA1
128d8c881f88c4a75be2d3a8c2363aa8dc1f450d

SHA256
7f5a33417a032030f24758bbbc13d6440d59b6fb067f8d637586b0faf0e68e96

SHA512
700824b165270829213cf7436f03f9212f5d2dfbfda705997940c23c738cf3132373b800667f1de87af53f1822d5c4d88d96516ba7a4939121bc13d69ff4c43f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
200a7913ecc3f47f8320ecf7095ae389

SHA1
d29a3e2567fd6afdb5afcb0d5a552db022685bad

SHA256
6590326e735953cf9500b65e7447384e855c4f1d0b5440f3f88285fdc3fea015

SHA512
e63ff6e2ffc430c7b13cf111c9d695d8195b2c56e74cf7b78727d1d49513065e9ad5f2b9273778d8c592bd226c236fae07a5c6620a03e774253acaac5e7ef4e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8e4b68d10fddd3ff600051b9a80329fd

SHA1
953eccfe443c345effee5ca89f7fdb222554ff0e

SHA256
b50624e4dcfa136de761d9c289c8a4251b4d66fdd4e063c3568dfe400c4da2f2

SHA512
a0e9a7ad85ddf6321f9306f42244b575895bc7ebc0eee4136abbeeeb434b26939f7c0adf640ffcc6e075035b01c81771c9d725f6e685586eb4c4bc3ea17ebf7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7a4da49241a1da079938b256fa3a805f

SHA1
55b61d3d86cc5d676b3b45187a597b12a71b826b

SHA256
ebcc6edce2b4ba369b9773b483757ec5f7625d1fe2ef986fae068dc8d1e567d0

SHA512
1e2c17de34375765697cf9819344e72a4a57922dce3c4520747a3d87359d3de4fc3ec496c418636e1eaae5b04c4f5928e91f3cfc220c9d2921d57d107740634d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
261b261bc5d448c662ebdbb20daa7697

SHA1
a022836cb331f44734110a5a1feaa0bbddb5dd89

SHA256
7aeb82c0698750adf84b6d56c37dbd4b999261e34c8529e83846cfd3dfab74e3

SHA512
173012c8276c1037d1bb05a9166cc509d6b3aacff9c35643b6346f6d8e2e29f572428bb8beb82c8b3f36bf85cd125dc8c44164eec7a5c8140419510522d58ac3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
60320507f7ea48a8eba0a3803629bf7a

SHA1
e8869d1ab10185f2c95d7e53ec2f5596fb6c547b

SHA256
f5304ef0430df4fc49b56b8c444f7fc61d377f2d9415e41fe36cf8d136ac1026

SHA512
840a0c6b953968cc21c4fec65296e575f8a0afd6fa6bd65d222069b28638303651437b298d16cda69c0d61892cf3e5c3f2f123e18e0998d5cf00ec51fa3ff303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
b35a764dc1f6753ea2b6c73564615203

SHA1
653cecba3156f5cedc1c59818510c1f0d8298c2c

SHA256
fe8397d4e68d06260d5dfe52b387c6f36049d4d03526a8a90ec59203159c402e

SHA512
45b3203e13a093cbb15094607db748d20e1749d18c3fc75d119f57f6dfd04bd4458be2d0348ed112a9f77fb75423fcbb0ea322d27ab713d94f4652d504d83f86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
6c141fcbe916124142262f66690ca22a

SHA1
ca9523c339126c1785ec1188ffeee07f2cf1a2a3

SHA256
63650d8d7daf914471071a29437433e776d8416719a1efa6c46636542c55c184

SHA512
d8ec010559a26cb8407928c9fe25016bfa1c9ca4eba8c9deff9ed14985539cca7918e7b0a75193da84ec012016d2a141507d00c4bc833c97622312d77230ca3e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
ab0c70526f7c20a049cb9d826ac9f81d

SHA1
50054291e9a7e8fdfdcf7b0388be33d161809dc1

SHA256
bdaa37048bb674ab82561da5f4d59dca6d0898db41ed90d78980fadacf1b66b5

SHA512
6250320c3bd2fccff6229f1b2ed6c62fb823aea29c734cd917bba17e6b37896c5fc97c5fdc3cde2df6851cbded482b93da5ff14a9cb3a34b51a3b8b666aefc5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
bf30155de0120c7c3c382ae155c57cda

SHA1
8244242302d38353c86d5cd2f145c08767552835

SHA256
d352fa5daddaa2d4fc7fc68cb706beecb0c8e9383a1e217618c278d7997c35c9

SHA512
314903e3d36e5f92a3a7de35bdb85f7e970fb607926c4335b65957af56d48dcfb7b723d30590013a193bffd8d36aa58c0d137379283f41ea4ff2700494d6176d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
954de038bd88dd7abb4d95eb8945e8e2

SHA1
71f3589ede6fe55edcffcc8a504c616ccba9c152

SHA256
a9a7235333b7ffd074eb07afc553e3967bf1d191f1a3daa5204cb84b9367b5cc

SHA512
e530db1769bd88c79c792c14688ed061c66b2a4d2021e26981a08218d52286472d1caa9fda0b3dc666555ddc26393ea9f2493aafbb48f76200e4fbb7f0275ea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
cf4743b656188ead979da70469d16ec5

SHA1
fb87dda4b247cfdd633c5e97a08bd3bed9131d70

SHA256
26c74985cf3ab0de6a1206abab5bc0c246d833385be39331ea5e5dd71b1df1fe

SHA512
62c85a5eaa52180c3baa5defbb5f7dd8b6f260f3ea85a5e20dc5082e64fbc2703c299053cf4770c608a9da99790e7128e13a93d7b49604e1a6a7e41d75991a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e650fe0dac3e2454bfa73ae605e383d9

SHA1
56b9a27cf36b660223d94688861eca039a37ea96

SHA256
649b5ac60d0ae808f6a6b04c9f338968182f5cfb00f91a456bd1132ee0eb3033

SHA512
1158401b704af5ab96431fcdf22da7e62bb3dcfc4356670d5aa093176229504652bdf8e298540071e70cd9d3bc0d72c3dea491bfdc1882929a477392011160f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
652af0cbd3ffaf4e27ca3d5b6b48a1a5

SHA1
2bb398a299ac4f7b159ecd852955eb282c12ef73

SHA256
56dee192828eba2824647ba0316c0bff01029221ef1b1169add7214f4c421283

SHA512
2624a089a791ee0ecf5939c46ca1ca49c2f77ee31a5d885ed0586f6580961cf71cc7cf18055eadea42bf333d4024b734b3da3b61a5e786d50c73681f33817fe8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5815b6.TMP

Filesize
1KB

MD5
3a9f1748358bedea2ff74f7331f7cabf

SHA1
e24f8fdf67cfb443832f35c187695e8ff82f1562

SHA256
4160bc87ffbe7e7264fc2c7e677b0782175194dd65e71256eaffa5e583389d69

SHA512
cd5e3e02a4f5e500861a05ef89d7ecb0ccabd7bc4a10227af5fde5142c1ab8d873c113836f3d14c78efb381fe07c851aa771bada952885bab0022d025d811c08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
5913a2f49360b50386752a5ec039c987

SHA1
967ab93636f608bd24c220af4fa0dcb65429c25a

SHA256
14d3b6a32ba6f819386b42746a4fbd852e32d93ad2943b72695b109bd5e49587

SHA512
9775bb33af7106a35c01cd61d9d06d05554c7f145fac40fcf06a75515d8ccf4864db084b6db54bedfc3d0d874dd496bbb0e413d5057eb47a074c6ee30449e5e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
37f76ac112fcdf8713354831ce212de9

SHA1
7a78c6a8763f82018e044ef56e4a7b8411f03c46

SHA256
2e91aacace0faa9f0ee87d931782905b54a7fa5bffbe6424f59a8768bbbf2d19

SHA512
1a9a059301c45a324f02d56a88fc7c60f3f61461fd52400402f6ebd0830f191af16d38dd53a039a694ea00ffd9194b63c664243676b468b6effbd558e28d5b3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
4ae36f5b4d95243674bb4ac75ee2bd9a

SHA1
f2dff855ed353617c3e9336793f602fed1b0737f

SHA256
5e15b8170a937de2b27f18dc070297b9adc61008e1ba2708d2e86a9f0a686457

SHA512
dd2e0fcfac90da5476b81f8db549b03491a62ce9421d30bf1264899d1fd3334cf9650e884d3e501fff149981d57d2b3bd14634eb270f30b4d306a353f2ab7faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bbd5c14ac77a378ca1ff3adb633d6c65

SHA1
80fa5a07aca829feb20ec5daa009b27da5081e1a

SHA256
048668c74c5726d47174d50e9f5d0b32ded92705d92de603786b6c5f71ea3890

SHA512
16ba6ed0f98fea64aa8829d9cbbad2f6666b09f596605ba21e59b09015f01a8edca205c7928383ad5346273b974ee55c64899abbf41f7da9968d4ceeaf081ac0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f0594a3f0265793e4011aedc6bd58ce2

SHA1
549d8c2c23361a428601b605b96d388c5c8e2955

SHA256
688eea36f87d7996919aded2deef77190e0529ed40ed19b785ccc58235989ce9

SHA512
a24fcdabbe9b0708b5b4895c549015c1a73e2a693ddaceeb1e2c81755c2ae871b2f8c6c0133752955f25f4ac7d0628e1b11fee1fa7dd8af719e694cc3017b87e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\Helper.dll

Filesize
2.0MB

MD5
4eb0347e66fa465f602e52c03e5c0b4b

SHA1
fdfedb72614d10766565b7f12ab87f1fdca3ea81

SHA256
c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc

SHA512
4c909a451059628119f92b2f0c8bcd67b31f63b57d5339b6ce8fd930be5c9baf261339fdd9da820321be497df8889ce7594b7bfaadbaa43c694156651bf6c1fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\WeatherZero.png

Filesize
29KB

MD5
9ac6287111cb2b272561781786c46cdd

SHA1
6b02f2307ec17d9325523af1d27a6cb386c8f543

SHA256
ab99cdb7d798cb7b7d8517584d546aa4ed54eca1b808de6d076710c8a400c8c4

SHA512
f998a4e0ce14b3898a72e0b8a3f7154fc87d2070badcfa98582e3b570ca83a562d5a0c95f999a4b396619db42ab6269a2bac47702597c5a2c37177441723d837

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\WebAdvisor.png

Filesize
47KB

MD5
4cfff8dc30d353cd3d215fd3a5dbac24

SHA1
0f4f73f0dddc75f3506e026ef53c45c6fafbc87e

SHA256
0c430e56d69435d8ab31cbb5916a73a47d11ef65b37d289ee7d11130adf25856

SHA512
9d616f19c2496be6e89b855c41befc0235e3ce949d2b2ae7719c823f10be7fe0809bddfd93e28735b36271083dd802ae349b3ab7b60179b269d4a18c6cef4139

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\finish.png

Filesize
3KB

MD5
f765a844756b1831e35948eab6648aa0

SHA1
77587bb9b43ea58d53f4b032d0be2d19249e21f5

SHA256
9637a9463cb02abb2ace26df81a7a101ea6f95d6112273c78c5fa23f3a1b19d9

SHA512
ffc3f981cca14eda8ef5235632d6003a44cc5be206b915f3717b7c552c4f81e556f6417e1b82fa75b7942fd7510e9ad8c6a94c8fc2ee91d80f92f9fe1539a75b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\loader.gif

Filesize
10KB

MD5
12d7fd91a06cee2d0e76abe0485036ee

SHA1
2bf1f86cc5f66401876d4e0e68af8181da9366ac

SHA256
a6192b9a3fa5db9917aef72d651b7ad8fd8ccb9b53f3ad99d7c46701d00c78cb

SHA512
17ab033d3518bd6d567f7185a3f1185410669062d5ec0a0b046a3a9e8a82ee8f8adb90b806542c5892fc1c01dd3397ea485ebc86e4d398f754c40daf3c333edb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\mainlogo.png

Filesize
8KB

MD5
07048802a31a80cebd26ebe37aa21cb3

SHA1
37efbc0deec87bb88352f8ace36736ce6504b308

SHA256
550da88d16e38a54642ffc9a531f17fcdb739912d32164429e779643a5a9a83d

SHA512
3ff63e39587f9544ef972a3aadf164c4a7004e54418ef26707815d48a559846339c6ff0004ba52f8f365d8bfae3e51b5136f196685b7790756afbc2e1c3c3146

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\prod1.zip

Filesize
515KB

MD5
f68008b70822bd28c82d13a289deb418

SHA1
06abbe109ba6dfd4153d76cd65bfffae129c41d8

SHA256
cc6f4faf4e8a9f4d2269d1d69a69ea326f789620fb98078cc98597f3cb998589

SHA512
fa482942e32e14011ae3c6762c638ccb0a0e8ec0055d2327c3acc381dddf1400de79e4e9321a39a418800d072e59c36b94b13b7eb62751d3aec990fb38ce9253

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-11EAA.tmp\prod1_extract\saBSI.exe

Filesize
1.1MB

MD5
143255618462a577de27286a272584e1

SHA1
efc032a6822bc57bcd0c9662a6a062be45f11acb

SHA256
f5aa950381fbcea7d730aa794974ca9e3310384a95d6cf4d015fbdbd9797b3e4

SHA512
c0a084d5c0b645e6a6479b234fa73c405f56310119dd7c8b061334544c47622fdd5139db9781b339bb3d3e17ac59fddb7d7860834ecfe8aad6d2ae8c869e1cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-G7UBG.tmp\memz-trojan_MjqN-N1.tmp

Filesize
3.2MB

MD5
37e92b45bdfce60551dfdbafa18b2b14

SHA1
a2617ea4e5688c92ba1c5597c42529c3a836d61e

SHA256
78629b84ff2a802413cc2669ef2a6aeab4fc87db713079d194a7b5bec72854d3

SHA512
2a793dcfe067747efdc95e2fb6fcc3481d2340a75c5e7d6a6a4626da26643a48da45796a9718b28a4dfe3363f0eafede4ad6d19988f9c88555f8cfb0e9d19a46

Download Submit
C:\Users\Admin\AppData\Local\Temp\mwa1493.tmp

Filesize
135KB

MD5
32528f494643e0e05625d5a5b8e61263

SHA1
701eb330c5f29b2178c6196404f3bc53e297987e

SHA256
926061fc6a92079aa227cc2e426bd5b2130501422a95e6a8984f15f05dee2e70

SHA512
80979203400fde66bc2f5567c2cc5a60448b8336dca93b8ef7d2d77033a063a9c581b9acdb99f81c1affae5fe159f2b4bc74b842104ffbb05172cb4656ab561b

Download Submit
C:\Users\Admin\AppData\Local\Temp\mwa2C61.tmp

Filesize
173KB

MD5
6e7f3a7401c7da1e60f5df4531738ab4

SHA1
fc6305ca9ae4023d45ca8d7e67304f59a8ed2aa7

SHA256
6dd62d41da015e4a1486a8866fcb28ac1209a552be8313dbd63e821cb46811c8

SHA512
4f6984e41b17bfe78a8d27c6fae33b3a2f7d8db3479f73ce3a1d42782db7ee029bc44b77cdc3ebe0d046e72a613ccfe406748878d5002e947cfce266cf90af41

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 220616.crdownload

Filesize
3.6MB

MD5
32595caa2a6bbbf58e9cc3c145e2aafe

SHA1
a85f67867e000d7bb3a074bb2b84fa3a143d0663

SHA256
d9fc9e75e174f309efbbb0a4fe13ea27e50c0d1eac65e0ddc858a80a3a4c49a7

SHA512
151748c2c0971d0c9cebc9e4cf3dc0f36e72d9a4f288fff1979729851e6e4ec1ba41e6c4e20f5e13448ac1b9e940a3aa2bc2b097800e9640759f442c95eb4017

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 630002.crdownload

Filesize
2.5MB

MD5
787e46ea682fdc4ec93a0060f91fbb6c

SHA1
0ba5e3021cd67ea146cfd2e726e98a281bb08e7d

SHA256
02aaff85a97f1298bd46aac85e31636ceb3bf5ece716e7337a59f7426a40aa7f

SHA512
cf4d74a3d4275cce411ecb6bd19c1b30c4681c0d51d7620d431c8a3e729979a301adbe556b622313a34715b736626cea5ac949d2520b6a08d9b9de510d95c728

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 718127.crdownload

Filesize
12.1MB

MD5
c8bf514a334eaa148cb3c6135c2fb394

SHA1
0e47a89c3729db5a6f195c6abb04e5129d788df8

SHA256
9127560918eaefe69f1959bcb7f7e13b7e3a7ac156b564922829faaec9b96f67

SHA512
9879a258f429ef492cf495dbddd4f2b9c9fbc061e325aa8ad870ed05049b7ad595b26d223d20c55fc99f403fc9b5d0235353d71bf5d9a39ee4462838feb247ff

Download Submit
C:\Users\Admin\Downloads\memz-trojan.zip

Filesize
47KB

MD5
c31e52bf196d6936910fa3dff6b6031e

SHA1
405a89972d416d292b247fd70bbc080c3003b5e6

SHA256
8b47e773a782361209f8adacc8d6aeefb595e1c13ae6813df7de01c20a15c91e

SHA512
a5335c7d3beafdefa6cb1a459736615ca0151fa2e64dafb78de65aa4b924068ad0dc55c70a5317be19edeb899f94ea02e2e54279933b87828ebe86ef95f13291

Download Submit
C:\Users\Admin\Downloads\memz.by.iTzDrK_.rar

Filesize
17KB

MD5
352c9d71fa5ab9e8771ce9e1937d88e9

SHA1
7ef6ee09896dd5867cff056c58b889bb33706913

SHA256
3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61

SHA512
6c133aa0c0834bf3dbb3a4fb7ff163e3b17ae2500782d6bba72812b4e703fb3a4f939a799eeb17436ea24f225386479d3aa3b81fdf35975c4f104914f895ff23

Download Submit
memory/4180-1119-0x00000000005D0000-0x00000000006AC000-memory.dmp

Filesize
880KB

Download
memory/4180-1168-0x00000000005D0000-0x00000000006AC000-memory.dmp

Filesize
880KB

Download
memory/4180-1481-0x00000000005D0000-0x00000000006AC000-memory.dmp

Filesize
880KB

Download
memory/4868-1485-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1572-0x00007FF7D6290000-0x00007FF7D62A0000-memory.dmp

Filesize
64KB

Download
memory/4868-1469-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1473-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1466-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1476-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1480-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1479-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1462-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1482-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1483-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1463-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1484-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1506-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1464-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1489-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1461-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1495-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1488-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1487-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1494-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1486-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1492-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1523-0x00007FF80D850000-0x00007FF80D860000-memory.dmp

Filesize
64KB

Download
memory/4868-1528-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1491-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1490-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1542-0x00007FF7D6290000-0x00007FF7D62A0000-memory.dmp

Filesize
64KB

Download
memory/4868-1549-0x00007FF7E7080000-0x00007FF7E7090000-memory.dmp

Filesize
64KB

Download
memory/4868-1470-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1584-0x00007FF7E7080000-0x00007FF7E7090000-memory.dmp

Filesize
64KB

Download
memory/4868-1586-0x00007FF7E7080000-0x00007FF7E7090000-memory.dmp

Filesize
64KB

Download
memory/4868-1590-0x00007FF7D6290000-0x00007FF7D62A0000-memory.dmp

Filesize
64KB

Download
memory/4868-1596-0x00007FF7E7080000-0x00007FF7E7090000-memory.dmp

Filesize
64KB

Download
memory/4868-1496-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1623-0x00007FF7C87B0000-0x00007FF7C87C0000-memory.dmp

Filesize
64KB

Download
memory/4868-1629-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1653-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1493-0x00007FF7C6FF0000-0x00007FF7C7000000-memory.dmp

Filesize
64KB

Download
memory/4868-1655-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1659-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1660-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1661-0x00007FF7C87B0000-0x00007FF7C87C0000-memory.dmp

Filesize
64KB

Download
memory/4868-1663-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1664-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1666-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1667-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1637-0x00007FF7D0A60000-0x00007FF7D0A70000-memory.dmp

Filesize
64KB

Download
memory/4868-1582-0x00007FF7E7080000-0x00007FF7E7090000-memory.dmp

Filesize
64KB

Download
memory/4868-1602-0x00007FF7D8EA0000-0x00007FF7D8EB0000-memory.dmp

Filesize
64KB

Download
memory/5792-1169-0x0000000000E90000-0x00000000011D3000-memory.dmp

Filesize
3.3MB

Download
memory/5792-1174-0x00000000051E0000-0x0000000005320000-memory.dmp

Filesize
1.2MB

Download
memory/5792-1179-0x00000000051E0000-0x0000000005320000-memory.dmp

Filesize
1.2MB

Download
memory/5792-1181-0x0000000000E90000-0x00000000011D3000-memory.dmp

Filesize
3.3MB

Download
memory/5792-1226-0x00000000051E0000-0x0000000005320000-memory.dmp

Filesize
1.2MB

Download
memory/5792-1351-0x0000000000E90000-0x00000000011D3000-memory.dmp

Filesize
3.3MB

Download
memory/5792-1155-0x00000000051E0000-0x0000000005320000-memory.dmp

Filesize
1.2MB

Download