Analysis
-
max time kernel
821s -
max time network
823s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/03/2025, 00:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pixeldrain.com/u/TcV2BREC
Resource
win11-20250313-en
General
-
Target
https://pixeldrain.com/u/TcV2BREC
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Downloads MZ/PE file 5 IoCs
flow pid Process 1181 228 msedge.exe 952 228 msedge.exe 1692 228 msedge.exe 1847 228 msedge.exe 1866 228 msedge.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Control Panel\International\Geo\Nation K-Lite_Codec_Pack_1766_Standard.tmp -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
pid Process 6292 Wave Browser.exe 1236 SWUpdaterSetup.exe 6384 SWUpdater.exe 4944 SWUpdater.exe 1588 SWUpdaterComRegisterShell64.exe 4496 SWUpdaterComRegisterShell64.exe 5712 SWUpdaterComRegisterShell64.exe 1696 SWUpdater.exe 6388 SWUpdater.exe 6720 SWUpdater.exe 7016 WaveInstaller-v1.5.20.5.exe 200 setup.exe 4508 setup.exe 1664 setup.exe 848 setup.exe 5280 wavebrowser.exe 3588 wavebrowser.exe 6048 wavebrowser.exe 1604 wavebrowser.exe 5340 wavebrowser.exe 4192 wavebrowser.exe 1312 wavebrowser.exe 4836 wavebrowser.exe 6928 wavebrowser.exe 5268 wavebrowser.exe 8012 wavebrowser.exe 8140 wavebrowser.exe 8160 wavebrowser.exe 8176 wavebrowser.exe 3468 wavebrowser.exe 6904 wavebrowser.exe 1308 wavebrowser.exe 3488 wavebrowser.exe 1560 wavebrowser.exe 7176 wavebrowser.exe 7800 wavebrowser.exe 6776 wavebrowser.exe 5220 wavebrowser.exe 7948 SWUpdater.exe 6840 wavebrowser.exe 8020 wavebrowser.exe 8004 wavebrowser.exe 1696 wavebrowser.exe 8092 wavebrowser.exe 7660 wavebrowser.exe 7436 wavebrowser.exe 4028 wavebrowser.exe 6220 wavebrowser.exe 7196 wavebrowser.exe 3476 wavebrowser.exe 1668 wavebrowser.exe 7164 wavebrowser.exe 5940 wavebrowser.exe 7120 wavebrowser.exe 3820 wavebrowser.exe 5836 wavebrowser.exe 7824 wavebrowser.exe 7436 wavebrowser.exe 5196 wavebrowser.exe 7664 wavebrowser.exe 7916 wavebrowser.exe 5836 wavebrowser.exe 1512 wavebrowser.exe 2420 wavebrowser.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Wine\Debug K-Lite_Codec_Pack_1766_Standard.tmp -
Loads dropped DLL 64 IoCs
pid Process 6384 SWUpdater.exe 4944 SWUpdater.exe 1588 SWUpdaterComRegisterShell64.exe 4944 SWUpdater.exe 4496 SWUpdaterComRegisterShell64.exe 4944 SWUpdater.exe 5712 SWUpdaterComRegisterShell64.exe 4944 SWUpdater.exe 1696 SWUpdater.exe 6388 SWUpdater.exe 6720 SWUpdater.exe 6720 SWUpdater.exe 6388 SWUpdater.exe 5280 wavebrowser.exe 3588 wavebrowser.exe 5280 wavebrowser.exe 6048 wavebrowser.exe 1604 wavebrowser.exe 6048 wavebrowser.exe 4192 wavebrowser.exe 5340 wavebrowser.exe 5340 wavebrowser.exe 4192 wavebrowser.exe 1312 wavebrowser.exe 1312 wavebrowser.exe 4836 wavebrowser.exe 4836 wavebrowser.exe 6928 wavebrowser.exe 5340 wavebrowser.exe 5340 wavebrowser.exe 5340 wavebrowser.exe 6928 wavebrowser.exe 5340 wavebrowser.exe 5340 wavebrowser.exe 5340 wavebrowser.exe 5268 wavebrowser.exe 5268 wavebrowser.exe 8012 wavebrowser.exe 8012 wavebrowser.exe 8140 wavebrowser.exe 8140 wavebrowser.exe 8160 wavebrowser.exe 8160 wavebrowser.exe 8176 wavebrowser.exe 8176 wavebrowser.exe 3468 wavebrowser.exe 3468 wavebrowser.exe 6904 wavebrowser.exe 6904 wavebrowser.exe 1308 wavebrowser.exe 1308 wavebrowser.exe 3488 wavebrowser.exe 3488 wavebrowser.exe 1560 wavebrowser.exe 1560 wavebrowser.exe 7176 wavebrowser.exe 7176 wavebrowser.exe 7800 wavebrowser.exe 6776 wavebrowser.exe 7800 wavebrowser.exe 6776 wavebrowser.exe 5220 wavebrowser.exe 5220 wavebrowser.exe 7948 SWUpdater.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wavesor SWUpdater = "\"C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.139.0\\SWUpdaterCore.exe\"" SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto" 6AdwCleaner.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 12 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SWUpdater.exe -
Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: StellarDataRecovery.exe File opened (read-only) \??\B: StellarDataRecovery.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: StellarDataRecovery.exe File opened (read-only) \??\F: StellarDataRecovery.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 22 IoCs
flow ioc 98 raw.githubusercontent.com 289 camo.githubusercontent.com 290 camo.githubusercontent.com 1629 raw.githubusercontent.com 1845 raw.githubusercontent.com 97 raw.githubusercontent.com 101 raw.githubusercontent.com 1635 raw.githubusercontent.com 1843 raw.githubusercontent.com 1846 raw.githubusercontent.com 1847 raw.githubusercontent.com 7 raw.githubusercontent.com 100 raw.githubusercontent.com 103 raw.githubusercontent.com 1630 raw.githubusercontent.com 1864 raw.githubusercontent.com 99 raw.githubusercontent.com 102 raw.githubusercontent.com 1631 raw.githubusercontent.com 1633 raw.githubusercontent.com 1634 raw.githubusercontent.com 1866 raw.githubusercontent.com -
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
flow ioc pid Process 880 https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html 228 msedge.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 StellarDataRecovery.exe File opened for modification \??\PhysicalDrive0 smartctl64Bit.exe -
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer wavebrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName wavebrowser.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Stellar Data Recovery\Resources\media\Boot\ja-jp\is-DL2DL.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Boot\nb-no\is-ASTTK.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Microsoft\Boot\Fonts\is-A5R04.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\zh-tw\is-3D3ED.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\SDMTranslation\JA\is-3PC8O.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\VideoTranslation\IT\is-56PO3.tmp StellarDataRecovery.tmp File opened for modification C:\Program Files\Stellar Data Recovery\mplayer.exe StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-S60K0.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\imageformats\is-AVNBN.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Boot\uk-ua\is-H900I.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\SDMTranslation\DE\is-IUO0M.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\SDMTranslation\DU\is-FJNUF.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Translation\BR\is-O99UD.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\translations\is-AG0KR.tmp StellarDataRecovery.tmp File opened for modification C:\Program Files\Stellar Data Recovery\avformat-lav-56.dll StellarDataRecovery.tmp File opened for modification C:\Program Files\Stellar Data Recovery\StellarRepairforPhoto.exe StellarDataRecovery.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\Resources\Localize\is-S3SFC.tmp K-Lite_Codec_Pack_1766_Standard.tmp File opened for modification C:\Program Files\Stellar Data Recovery\audio\qtaudio_wasapi.dll StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\BootableTranslation\BR\is-3S3GE.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\BootableTranslation\KO\is-ISK5P.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\PhotoTranslation\DE\is-RQL85.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\PhotoTranslation\Ontrack\FR\is-B2GRC.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\SDMTranslation\CN\is-FU2NJ.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\translations\is-T847O.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\VideoTranslation\Ontrack\BR\is-FF9N3.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-HGKN0.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-7B91F.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\Boot\zh-cn\is-141N4.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Boot\lt-lt\is-17Q9U.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Translation\BR\is-Q3BFP.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Translation\JA\is-VNQ53.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Translation\KO\is-S44CK.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\TranslationSS\HI\is-JASDJ.tmp StellarDataRecovery.tmp File opened for modification C:\Program Files\Stellar Data Recovery\api-ms-win-core-file-l1-1-0.dll StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-15CNB.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Boot\es-es\is-7NLCA.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\TranslationSS\Ontrack\DE\is-CJ2FJ.tmp StellarDataRecovery.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\Resources\is-0DGVP.tmp K-Lite_Codec_Pack_1766_Standard.tmp File created C:\Program Files\Stellar Data Recovery\is-606T2.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\BootableTranslation\HI\is-44V8M.tmp StellarDataRecovery.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Tools\is-UT81H.tmp K-Lite_Codec_Pack_1766_Standard.tmp File created C:\Program Files (x86)\K-Lite Codec Pack\Icaros\is-5JKUK.tmp K-Lite_Codec_Pack_1766_Standard.tmp File opened for modification C:\Program Files\Stellar Data Recovery\api-ms-win-core-libraryloader-l1-1-0.dll StellarDataRecovery.tmp File opened for modification C:\Program Files\Stellar Data Recovery\Qt5Widgets.dll StellarDataRecovery.tmp File opened for modification C:\Program Files\Stellar Data Recovery\Resources\media\Boot\Resources\bootres.dll StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-M9VB7.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Microsoft\Boot\Fonts\is-1IOO4.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Microsoft\Boot\sv-se\is-JSR6J.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\ko-kr\is-9JLLV.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-L63TB.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-4VCL1.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\PhotoTranslation\CN\is-IROUM.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\PhotoTranslation\IT\is-JVCEP.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\Boot\Fonts\is-BGD9V.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Microsoft\Boot\Fonts\is-6A8KO.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\es-mx\is-UKAT4.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\SDMTranslation\DU\is-H5L73.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\SDMTranslation\FR\is-1K8FJ.tmp StellarDataRecovery.tmp File opened for modification C:\Program Files\Stellar Data Recovery\d3dcompiler_47.dll StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-GE5SS.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\is-2PKIE.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\PhotoTranslation\KO\is-8LBQ6.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\PhotoTranslation\Ontrack\EN\is-5UU7U.tmp StellarDataRecovery.tmp File created C:\Program Files\Stellar Data Recovery\Resources\media\EFI\Microsoft\Boot\Fonts\is-1R753.tmp StellarDataRecovery.tmp -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_606522571\nav_config.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_1081402192\automation.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_1081402192\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1306663305\keys.json wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1485739668\manifest.json wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\MW wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_606522571\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_458928288\sets.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_378641049\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\PK wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\EE wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\SZ wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\NC wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\BY wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\BO wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1772003159\LICENSE.txt wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\MD wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\MA wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_282544540\manifest.fingerprint wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_8336752\ssl_error_assistant.pb wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\XK wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\JP wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\BG wavebrowser.exe File opened for modification C:\Windows\SystemTemp msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\SY wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\KH wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\GF wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\FJ wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_458928288\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\ZA wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1854052685\_metadata\verified_contents.json wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_1689491499\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_1550677660\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_267076758\manifest.fingerprint msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\BF wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1306663305\manifest.fingerprint wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_964232247\ct_config.pb wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1118877702\manifest.fingerprint wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\YE wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\NO wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\CO wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_765155074\cr_en-us_500000_index.bin wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\TK wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\SN wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\LC wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\ES wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\CD wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\AE wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_495589119\manifest.json msedge.exe File opened for modification C:\Windows\SystemTemp wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_563957225\_metadata\verified_contents.json wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_964232247\crs.pb wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\SV wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\PT wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\GN wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_2032370090\manifest.json msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_1766664680\LICENSE msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5160_1081402192\travel-facilitated-booking-bing.js msedge.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\UA wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\TL wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\RO wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\IL wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_284837599\_metadata\verified_contents.json wavebrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1294005868\DE wavebrowser.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 5 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
description ioc Process File opened for modification C:\Users\Admin\Downloads\Wave Browser.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\StellarDataRecovery.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\The Happy AntiVirus Setup Wizard.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\SpySheriff.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier msedge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 38 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdwereCleaner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WaveInstaller-v1.5.20.5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K-Lite_Codec_Pack_1766_Standard.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StellarDataRecovery.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Happy Antivirus.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdaterSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K-Lite_Codec_Pack_1766_Standard.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setacl_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language The Happy AntiVirus Setup Wizard.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setacl_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language The Happy AntiVirus Setup Wizard.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SWUpdater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SpySheriff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StellarDataRecovery.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1696 SWUpdater.exe 7948 SWUpdater.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x000c00000002c3ac-12092.dat nsis_installer_1 behavioral1/files/0x000c00000002c3ac-12092.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 K-Lite_Codec_Pack_1766_Standard.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz K-Lite_Codec_Pack_1766_Standard.tmp -
Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName wavebrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS wavebrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer wavebrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe -
Kills process with taskkill 7 IoCs
pid Process 8592 taskkill.exe 5552 taskkill.exe 9484 taskkill.exe 6188 taskkill.exe 8828 taskkill.exe 6528 taskkill.exe 9132 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" explorer.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" explorer.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Icaros\UseCoverArt = "1" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\USER\.DEFAULT\Software\Icaros\Cache K-Lite_Codec_Pack_1766_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Icaros\Cache\MinFreeSpace = "5120" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Icaros\FrameThresh = "8" K-Lite_Codec_Pack_1766_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Icaros\DebugMode = "1" K-Lite_Codec_Pack_1766_Standard.tmp Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875098580299229" msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry wavebrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Icaros K-Lite_Codec_Pack_1766_Standard.tmp Set value (int) \REGISTRY\USER\.DEFAULT\Software\Icaros\Offset = "25" K-Lite_Codec_Pack_1766_Standard.tmp -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\WOW6432Node\Interface\{E44B162B-4287-40B0-8E7A-6E251D80B3DF}\NumMethods\ = "17" SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\WaveBrwsHTM.737NQ6RNIDPCTOU2VE5UK5L3YA\DefaultIcon\ = "C:\\Users\\Admin\\Wavesor Software\\WaveBrowser\\wavebrowser.exe,3" setup.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\.xhtml\OpenWithProgids setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ACE4747B-35BD-4E97-9DD7-1D4245B0695C}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0C08E3BB-D10B-4CC9-B1B3-701F5BE9D6EC}\ = "Icaros Property Handler" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.m2p\shell\play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9991" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.trp\shell\open K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.trp\OpenWithProgids K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{8129608C-48BD-42A6-9EBC-7B0933A5CFA3}\NumMethods\ = "12" SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{2C53B9D4-A718-4972-B28E-2E7AF1055602}\NumMethods SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cbz\PerceivedType = "image" K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.mpc\ = "Musepack Audio File" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rm\ShellEx K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\Software\Classes\.ogg\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\Extensions\.3gp2\Source Filter = "{B98D13E7-55DB-4385-A33D-09FD1BA26338}" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{7DFF302B-EA41-49F8-97B1-9413CEF98C68} SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\WOW6432Node\Interface\{2C53B9D4-A718-4972-B28E-2E7AF1055602} SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{97518FC7-7CA2-4921-BC40-F4A07E221C1C}\ = "ICoCreateAsyncStatus" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ogv\ExtendedTileInfo = "prop:System.ItemType;System.Size;System.Media.Duration;System.OfflineAvailability" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.ivf\shell\enqueue K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.dff\shell\open\command\ = "\"C:\\Program Files (x86)\\Windows Media Player\\wmplayer.exe\" /Open \"%L\"" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.tp\ShellEx K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.webm\Source Filter = "{B98D13E7-55DB-4385-A33D-09FD1BA26338}" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{44367D77-92C0-45E8-840D-0C098E650CE8} SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{D3C865DD-E36B-432E-9E47-554925B86737}\NumMethods SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\WaveBrwsPDF.737NQ6RNIDPCTOU2VE5UK5L3YA\ = "WaveBrowser PDF Document" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.pmp K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B98D13E7-55DB-4385-A33D-09FD1BA26338}\ = "LAV Splitter Source" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.rm\PreferExecuteOnMismatch = "1" K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.flv\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{c5aec3ec-e812-4677-a9a7-4fee1f9aa000}" K-Lite_Codec_Pack_1766_Standard.tmp Set value (int) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "12811" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\WOW6432Node\Interface\{97518FC7-7CA2-4921-BC40-F4A07E221C1C}\ProxyStubClsid32 SWUpdater.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\CLSID SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{3BE77C6E-0029-4F24-B677-32C9E15CD8F1}\NumMethods SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hdmov\PerceivedType = "video" K-Lite_Codec_Pack_1766_Standard.tmp Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.dsf\PreferExecuteOnMismatch = "1" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\Software\Classes\.mxf\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\Software\Classes\.m4a\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Media Type\Extensions\.bdmv K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{44367D77-92C0-45E8-840D-0C098E650CE8}\NumMethods SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{D669BD5D-A9B6-47FD-B558-81508AEF48C4}\NumMethods\ = "4" SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{E4E159E0-7B9C-4D75-AC11-A80628173DE3} SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.f4v\InfoTip = "prop:System.ItemType;System.Size;System.Media.Duration;System.OfflineAvailability" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.video\shell\play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.wv\shell\play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9991" K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.ape\ = "Monkey's Audio File" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\Software\Classes\.amv\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1} K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{2C53B9D4-A718-4972-B28E-2E7AF1055602} SWUpdaterComRegisterShell64.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\WOW6432Node\Interface\{7DFF302B-EA41-49F8-97B1-9413CEF98C68} SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{DDF98EF0-2728-4A8D-8B0F-32627DC56437}\ = "ICurrentState" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{171252A0-8820-4AFE-9DF8-5C92B2D66B04}\InprocServer32\ThreadingModel = "Both" regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\.mkv\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{92333BDA-3022-4A7F-8858-081260EA85DE}\ProxyStubClsid32\ = "{D7EC6DDA-90E9-44BA-863B-6C3500BB5BDF}" SWUpdaterComRegisterShell64.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\CLSID\{6C4CCEAC-D03B-4674-B2A9-D44A1D18FD9C}\InprocHandler32\ = "C:\\Users\\Admin\\Wavesor Software\\SWUpdater\\1.3.139.0\\psuser_64.dll" SWUpdaterComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ogv regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.rec\shell K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.spx\shell\play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9991" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\.svg setup.exe Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\.opus K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ra\PerceivedType = "audio" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KLCP.WMP.dff\DefaultIcon K-Lite_Codec_Pack_1766_Standard.tmp Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Media Type\Extensions\.mov\Media Type = "{E436EB83-524F-11CE-9F53-0020AF0BA770}" K-Lite_Codec_Pack_1766_Standard.tmp Key created \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\WOW6432Node\Interface\{D669BD5D-A9B6-47FD-B558-81508AEF48C4}\ProxyStubClsid32 SWUpdater.exe Set value (str) \REGISTRY\USER\S-1-5-21-994669834-3080981395-1291080877-1000_Classes\Interface\{B2083DCC-1D29-45E6-8386-BEE1488D11AA}\NumMethods\ = "24" SWUpdaterComRegisterShell64.exe -
Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 6AdwCleaner.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 6AdwCleaner.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 6AdwCleaner.exe -
NTFS ADS 8 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\scoped_dir5160_1921217884\pefhciejnkgdgoahgfeklebcbpmhnhhd_10612.crx\:Zone.Identifier:$DATA msedge.exe File opened for modification C:\Users\Admin\Downloads\StellarDataRecovery.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\SpySheriff.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Webstore Downloads\pefhciejnkgdgoahgfeklebcbpmhnhhd_10612.crx:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Wave Browser.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\FakeAdwCleaner.zip:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\The Happy AntiVirus Setup Wizard.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\AdwereCleaner.exe:Zone.Identifier msedge.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 9320 StellarDataRecovery.exe 7148 explorer.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2752 msedge.exe 2752 msedge.exe 6384 SWUpdater.exe 6384 SWUpdater.exe 200 setup.exe 200 setup.exe 200 setup.exe 200 setup.exe 200 setup.exe 200 setup.exe 6384 SWUpdater.exe 6384 SWUpdater.exe 6384 SWUpdater.exe 6384 SWUpdater.exe 9596 StellarDataRecovery.tmp 9596 StellarDataRecovery.tmp 8292 K-Lite_Codec_Pack_1766_Standard.tmp 8292 K-Lite_Codec_Pack_1766_Standard.tmp 7148 explorer.exe 7148 explorer.exe 5624 wavebrowser.exe 5624 wavebrowser.exe 2956 The Happy AntiVirus Setup Wizard.tmp 2956 The Happy AntiVirus Setup Wizard.tmp 6368 SWUpdater.exe 6368 SWUpdater.exe 6368 SWUpdater.exe 6368 SWUpdater.exe -
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
pid Process 9320 StellarDataRecovery.exe 7148 explorer.exe 5160 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
pid Process 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 6292 Wave Browser.exe Token: SeDebugPrivilege 6384 SWUpdater.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeDebugPrivilege 6384 SWUpdater.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe Token: SeCreatePagefilePrivilege 5280 wavebrowser.exe Token: SeShutdownPrivilege 5280 wavebrowser.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 1664 setup.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5160 msedge.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 5280 wavebrowser.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 9320 StellarDataRecovery.exe 9320 StellarDataRecovery.exe 9320 StellarDataRecovery.exe 9320 StellarDataRecovery.exe 9320 StellarDataRecovery.exe 7148 explorer.exe 6376 SearchHost.exe 8368 StartMenuExperienceHost.exe 7148 explorer.exe 7148 explorer.exe 7148 explorer.exe 8372 6AdwCleaner.exe 8372 6AdwCleaner.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5160 wrote to memory of 668 5160 msedge.exe 81 PID 5160 wrote to memory of 668 5160 msedge.exe 81 PID 5160 wrote to memory of 228 5160 msedge.exe 82 PID 5160 wrote to memory of 228 5160 msedge.exe 82 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 2660 5160 msedge.exe 83 PID 5160 wrote to memory of 928 5160 msedge.exe 85 PID 5160 wrote to memory of 928 5160 msedge.exe 85 PID 5160 wrote to memory of 928 5160 msedge.exe 85 PID 5160 wrote to memory of 928 5160 msedge.exe 85 PID 5160 wrote to memory of 928 5160 msedge.exe 85 PID 5160 wrote to memory of 928 5160 msedge.exe 85 PID 5160 wrote to memory of 928 5160 msedge.exe 85 PID 5160 wrote to memory of 928 5160 msedge.exe 85 PID 5160 wrote to memory of 928 5160 msedge.exe 85 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://pixeldrain.com/u/TcV2BREC1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x244,0x248,0x24c,0x240,0x1a0,0x7ffba3fbf208,0x7ffba3fbf214,0x7ffba3fbf2202⤵PID:668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1848,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:112⤵
- Downloads MZ/PE file
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
PID:228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2336,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:22⤵PID:2660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2564,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:132⤵PID:928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3436,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:12⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3444,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵PID:1676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4080,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:12⤵PID:5632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4140,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:92⤵PID:4068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4132,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:12⤵PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4296,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:92⤵PID:3044
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4156,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:142⤵PID:3864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4212,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:142⤵PID:3944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5256,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:142⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5248,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:142⤵PID:4980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:142⤵PID:2308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5924,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:142⤵PID:3948
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵PID:4632
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:142⤵PID:1112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6248,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:142⤵PID:6116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6380,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:142⤵PID:1096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6456,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:142⤵PID:5184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6416,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:142⤵PID:2228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6764,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:142⤵PID:1520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6944,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:142⤵PID:4836
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7096,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:142⤵PID:4332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6776,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:142⤵PID:5856
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4468,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:142⤵PID:2872
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --field-trial-handle=4320,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:12⤵PID:3756
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --field-trial-handle=4576,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:12⤵PID:3704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --field-trial-handle=6568,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:12⤵PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --field-trial-handle=4584,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:12⤵PID:1892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --field-trial-handle=5976,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:12⤵PID:5152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6192,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:142⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4200,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:142⤵PID:4436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7084,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:142⤵PID:3732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --field-trial-handle=2948,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:12⤵PID:2384
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --field-trial-handle=4312,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:12⤵PID:4316
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3924,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7328,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:122⤵PID:1428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4408,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:142⤵PID:4932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --field-trial-handle=5416,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:12⤵PID:5732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --field-trial-handle=7588,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:12⤵PID:1704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --field-trial-handle=5720,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:12⤵PID:4116
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --field-trial-handle=5736,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:12⤵PID:2816
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7908,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:142⤵PID:3416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --field-trial-handle=7988,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:12⤵PID:1740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --field-trial-handle=8188,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:12⤵PID:4844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8396,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:142⤵PID:6104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8004,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:142⤵PID:5864
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --field-trial-handle=772,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:12⤵PID:5432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --field-trial-handle=8392,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:12⤵PID:3652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=8204,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:2752
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --field-trial-handle=8220,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:92⤵PID:5184
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --field-trial-handle=8668,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:12⤵PID:4152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --field-trial-handle=8816,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8840 /prefetch:12⤵PID:5804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --field-trial-handle=8976,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:12⤵PID:5828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --field-trial-handle=9272,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9264 /prefetch:12⤵PID:3196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9568,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:142⤵PID:1204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7308,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9104 /prefetch:142⤵
- NTFS ADS
PID:1956
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8984,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8608 /prefetch:142⤵PID:1108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9644,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9668 /prefetch:142⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8304,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:142⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8624,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8612 /prefetch:142⤵PID:5680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --field-trial-handle=9756,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:92⤵PID:2004
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --field-trial-handle=7860,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:12⤵PID:7140
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9572,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9636 /prefetch:142⤵PID:3820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8880,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:142⤵PID:6840
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8960,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:142⤵PID:936
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --field-trial-handle=6480,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9448 /prefetch:12⤵PID:428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --field-trial-handle=5600,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9044 /prefetch:12⤵PID:5552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5556,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:142⤵PID:6300
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --field-trial-handle=8560,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9708 /prefetch:12⤵PID:6512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --field-trial-handle=9792,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9780 /prefetch:12⤵PID:6576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --field-trial-handle=9976,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9984 /prefetch:12⤵PID:6588
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --field-trial-handle=9956,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10180 /prefetch:12⤵PID:5352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --field-trial-handle=10020,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10184 /prefetch:12⤵PID:4792
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --field-trial-handle=7788,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10540 /prefetch:12⤵PID:916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --field-trial-handle=10524,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10744 /prefetch:12⤵PID:912
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --field-trial-handle=10900,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10912 /prefetch:12⤵PID:1220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --field-trial-handle=11040,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11064 /prefetch:12⤵PID:436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --field-trial-handle=10724,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11220 /prefetch:12⤵PID:4664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --field-trial-handle=11328,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11372 /prefetch:12⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --field-trial-handle=11576,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9008 /prefetch:12⤵PID:3844
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --always-read-main-dll --field-trial-handle=11056,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10656 /prefetch:12⤵PID:6432
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --always-read-main-dll --field-trial-handle=10736,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11776 /prefetch:12⤵PID:6444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --field-trial-handle=10000,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11968 /prefetch:12⤵PID:6656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --field-trial-handle=12100,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12132 /prefetch:12⤵PID:6660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --field-trial-handle=11972,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12188 /prefetch:12⤵PID:6776
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --field-trial-handle=12440,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12248 /prefetch:12⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --field-trial-handle=11532,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12600 /prefetch:12⤵PID:6880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --field-trial-handle=11964,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9632 /prefetch:12⤵PID:6088
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --field-trial-handle=10656,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10792 /prefetch:12⤵PID:6196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --field-trial-handle=10848,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10068 /prefetch:12⤵PID:6180
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --field-trial-handle=8900,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9040 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10100,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8856 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:3372
-
-
C:\Users\Admin\Downloads\Wave Browser.exe"C:\Users\Admin\Downloads\Wave Browser.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6292 -
C:\Users\Admin\AppData\Local\Temp\Wave\SWUpdaterSetup.exe"C:\Users\Admin\AppData\Local\Temp\Wave\SWUpdaterSetup.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1236 -
C:\Program Files (x86)\Wavesor\Temp\GUMB538.tmp\SWUpdater.exe"C:\Program Files (x86)\Wavesor\Temp\GUMB538.tmp\SWUpdater.exe" /install "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6384 -
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4944 -
C:\Users\Admin\Wavesor Software\SWUpdater\1.3.139.0\SWUpdaterComRegisterShell64.exe"C:\Users\Admin\Wavesor Software\SWUpdater\1.3.139.0\SWUpdaterComRegisterShell64.exe" /user6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1588
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\1.3.139.0\SWUpdaterComRegisterShell64.exe"C:\Users\Admin\Wavesor Software\SWUpdater\1.3.139.0\SWUpdaterComRegisterShell64.exe" /user6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4496
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\1.3.139.0\SWUpdaterComRegisterShell64.exe"C:\Users\Admin\Wavesor Software\SWUpdater\1.3.139.0\SWUpdaterComRegisterShell64.exe" /user6⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5712
-
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTM5LjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzkuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9IntEMEFGMDQ4Mi0xMDQyLTQzM0MtQTc1NC03M0VGMzVGRDlGOTB9IiB1c2VyaWQ9Ins1YmExZDU4ZS02MDJkLTQ2MjctODQzNy1kMzNiMDgxMzJlYmV9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezNGODE1MDRCLUI2OTMtNERGOC04Q0E5LTdENUUzRUNDRjA5Qn0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntGNkY2MEFDRS03MUFELTQ2MTAtODBENC05MjUzNzI5RkI0Qjd9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMTM5LjAiIGxhbmc9ImVuIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIzMzciLz48L2FwcD48L3JlcXVlc3Q-5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1696
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /handoff "bundlename=WaveBrowser&appguid={EB149AD2-CE4E-4F51-B7FC-A149FAA4CCAF}&appname=WaveBrowser&needsadmin=False&lang=en&usagestats=1&installdataindex=1" /installsource otherinstallcmd /sessionid "{D0AF0482-1042-433C-A754-73EF35FD9F90}"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:6388
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=13368,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=13388 /prefetch:142⤵PID:3680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --field-trial-handle=9276,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10128 /prefetch:12⤵PID:728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --field-trial-handle=11028,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12292 /prefetch:12⤵PID:6236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --field-trial-handle=2672,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11252 /prefetch:12⤵PID:6400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --field-trial-handle=12544,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9900 /prefetch:12⤵PID:5696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --always-read-main-dll --field-trial-handle=12356,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11004 /prefetch:12⤵PID:6084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --field-trial-handle=11220,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11556 /prefetch:12⤵PID:8076
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=12548,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10936 /prefetch:142⤵PID:6064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=2896,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12256 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:6536
-
-
C:\Users\Admin\Downloads\StellarDataRecovery.exe"C:\Users\Admin\Downloads\StellarDataRecovery.exe"2⤵
- System Location Discovery: System Language Discovery
PID:9556 -
C:\Users\Admin\AppData\Local\Temp\is-J3A4N.tmp\StellarDataRecovery.tmp"C:\Users\Admin\AppData\Local\Temp\is-J3A4N.tmp\StellarDataRecovery.tmp" /SL5="$A02DE,125914837,952320,C:\Users\Admin\Downloads\StellarDataRecovery.exe"3⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:9596 -
C:\Program Files\Stellar Data Recovery\K-Lite_Codec_Pack_1766_Standard.exe"C:\Program Files\Stellar Data Recovery\K-Lite_Codec_Pack_1766_Standard.exe" /VERYSILENT4⤵
- System Location Discovery: System Language Discovery
PID:336 -
C:\Users\Admin\AppData\Local\Temp\is-DSHCI.tmp\K-Lite_Codec_Pack_1766_Standard.tmp"C:\Users\Admin\AppData\Local\Temp\is-DSHCI.tmp\K-Lite_Codec_Pack_1766_Standard.tmp" /SL5="$80232,18994698,422400,C:\Program Files\Stellar Data Recovery\K-Lite_Codec_Pack_1766_Standard.exe" /VERYSILENT5⤵
- Checks computer location settings
- Identifies Wine through registry keys
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:8292 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Filters\DirectVobSub\vsfilter.dll"6⤵
- System Location Discovery: System Language Discovery
PID:8996
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Filters\DirectVobSub64\vsfilter.dll"6⤵
- Modifies registry class
PID:9984
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\LAVAudio.ax"6⤵
- System Location Discovery: System Language Discovery
PID:6292
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\LAVVideo.ax"6⤵
- System Location Discovery: System Language Discovery
PID:8532
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV\LAVSplitter.ax"6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:9432
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Icaros\32-bit\IcarosThumbnailProvider.dll"6⤵
- System Location Discovery: System Language Discovery
PID:5596
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Icaros\32-bit\IcarosPropertyHandler.dll"6⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6852
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV64\LAVAudio.ax"6⤵PID:10000
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV64\LAVVideo.ax"6⤵PID:9180
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Filters\LAV64\LAVSplitter.ax"6⤵PID:10124
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\IcarosThumbnailProvider.dll"6⤵PID:10096
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\K-Lite Codec Pack\Icaros\64-bit\IcarosPropertyHandler.dll"6⤵
- Modifies registry class
PID:8528
-
-
C:\Program Files (x86)\K-Lite Codec Pack\Tools\setacl_x86.exe"C:\Program Files (x86)\K-Lite Codec Pack\Tools\setacl_x86.exe" -ot reg -on "HKLM\SOFTWARE\Microsoft\DirectShow\Preferred" -actn setowner -ownr "n:S-1-5-32-544;s:y"6⤵
- System Location Discovery: System Language Discovery
PID:9140
-
-
C:\Program Files (x86)\K-Lite Codec Pack\Tools\setacl_x86.exe"C:\Program Files (x86)\K-Lite Codec Pack\Tools\setacl_x86.exe" -ot reg -on "HKLM\SOFTWARE\Microsoft\DirectShow\Preferred" -actn ace -ace "n:S-1-5-32-544;s:y;p:full;i:so,sc;m:set;w:dacl"6⤵
- System Location Discovery: System Language Discovery
PID:8256
-
-
C:\Program Files (x86)\K-Lite Codec Pack\Tools\setacl_x64.exe"C:\Program Files (x86)\K-Lite Codec Pack\Tools\setacl_x64.exe" -ot reg -on "HKLM\SOFTWARE\Microsoft\DirectShow\Preferred" -actn setowner -ownr "n:S-1-5-32-544;s:y"6⤵PID:8928
-
-
C:\Program Files (x86)\K-Lite Codec Pack\Tools\setacl_x64.exe"C:\Program Files (x86)\K-Lite Codec Pack\Tools\setacl_x64.exe" -ot reg -on "HKLM\SOFTWARE\Microsoft\DirectShow\Preferred" -actn ace -ace "n:S-1-5-32-544;s:y;p:full;i:so,sc;m:set;w:dacl"6⤵PID:9856
-
-
-
-
C:\Program Files\Stellar Data Recovery\StellarDataRecovery.exe"C:\Program Files\Stellar Data Recovery\StellarDataRecovery.exe"4⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:9320 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\wbem\WMIC.exe diskdrive get Model,SerialNumber,Index >> C:\Users\Admin\AppData\Local\Temp\DiskDetails.txt5⤵PID:6852
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\WMIC.exe diskdrive get Model,SerialNumber,Index6⤵PID:9092
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\wbem\WMIC.exe diskdrive get MediaType,Index >> C:\Users\Admin\AppData\Local\Temp\DiskDetails.txt5⤵PID:8888
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\WMIC.exe diskdrive get MediaType,Index6⤵PID:8304
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\wbem\WMIC.exe diskdrive get Model,SerialNumber,Index >> C:\Users\Admin\AppData\Local\Temp\DiskDetails.txt5⤵PID:9140
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\WMIC.exe diskdrive get Model,SerialNumber,Index6⤵PID:8968
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\wbem\WMIC.exe diskdrive get MediaType,Index >> C:\Users\Admin\AppData\Local\Temp\DiskDetails.txt5⤵PID:8812
-
C:\Windows\system32\wbem\WMIC.exeC:\Windows\system32\wbem\WMIC.exe diskdrive get MediaType,Index6⤵PID:8796
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c smartctl64Bit.exe -a /dev/sda >> C:\Users\Admin\AppData\Local\Temp\SMART.txt5⤵PID:8772
-
C:\Program Files\Stellar Data Recovery\smartctl64Bit.exesmartctl64Bit.exe -a /dev/sda6⤵
- Writes to the Master Boot Record (MBR)
PID:9240
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.stellarinfo.com/services/data-recovery.php?utm_source=Stellar-Data-Recovery-Standard&utm_medium=EXE-Builds&utm_campaign=In-Lab-Services-co-uk-com5⤵PID:9952
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.stellarinfo.com/services/data-recovery.php?utm_source=Stellar-Data-Recovery-Standard&utm_medium=EXE-Builds&utm_campaign=In-Lab-Services-co-uk-com6⤵PID:9700
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.stellarinfo.com/installation/windows-data-recovery.php4⤵PID:8892
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://www.stellarinfo.com/installation/windows-data-recovery.php5⤵PID:9096
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11352,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:142⤵PID:9304
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --always-read-main-dll --field-trial-handle=10780,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12836 /prefetch:12⤵PID:2000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=12520,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:142⤵PID:8704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --always-read-main-dll --field-trial-handle=13012,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=13092 /prefetch:12⤵PID:8420
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11636,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=13248 /prefetch:142⤵PID:6548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --field-trial-handle=13252,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:12⤵PID:3740
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --always-read-main-dll --field-trial-handle=11692,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:7264
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --always-read-main-dll --field-trial-handle=8756,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11696 /prefetch:12⤵PID:1560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10132,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:142⤵PID:9664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9472,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10748 /prefetch:142⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --field-trial-handle=13372,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:12⤵PID:7584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12276 /prefetch:142⤵
- NTFS ADS
PID:5212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --always-read-main-dll --field-trial-handle=8692,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:12⤵PID:9488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --always-read-main-dll --field-trial-handle=5576,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:12⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --field-trial-handle=8980,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=1028 /prefetch:12⤵PID:5668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --field-trial-handle=8748,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=13136 /prefetch:12⤵PID:9924
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8024,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11464 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:5288
-
-
C:\Users\Admin\Downloads\The Happy AntiVirus Setup Wizard.exe"C:\Users\Admin\Downloads\The Happy AntiVirus Setup Wizard.exe"2⤵
- System Location Discovery: System Language Discovery
PID:7988 -
C:\Users\Admin\AppData\Local\Temp\is-U6O1L.tmp\The Happy AntiVirus Setup Wizard.tmp"C:\Users\Admin\AppData\Local\Temp\is-U6O1L.tmp\The Happy AntiVirus Setup Wizard.tmp" /SL5="$1302AE,2427357,831488,C:\Users\Admin\Downloads\The Happy AntiVirus Setup Wizard.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2956 -
C:\Program Files (x86)\Happy Antivirus\Happy Antivirus.exe"C:\Program Files (x86)\Happy Antivirus\Happy Antivirus.exe"4⤵
- System Location Discovery: System Language Discovery
PID:8292 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im explorer.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:6528
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sidebar.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:9132
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:8828
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im firefox.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:6188
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im iexplore.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:8592
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im opera.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:9484
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im safari.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:5552
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --field-trial-handle=7936,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8248 /prefetch:12⤵PID:3788
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --always-read-main-dll --field-trial-handle=13208,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12848 /prefetch:12⤵PID:8156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --always-read-main-dll --field-trial-handle=13472,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11464 /prefetch:12⤵PID:8244
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11796,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11548 /prefetch:142⤵PID:10036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11796,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11548 /prefetch:142⤵PID:6596
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=12400,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11448 /prefetch:142⤵PID:6328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --always-read-main-dll --field-trial-handle=8648,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10976 /prefetch:12⤵PID:4540
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --always-read-main-dll --field-trial-handle=12516,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12324 /prefetch:12⤵PID:4092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --always-read-main-dll --field-trial-handle=12460,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10320 /prefetch:12⤵PID:7600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10580,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8920 /prefetch:142⤵PID:8656
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=8700,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10668 /prefetch:142⤵PID:7404
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=131 --always-read-main-dll --field-trial-handle=11452,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:12⤵PID:1408
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9160,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9796 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:6492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --always-read-main-dll --field-trial-handle=13536,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=9436 /prefetch:12⤵PID:1236
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=9772,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=13504 /prefetch:142⤵PID:5688
-
-
C:\Users\Admin\Downloads\SpySheriff.exe"C:\Users\Admin\Downloads\SpySheriff.exe"2⤵
- System Location Discovery: System Language Discovery
PID:7728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --always-read-main-dll --field-trial-handle=8372,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11280 /prefetch:12⤵PID:8344
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=10904,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=10332 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
PID:7336
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=13548,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=11472 /prefetch:142⤵PID:5448
-
-
C:\Users\Admin\Downloads\AdwereCleaner.exe"C:\Users\Admin\Downloads\AdwereCleaner.exe"2⤵
- System Location Discovery: System Language Discovery
PID:5836 -
C:\Users\Admin\AppData\Local\6AdwCleaner.exe"C:\Users\Admin\AppData\Local\6AdwCleaner.exe"3⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
PID:8372
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=11764,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:142⤵PID:8896
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=12220,i,12668507189767068005,9304738543229187842,262144 --variations-seed-version --mojo-platform-channel-handle=12316 /prefetch:142⤵PID:2820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"1⤵PID:4976
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:6720 -
C:\Users\Admin\Wavesor Software\SWUpdater\Install\{D571E701-90B5-49C6-9DC0-4D513A8261D9}\WaveInstaller-v1.5.20.5.exe"C:\Users\Admin\Wavesor Software\SWUpdater\Install\{D571E701-90B5-49C6-9DC0-4D513A8261D9}\WaveInstaller-v1.5.20.5.exe" /installerdata="C:\Users\Admin\AppData\Local\Temp\guiEEB7.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7016 -
C:\Users\Admin\AppData\Local\Temp\nskF213.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\nskF213.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\Temp\nskF213.tmp\wavebrowser.packed.7z" --wid=uqlwbmtn --installerdata="C:\Users\Admin\AppData\Local\Temp\guiEEB7.tmp"3⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:200 -
C:\Users\Admin\AppData\Local\Temp\nskF213.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\nskF213.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.20.5 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff7d6808980,0x7ff7d680898c,0x7ff7d68089984⤵
- Executes dropped EXE
PID:4508
-
-
C:\Users\Admin\AppData\Local\Temp\nskF213.tmp\setup.exe"C:\Users\Admin\AppData\Local\Temp\nskF213.tmp\setup.exe" --verbose-logging --installerdata="C:\Users\Admin\AppData\Local\Temp\guiEEB7.tmp" --create-shortcuts=0 --install-level=04⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\nskF213.tmp\setup.exeC:\Users\Admin\AppData\Local\Temp\nskF213.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.20.5 --initial-client-data=0x28c,0x290,0x294,0x268,0x298,0x7ff7d6808980,0x7ff7d680898c,0x7ff7d68089985⤵
- Executes dropped EXE
PID:848
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" https://install.wavebrowser.co/thank-you?tid=uqlwbmtn&src=d-cp21976981191-lp0-obem-wav-igfJrEHkHAREKAiIcNfAJQ-ab51-w64-brwsr&cid=21976981191&iid=wav&uid=5ba1d58e-602d-4627-8437-d33b08132ebe4⤵PID:3732
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch https://install.wavebrowser.co/thank-you?tid=uqlwbmtn&src=d-cp21976981191-lp0-obem-wav-igfJrEHkHAREKAiIcNfAJQ-ab51-w64-brwsr&cid=21976981191&iid=wav&uid=5ba1d58e-602d-4627-8437-d33b08132ebe5⤵PID:1620
-
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --install-type=1 --from-installer4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6048 -
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.20.5 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb8bed6cf8,0x7ffb8bed6d04,0x7ffb8bed6d105⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604
-
-
-
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJTV1VwZGF0ZXIiIHVwZGF0ZXJ2ZXJzaW9uPSIxLjMuMTM5LjAiIHNoZWxsX3ZlcnNpb249IjEuMy4xMzkuMCIgaXNtYWNoaW5lPSIwIiBzZXNzaW9uaWQ9IntEMEFGMDQ4Mi0xMDQyLTQzM0MtQTc1NC03M0VGMzVGRDlGOTB9IiB1c2VyaWQ9Ins1YmExZDU4ZS02MDJkLTQ2MjctODQzNy1kMzNiMDgxMzJlYmV9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHJlcXVlc3RpZD0iezY2QjE5MjU3LURCNkQtNDJENS1BRDg4LTUxNkM4OURBNTY0N30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iOCIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntFQjE0OUFEMi1DRTRFLTRGNTEtQjdGQy1BMTQ5RkFBNENDQUZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjUuMjAuNSIgbGFuZz0iZW4iIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cHM6Ly9jZG4uc3d1cGRhdGVyLmNvbS9idWlsZC9XYXZlQnJvd3Nlci9zdGFibGUvd2luLzExMjA5ODc3NzQ5ODEvNjQvV2F2ZUluc3RhbGxlci12MS41LjIwLjUuZXhlIiBkb3dubG9hZGVkPSIxMDQwNzA1MDQiIHRvdGFsPSIxMDQwNzA1MDQiIGRvd25sb2FkX3RpbWVfbXM9Ijk3NjEiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSI3NDIiIGRvd25sb2FkX3RpbWVfbXM9IjExMTExIiBkb3dubG9hZGVkPSIxMDQwNzA1MDQiIHRvdGFsPSIxMDQwNzA1MDQiIGluc3RhbGxfdGltZV9tcz0iMTkwNjYiLz48L2FwcD48L3JlcXVlc3Q-2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:7948
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C8 0x00000000000004CC1⤵PID:3028
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --strtl=ti1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:5280 -
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\WaveBrowser\User Data" --annotation=channel= --annotation=plat=Win64 --annotation=prod=WaveBrowser --annotation=ver=1.5.20.5 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb8bed6cf8,0x7ffb8bed6d04,0x7ffb8bed6d102⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3588
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2024,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=2020 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5340
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=1696,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=2100 /prefetch:112⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4192
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2364,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=2524 /prefetch:132⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2892,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=2948 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5268
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2900,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3156 /prefetch:92⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4836
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --field-trial-handle=3984,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=3992 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6928
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4548,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4564 /prefetch:142⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8012
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4696,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4920 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8140
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4724,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4708 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8160
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4740,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5076 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8176
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4756,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5204 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3468
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4772,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5328 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6904
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4788,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5472 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=4804,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5600 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3488
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4820,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5700 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1560
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --instant-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4828,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5832 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7176
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6240,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=4944 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7800
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=6300,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6284 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6776
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=6316,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6864 /prefetch:12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5220
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6332,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7236 /prefetch:12⤵
- Executes dropped EXE
PID:6840
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6348,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7348 /prefetch:12⤵
- Executes dropped EXE
PID:8020
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=6364,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7464 /prefetch:12⤵
- Executes dropped EXE
PID:8004
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6380,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7580 /prefetch:12⤵
- Executes dropped EXE
PID:1696
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6396,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7708 /prefetch:12⤵
- Executes dropped EXE
PID:8092
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6756,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6252 /prefetch:142⤵
- Executes dropped EXE
PID:7660
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6760,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8108 /prefetch:142⤵
- Executes dropped EXE
PID:7436
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8020,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7920 /prefetch:142⤵
- Executes dropped EXE
PID:4028
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8152,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8208 /prefetch:142⤵
- Executes dropped EXE
PID:6220
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9636,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9656 /prefetch:142⤵
- Executes dropped EXE
PID:7196
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9644,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9812 /prefetch:142⤵
- Executes dropped EXE
PID:3476
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9632,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8044 /prefetch:142⤵
- Executes dropped EXE
PID:1668
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10072,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9624 /prefetch:142⤵
- Executes dropped EXE
PID:7164
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10188,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10180 /prefetch:142⤵
- Executes dropped EXE
PID:5940
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10028,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6932 /prefetch:142⤵
- Executes dropped EXE
PID:7120
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9676,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9924 /prefetch:142⤵
- Executes dropped EXE
PID:3820
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9776,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9708 /prefetch:142⤵
- Executes dropped EXE
PID:5836
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9740,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10488 /prefetch:142⤵
- Executes dropped EXE
PID:7824
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9724,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10632 /prefetch:142⤵
- Executes dropped EXE
PID:7436
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10220,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10340 /prefetch:142⤵
- Executes dropped EXE
PID:5196
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9952,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9752 /prefetch:142⤵
- Executes dropped EXE
PID:7664
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=6124,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10716 /prefetch:12⤵
- Executes dropped EXE
PID:7916
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=10600,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10572 /prefetch:12⤵
- Executes dropped EXE
PID:5836
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9772,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11980 /prefetch:142⤵
- Executes dropped EXE
PID:1512
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11908,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11768 /prefetch:142⤵
- Executes dropped EXE
PID:2420
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11420,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11252 /prefetch:142⤵PID:7324
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11384,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11288 /prefetch:142⤵PID:5196
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11944,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11332 /prefetch:142⤵PID:8196
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11316,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11392 /prefetch:142⤵PID:8216
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11668,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11052 /prefetch:142⤵PID:8256
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11312,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10948 /prefetch:142⤵PID:8296
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11068,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9784 /prefetch:142⤵PID:8336
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8680,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8672 /prefetch:142⤵PID:8376
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4016,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8592 /prefetch:142⤵PID:8444
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9516,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9532 /prefetch:142⤵PID:8456
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9552,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9400 /prefetch:142⤵PID:8496
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10416,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10704 /prefetch:142⤵PID:8536
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9284,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8504 /prefetch:142⤵PID:8732
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8452,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9196 /prefetch:142⤵PID:8752
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8456,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9280 /prefetch:142⤵PID:8956
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9016,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9008 /prefetch:142⤵PID:8988
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8364,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8904 /prefetch:142⤵PID:9152
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8828,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8820 /prefetch:142⤵PID:8608
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8832,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10404 /prefetch:142⤵PID:7164
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=8824,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9916 /prefetch:142⤵PID:8792
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9836,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9940 /prefetch:142⤵PID:8212
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9968,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10040 /prefetch:142⤵PID:8452
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10168,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12108 /prefetch:142⤵PID:6292
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10160,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12248 /prefetch:142⤵PID:8944
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12372,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12384 /prefetch:142⤵PID:9176
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12524,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12536 /prefetch:142⤵PID:8680
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12364,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12684 /prefetch:142⤵PID:8528
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12844,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12856 /prefetch:142⤵PID:9432
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12996,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13020 /prefetch:142⤵PID:9512
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13004,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13012 /prefetch:142⤵PID:9620
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10348,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13256 /prefetch:142⤵PID:9640
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=13484,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13524 /prefetch:92⤵PID:7196
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=12672,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13560 /prefetch:142⤵PID:9056
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13712,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13724 /prefetch:142⤵PID:8756
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13716,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13868 /prefetch:142⤵PID:8204
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13248,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14020 /prefetch:142⤵PID:8880
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=14012,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14168 /prefetch:142⤵PID:9144
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=14008,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14328 /prefetch:142⤵PID:6112
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=14176,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14348 /prefetch:142⤵PID:8432
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=14612,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14188 /prefetch:142⤵PID:8508
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --field-trial-handle=14636,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14768 /prefetch:92⤵PID:10028
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --field-trial-handle=14920,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14900 /prefetch:92⤵PID:9968
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --field-trial-handle=15232,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15216 /prefetch:92⤵PID:8852
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --field-trial-handle=15436,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15580 /prefetch:92⤵PID:6672
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --field-trial-handle=15548,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15892 /prefetch:92⤵PID:9548
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --field-trial-handle=15612,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15996 /prefetch:92⤵PID:9692
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=15564,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=11744 /prefetch:142⤵PID:9648
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --field-trial-handle=15508,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8728 /prefetch:92⤵PID:9700
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --field-trial-handle=11680,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15088 /prefetch:92⤵PID:9804
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --field-trial-handle=15708,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15644 /prefetch:92⤵PID:9904
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --field-trial-handle=15844,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16388 /prefetch:92⤵PID:10076
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --start-stack-profiler --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --field-trial-handle=16136,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16284 /prefetch:12⤵PID:8516
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --field-trial-handle=16740,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15620 /prefetch:92⤵PID:4904
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --field-trial-handle=11776,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12516 /prefetch:12⤵PID:9336
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11956,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=12492 /prefetch:142⤵PID:3980
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13884,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=13512 /prefetch:142⤵PID:4576
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11864,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=9928 /prefetch:142⤵PID:8112
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9876,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=7192 /prefetch:142⤵PID:6244
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=11320,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=244 /prefetch:142⤵PID:8776
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=13456,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8432 /prefetch:142⤵PID:8248
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=9148,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=14944 /prefetch:142⤵PID:9536
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=1088,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10268 /prefetch:142⤵PID:2012
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=16320,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16328 /prefetch:142⤵PID:3536
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --field-trial-handle=16316,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15812 /prefetch:92⤵PID:3900
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --field-trial-handle=4964,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=8008 /prefetch:92⤵PID:8296
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4880,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5996 /prefetch:142⤵PID:4700
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=15516,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16824 /prefetch:142⤵PID:8576
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=10548,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16664 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
PID:5624
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=2288,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6340 /prefetch:142⤵PID:8680
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --field-trial-handle=16328,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10360 /prefetch:92⤵PID:4692
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10624,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10616 /prefetch:142⤵PID:2540
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10988,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10556 /prefetch:142⤵PID:2624
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=4832,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=6576 /prefetch:142⤵PID:7436
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=15444,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10560 /prefetch:142⤵PID:9100
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=133 --field-trial-handle=14928,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10268 /prefetch:92⤵PID:7296
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=6032,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=520 /prefetch:142⤵PID:4744
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=10360,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=1804 /prefetch:142⤵PID:9296
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --field-trial-handle=5168,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=15840 /prefetch:92⤵PID:8152
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --field-trial-handle=5280,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16752 /prefetch:92⤵PID:7500
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5116,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5176 /prefetch:142⤵PID:4956
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --field-trial-handle=5188,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5988 /prefetch:92⤵PID:3776
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5248,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=520 /prefetch:142⤵PID:576
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --field-trial-handle=10484,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=16452 /prefetch:92⤵PID:9940
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5572,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=5240 /prefetch:142⤵PID:4764
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=renderer --string-annotations=is-enterprise-managed=no --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --field-trial-handle=5136,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10608 /prefetch:92⤵PID:5372
-
-
C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe"C:\Users\Admin\Wavesor Software\WaveBrowser\wavebrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=5112,i,5757727322367912580,13843989999052048724,262144 --variations-seed-version=15 --mojo-platform-channel-handle=10364 /prefetch:142⤵PID:4488
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2284
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:8504
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:7148
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6376
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:8368
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:9592
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /c1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:3800 -
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /cr2⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:8024
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource core2⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:6248
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /ua /installsource scheduler1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:7724 -
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" /registermsihelper2⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
PID:6180
-
-
C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe"C:\Users\Admin\Wavesor Software\SWUpdater\SWUpdater.exe" -Embedding1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6368
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\22b0882d3d5646648055ed0f3fb24231 /t 9140 /p 83721⤵PID:9116
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
4Pre-OS Boot
1Bootkit
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
9System Information Discovery
8System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD5cb02c0438f3f4ddabce36f8a26b0b961
SHA148c4fcb17e93b74030415996c0ec5c57b830ea53
SHA25664677f7767d6e791341b2eac7b43df90d39d9bdf26d21358578d2d38037e2c32
SHA512373f91981832cd9a1ff0b8744b43c7574b72971b5b6b19ea1f4665b6c878f7a1c7834ac08b92e0eca299eb4b590bf10f48a0485350a77a5f85fc3d2dd6913db3
-
Filesize
19.0MB
MD5d3a01c9931cf9d7f83ebb0a261597c96
SHA1268154fbfde50c6a40a9a7025aaba587080ce8ca
SHA2564973ec3c4aaeffa86bc842e9c93a82866a320070c3a7c746cc3fcab1f3fae6b1
SHA51236e9c09d9205a8338793719cf493ac6826695c2d3b33dcb55958fa2e9ca4c2097e10e44e15dd7492bbdc46f80f1125a1821fd8485cb4e8fea5b0cc5c14d228e8
-
Filesize
23B
MD54aef4415f2e976b2cc6f24b877804a57
SHA12aa2d42c51f9cf024e3777f0dde4270388fd22ae
SHA256307cef95dd5b36ff215055d427e1885b7fc3650c9224cf76d63056545996ff60
SHA512c75f089a95107997b0a786e7c1191e48ec7a69aefff97daf37783791d943c612b7c1b43bcc2cacdfd15e79382e0f314c88817c7dd320f8028af3420452ce3a1c
-
Filesize
332KB
MD56fa418fe9aa27b7de9e3d361e4eb187a
SHA1acae621a149c3ee37a8ed0df7fac995f6c38d467
SHA2565644d08d196d002dddc5db56edd8ce6768c3ad1b76a899f042e9d75c7df971b5
SHA51230c30904367f0543ba6d9d1de8ea837a029840fbbd90208241c1a842f09ad8297e418218c141a29bcae38623a38b99306ebff51e36c028feebe38c731d9eb16a
-
Filesize
80KB
MD531a5e844ac650718f04e33f75dbc7d01
SHA10a5350c32d3ff518e29984dfa6d92526a02092ce
SHA25674fe7481c3c592702dd3fc9fb29c6c23cbeec12662bc38cb0b0a47c6131f3d35
SHA512c8ddf4322714b973c7804d3d93b4863537d9523be830c1e099f30a2da892b823afee7528fe75420c377bf4f81f0b6f72943050236f81a4a9aaebaeaa5c954809
-
Filesize
89KB
MD552f7070bd68452810e0b2205a44f06f9
SHA172c8ae357662707f98dfbc489b40be6347292e98
SHA256f08328ac774b9a062d881db9979c99b5bfea2879411f82ed0cab571131516841
SHA512b8c69c0629812f6278e9ae05c152b429d4b5d0b7ff6907d28e3a6c1f28a83ceef63f6fa5ef9e8cb472e3fcffaa5c46e9c5eb4b0e338dba02ef8230edb5a13942
-
Filesize
114KB
MD524f25891971cf25aa8230ba3f98c4c85
SHA1622f6c1e848781d86e13ffdc785b6eace8c4f2f6
SHA2561e524b7aba1cbcd4df6519347701bcf771cf0ca7cbb1e053f0b3d65384281872
SHA5120910439cd749db29f6dd5237395e579648924cb04d306f1132d3aa5ffe462179037f69c3c43d35c1844b04277e9f9bc97ffdef370aa3e8ae25aa16de8fa4fe7d
-
Filesize
25.8MB
MD5324739f41d529f56abd7ab974d40a873
SHA1ca5eb88698ff4ead16e57ab8ff3015e823b3e49d
SHA256bb694c1621f32a55144e3d6ccd56d35da66319036fd554cb166ce191ab90339a
SHA5121dbda32570dd180db6947528edd7d5db94f92d1235004ed965a58c7686233728b44512af2df8565397be7c8cf1be5984b2ad5ed238fe9dd4db22ee3aec563439
-
Filesize
68KB
MD5712c274cdc4e39651e8b518f66dc7dec
SHA17ff61f4b8da29b686e3d3b3274da0a03b8cc95c8
SHA256c847943855a39bb6539c34e4a23ec6a4888c79f687d08020df5b73eec877993a
SHA512dcde669cc4681dfdcd48cf1610e842a0abb879fc40d039478a151985f7413b419ee0c6aa3e31e632971b999f552a2fcf887c6eb34ea34a641d0ab6398f2b5f63
-
Filesize
86KB
MD5faf368467184463e35ac2f0fb3ca178c
SHA1081a7d99a21a046e4d2fef587d784de83275aca4
SHA256cb71ea71eda4d5c5439e1ca68de613359d49cd7a22d3fce7e4e734c7f54579cf
SHA512870adc933cf5b14757dc97f110aaa9bce943e7cd1f22954078888d455212970093bc8c10d74cc430cf6c0d76965c35df6bac112e3d7c139ffe8e1ce8b5ff3b13
-
Filesize
114KB
MD53dcdef7515e8015e74fcd5bfa2f8f12d
SHA1de4c74a660fd05f7aaae346f6f783d1385c4e71c
SHA256004c23b01b3848da1a5819336e99efb0341d4bd3316430ce26670a2429de63e4
SHA512b65f684e3f24a3062d418284cb20583aa6bc590d0da1d50a21638495c6316057ca881a598c3e36c4ff51305a85e5ee3754cb9c7c77324d349cd2a9f52b890172
-
Filesize
145KB
MD50080ed0dfee29919770e1fb23b93f4cb
SHA17539d840c14763e2a3f8ecd5cca42322579a2c0d
SHA256cbc378b3ebdd7af48d038ed4625383e767810915e7fdaedb24ad4a099e30ccdc
SHA512a236636554f7f6576d910cac79acadc43e44553ebdb07a6698749925de1840e56515e207bc96308098b013e4850461817286055db55336c8acd42c53837504e7
-
Filesize
236KB
MD56664283394195e01120180066c883ec0
SHA1158ef42e5f0eae918c7359aa39c999dcc5f181b2
SHA256f0f5fad3603b3a7a3ec309663cf972638df7b15cee95524d34006f36502358c1
SHA51210d0e1eb2962c8ad26c443ae832d5f480552d9c672ebedfaa5f6bcedb41de9f14e18bafba4ebf0bb41f2fb1e97963a113573888e4d5df8553960a30cddcbd195
-
Filesize
85KB
MD57dfc8db3956adc1aec4e3ec20bdafd7f
SHA17c98859efba3facf2445707d28bac48ae9dbc33d
SHA25698fbcd450fad2465f1b95725768eb770c7d6402182306a34714f0355d6349a25
SHA512ef5b78cd6ed22d9364d68b633be4b6d9d8b2f6bbb9d6feb4b4f04afb664223787065b8ceccda5e8fac17a5fb4559249f6c49e54cf5202aa3badc9cadaecfd8e3
-
Filesize
140KB
MD569d17b576402765c6c42f460b4ef5db7
SHA1b9bbf318e7bad82720f5e3a43ba7095a2b268f5d
SHA25661555e1e6b07cfc1fd2f64a3f94bb7cf8bec11351cdb22c46943757ebe00195c
SHA512d859e99f948441ef65912ec59a2f22cd345102709aa852f9b0f029cac23b751bfbd16bb8a57da7e17b0d4fe64620e8c779ba562e224d365f7d5041913cc310f3
-
Filesize
145KB
MD57ed22b2bc147bf9954dc751c0143c944
SHA13fdd62459440b829e1b2fbf10710355c3ee1ae26
SHA256cb890969f44dace6c563ad8c27de47203ee64400917efd6fc53c64efdf8a7581
SHA512cbbba95c46841cccaf3ee050af0c0a0e2d748c09ba88ec14440b2944625c6bd315c9ea0fea90095df3a1b3d99bed9c6277c5b39424de41602ef02c9494ee3bac
-
Filesize
3.3MB
MD5037e1c51372c49c66b62345a2ea6d4dc
SHA16a2bbdac34610b6c2f29e6eb69ff3b19bd96e5ec
SHA25624b2b8760895aace2f47492db0d52e270c1df651d457a5d951fe905fa7e00f94
SHA5128dc8301db2767f4cdb8b75d3ba9ac3be7d823aa6beaf3af50071b8b17953ba98c3aaf06c729bdbe2755025d6519ae3769afb18ca26e9256cfb81e8146f3dc107
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5457A8CE4B2A7499F8299A013B6E1C7C_D734EC3DD00546F46D368325396086B0
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
Filesize
168KB
MD587e4959fefec297ebbf42de79b5c88f6
SHA1eba50d6b266b527025cd624003799bdda9a6bc86
SHA2564f0033e811fe2497b38f0d45df958829d01933ebe7d331079eefc8e38fbeaa61
SHA512232fedec0180e85560a226870a244a22f54ca130ed6d6dc95dc02a1ff85f17da396925c9ff27d522067a30ee3e74a38adff375d8752161ee629df14f39cf6ba9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json
Filesize3KB
MD56bbb18bb210b0af189f5d76a65f7ad80
SHA187b804075e78af64293611a637504273fadfe718
SHA25601594d510a1bbc016897ec89402553eca423dfdc8b82bafbc5653bf0c976f57c
SHA5124788edcfa3911c3bb2be8fc447166c330e8ac389f74e8c44e13238ead2fa45c8538aee325bd0d1cc40d91ad47dea1aa94a92148a62983144fdecff2130ee120d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\autofill_bypass_cache_forms.json
Filesize175B
MD58060c129d08468ed3f3f3d09f13540ce
SHA1f979419a76d5abfc89007d91f35412420aeae611
SHA256b32bfdb89e35959aaf3e61ae58d0be1da94a12b6667e281c9567295efdd92f92
SHA51299d0d9c816a680d7c0a28845aab7e8f33084688b1f3be4845f9cca596384b7a0811b9586c86ba9152de54cafcdea5871a6febbee1d5b3df6c778cdcb66f42cfa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.14\edge_autofill_global_block_list.json
Filesize4KB
MD5afb6f8315b244d03b262d28e1c5f6fae
SHA1a92aaff896f4c07bdea5c5d0ab6fdb035e9ec71e
SHA256a3bcb682dd63c048cd9ca88c49100333651b4f50de43b60ec681de5f8208d742
SHA512d80e232da16f94a93cfe95339f0db4ff4f385e0aa2ba9cbd454e43666a915f8e730b615085b45cc7c029aa45803e5aca61b86e63dac0cf5f1128beed431f9df0
-
Filesize
509KB
MD5630f694f05bdfb788a9731d59b7a5bfe
SHA1689c0e95aaefcbaca002f4e60c51c3610d100b67
SHA256ad6fdee06aa37e3af6034af935f74b58c1933752478026ceeccf47dc506c8779
SHA5126ee64baab1af4551851dcef549b49ec1442aa0b67d2149ac9338dc1fe0082ee24f4611fcc76d6b8abeb828ad957a9fa847cbc9c98cdf42dd410d046686b3769b
-
Filesize
21KB
MD5846feb52bd6829102a780ec0da74ab04
SHA1dd98409b49f0cd1f9d0028962d7276860579fb54
SHA256124b7eeba31f0e3d9b842a62f3441204beb13fade81da38b854aecba0e03a5b4
SHA512c8759e675506ccc6aa9807798252c7e7c48a0ab31674609738617dc105cee38bce69d4d41d6b95e16731466880b386d35483cbeea6275773f7041ba6e305fae9
-
Filesize
280B
MD502cf1313b32a8ab2f031cee39bee8fc3
SHA1861cc0ab9ff881460dd6433e37075b822aac9355
SHA2567e7fd13903a8d57f314d9e7dab6fa28975050b63f045eb315e96cccaa17d1e61
SHA512f5464c94391bfb590f6755c2ae6896dd459a2a93d778601caebf272438c2ff127ec5de81dcf8efeec65a56609558477afc7be1c4993977a18fde7b915f7a8700
-
Filesize
280B
MD58165d331a65e980c7f75dba657342854
SHA144967c0388744de38b07e07e3a9cb174854eb7bf
SHA25608d7b1fa1c3cdacb73cb9b34bb51a0516bfeac2f10ec54f2f27469d1c97820a9
SHA512ee23180ed03c5042d6e6343ac2181a6d9ffbbb775e1031222e46b4a61eca4f1caf2dab50269271a07b284e270195595c91ce8c43d4cef77c8873845216546e54
-
Filesize
280B
MD54c8ab5fd1316b076a628dafc8d131952
SHA10f8033913aa59238c08954c560b12517f128ed2e
SHA2564d7aae03ad71b0c90bcbbb60123e5be4dbd96d50ab717643c5b3a4cf1fd28418
SHA512b3f094f8b2b3bb955b19e38862ed98c2b4b6fc1c7ed54e15cac01b207ca0e6620b1972a49cc8d41c5fce99553f0bd2075d6bf6ff850906e3f76f1d8c146af0a0
-
Filesize
352B
MD52a04fa9679f17cd4ec013cd5ffe0eea9
SHA154e2e1b14cde81b2d2a18798e2475f0defc14101
SHA25650d7cbeef387ffabd21fc4c43340c36dc17b2360e0f460af0ac18662616f4b53
SHA512858b2e8aaee6e408bf78718bc89e8e1129a14cf5fe7dc118969db9afd898b9c2f99abb7eee7af94d7824fdcb9e9cd20f69db509eaec62c91b8c3efa4d4b52e01
-
Filesize
334B
MD59542f2208a16517db7c1bc943bc88089
SHA1b5e53bf91e4e7984f3d50362b4c9b399d1339135
SHA25668086b22d7227b46781016340d84fa5a2f311a125b0cd0592b24f4360c61eca2
SHA512bce0c0a88c806c97f33ca7ed9ea547bcf41954a994165bf209328e11436e1a328f21f7a951c007d4dd989fbbf9d9a469ad15950e8164e5fdd8cbdfee1829a5ad
-
Filesize
158B
MD5424f488d7b32cde9d61a5982156fc012
SHA18fe44230f7f4b3130ed3f1a3ad1a70fa026fd48e
SHA25669fabd86ade69e7cdd593f220be64d7e8b77817d97a80ff682cda3c25403af17
SHA5124f00234a7c93585f025a95d038023eee958e9cc53080c9b946410dfd16663c98a68462a86d911322efa84f2084a5f2ac2d03a2b5a442d7b5535d8451dc374ba9
-
Filesize
48KB
MD5df1d27ed34798e62c1b48fb4d5aa4904
SHA12e1052b9d649a404cbf8152c47b85c6bc5edc0c9
SHA256c344508bd16c376f827cf568ef936ad2517174d72bf7154f8b781a621250cc86
SHA512411311be9bfdf7a890adc15fe89e6f363bc083a186bb9bcb02be13afb60df7ebb545d484c597b5eecdbfb2f86cd246c21678209aa61be3631f983c60e5d5ca94
-
Filesize
62KB
MD5c813a1b87f1651d642cdcad5fca7a7d8
SHA10e6628997674a7dfbeb321b59a6e829d0c2f4478
SHA256df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3
SHA512af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b
-
Filesize
67KB
MD5cc63ec5f8962041727f3a20d6a278329
SHA16cbeee84f8f648f6c2484e8934b189ba76eaeb81
SHA25689a4d1b2e007ac49fc9677d797266268cd031f99aa0766ca2450bff84ac227d1
SHA512107cf3499a6cf9cdcbfa3ef4c6b4f2cda2472be116f8efa51ff403c624e8001d254be52de7834b2a6ab9f4bcc1a3b19adc0bba8c496e505abbca371ef6c8f877
-
Filesize
19KB
MD52e86a72f4e82614cd4842950d2e0a716
SHA1d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA256c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
SHA5127a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
-
Filesize
65KB
MD556d57bc655526551f217536f19195495
SHA128b430886d1220855a805d78dc5d6414aeee6995
SHA256f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
SHA5127814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
-
Filesize
26KB
MD5759be94e3186a7beb35e0037aa291760
SHA15cec0ad52551ed9bc6abf805f7456965a47b71ea
SHA2569550a8b1721e4f64f9b45d81d95f24fdf7c81a8b0fb8db28ffcf076467d1000f
SHA512bd919c4cc5f8b5ffc4e6c16b576b68f1e296f42e83fe4c865d35968ed115924f20e841b36a09e24ffde248af614b583f8eb66512ccd2718777e4dd512c42e311
-
Filesize
38KB
MD5b8103746b4757c6332fe545f11de8f70
SHA1588965d6333eb015af39c7f44ce71dfac67fb0f7
SHA2564177d563a186175d3a67091c399db6c57fc271e202406e244d4bc8ad95b1aebd
SHA512c83bd52d674d90752dfffeb76971a4f9684054d6f02cfdbe8f336758ac46d8b430f306cc64be00112b8c38d191afd1b8395d58600b12cefcb6a052ab70214ebf
-
Filesize
37KB
MD5bfda78672fa2098a6c4266a33e799f69
SHA17a51f4a9980e6f9d5a484d12fa3e35baddc753e9
SHA256bdfc29cd8b54192ada7194936da17428629bb5925e31a2846682571bebe402b6
SHA5127d01483a7da3941afcd7b1566c868018ac80927209269e98a6dab0078c1a14c0a380402efdd5b257e0a37ca6b45f68817dc774cbb32b5e7ba5f3cdefc2bc72d3
-
Filesize
21KB
MD5ec0963f084571ccba8609e51d71bf6ec
SHA1b4a93e1b2e235488747b17c212ae14e5551c2db9
SHA25639041d7cca3821b6b33037d88740780d6c1b380cf4973f7a869b101d35b015c3
SHA51288689aab98763297eb045308d3a1c415bcb0dcb58dc5d3f4338e5c92018666a0b0c5bc2cc444ffe333c4b6ea54f0286a4c6310a9e18d418fba83ff2698be5525
-
Filesize
21KB
MD554067bd6fb245223aaaa48e1fc8edcb0
SHA1e563bc020c09e8e79e3694997cf55718193ed827
SHA256fc01ce37eb543e614fb624cccc0a9be36718a4801b3db80fb195c075c24cdc49
SHA512d85ccb286e4f2fed8a3c82c3e5f4297013525c775a4464f3abaa007b3731c023dca46a96b4d9b05e1c23660038975384f7fa5156a32facf2d237841b37af05b7
-
Filesize
27KB
MD5fa2d7364a6cdbe8144bfc6add239bfe7
SHA12b37b884e7235429a2b4d675cf1d4975f9081d4c
SHA2563624f864be1b01a4fbcaa4623e5408ae4adf66702cf2339ebf5eb5b4cf993ac5
SHA5125a30f88a98af6ab94a0847989d9bb98d7e459232ec7a0ebfd0aa7f4405d0394fdbc439f33fbe2f72319f7cd8789e80443a122fde0b4f743833ebdc28bda37f92
-
Filesize
18KB
MD589ee4d8818e8a732f16be7086b4bf894
SHA12cc00669ddc0f4e33c95a926089cea5c1f7b9371
SHA256f6a0dfa58a63ca96a9c7e2e1244fcff6aea5d14348596d6b42cd750030481b82
SHA51289cc7dfae78985f32e9c82521b46e6a66c22258ebe70063d05f5eb25f941b2fd52df6e1938b20fe6c2e166faa2306526fdf74b398b35483f87b556a052b34c5e
-
Filesize
16KB
MD5db2656b672846f689c00438d029d58b6
SHA143b8d5085f31085a3a1e0c9d703861831dd507ce
SHA256aa3f28db9caadce78e49e2aeb52fda016b254ed89b924cdb2d87c6d86c1be763
SHA5124c57c347b10ea6b2ca1beb908afc122f304e50bd44a404f13c3082ba855796baef1a5eb69276d8744c1728578fa8b651815d7981fcec14a3c41c3ca58d2b24ab
-
Filesize
59KB
MD5057d50611dc6da29ea09acf98b39fd50
SHA18a4e4078a370de6863dd5d306bee57b3991987d6
SHA25667ccab355ce3aa4cbd201df34c15356b4d8f003b60d1f5fec6562dcb61da5c4d
SHA512a2c9b21122040d7de0bd2716f739faf24f81214bbb5bd01a1a2bc150039936d1193382cef256176f62eb9345b61df712491d75b1fd01f4c54ad60b1f39f645f5
-
Filesize
16KB
MD5dde035d148d344c412bd7ba8016cf9c6
SHA1fb923138d1cde1f7876d03ca9d30d1accbcf6f34
SHA256bcff459088f46809fba3c1d46ee97b79675c44f589293d1d661192cf41c05da9
SHA51287843b8eb37be13e746eb05583441cb4a6e16c3d199788c457672e29fdadc501fc25245095b73cf7712e611f5ff40b37e27fca5ec3fa9eb26d94c546af8b2bc0
-
Filesize
55KB
MD592e42e747b8ca4fc0482f2d337598e72
SHA1671d883f0ea3ead2f8951dc915dacea6ec7b7feb
SHA25618f8f1914e86317d047fd704432fa4d293c2e93aec821d54efdd9a0d8b639733
SHA512d544fbc039213b3aa6ed40072ce7ccd6e84701dca7a5d0b74dc5a6bfb847063996dfea1915a089f2188f3f68b35b75d83d77856fa3a3b56b7fc661fc49126627
-
Filesize
45KB
MD55569de99ab1fabb4a341f6491b8ae9cf
SHA101bd34e042fe11149a50d8a5772c7f55bb20d59c
SHA256cdfa951fea7ca30043fb919904f7ba8af0757d017b03ae48ccddae4d1d9e6417
SHA512d16c027aee5e5e0a2009c8e1227bf2a708083217e575cb5ad9b53bb3e1414d95f6ee266294d6bce9ff7b97b84469bfc9b10d7309399fe17d74d56094045efc21
-
Filesize
25KB
MD57e9f32172582f9a9f63aefdf213b2ca8
SHA1c6046d34dd37164db45fba949101f1b823b92c78
SHA25660a2a9f78913e6cf901b86cd1ea3da7efcff2b172ba65787b1d8352aebade766
SHA5122247abc46b2f5af16e49e5cdae38ddbf45c3653b362a856ef85110102b284b7887b0435ca935e03a4ad9c786b67dd2ab232784bdc3ec3a301ecf22e5be886e4c
-
Filesize
110KB
MD5df4ef1fa06bc34706b3b8245d4831d54
SHA1ba8f9d4b813ee160a56e162c36d29c1bc2a3bef1
SHA2564a34fd6dd56215d4c81be8f211ba69410018d336605334cb190886e4b6adebcc
SHA512b6b436366a3305228cd3ef912731ee4a6481db7cd43595f5217c2ab91b1a7c19168bf45e8ce8f4943ab3b393240b9c507073d4b7492016689ef0c1735700ea9a
-
Filesize
88KB
MD52dfda5e914fd68531522fb7f4a9332a6
SHA148a850d0e9a3822a980155595e5aa548246d0776
SHA2566abad504ab74e0a9a7a6f5b17cadc7dea2188570466793833310807fd052b09c
SHA512d41b94218215cec61120cc474d3bc99f9473ab716aadf9cdcbcabf16e742a3e2683dc64023ba4fd8d0ff06a221147b6014f35e0be421231dffb1cc64ac1755e2
-
Filesize
16KB
MD5dc491f2e34e1eb5974c0781d49b8cbaf
SHA1b73ca9b5f9c627d49da4ecbc3455192e4b305a3f
SHA256f956049f0d96d455a71003eba400cb94f7067bc52620cd05b81006ecfdd438d8
SHA5125c9bd0d5c93a05ca76eb727328a0fde40f2be7fe53b6b6c9eb260e8f20f92cfc831fd4b46f954d85baf151ae8aba1cdd6f76b0faf96217922cad844c905f3645
-
Filesize
16KB
MD5b65b06c397db836876d34dcdfcf40f28
SHA19bbfb4938e4ec5006dad600a02870dc1863b842f
SHA2569ff83aacf31b10f685dc666cc48a92e1772db19542d1b570e760fcc18d492896
SHA5125ac1cafeb60a6eb07734266a31492e890b6fb9a2d789d87e8dc48f8004ce8b334ed1e5da0763891fa338d80c114bebf7a00c952541e33cd9965b189d1a067936
-
Filesize
65KB
MD595e91183617a8584c5fd984976327e54
SHA151913845cec14ab5d49f4ffae0e9ff0ce7645ef7
SHA2561cb860b78a0afe442d03bc9553fd4b6dadebd8aa891071f7ab0a4719bd0bdaac
SHA51288fb1cbf50729982186284cb09c388110b75fbb782e53a16d58d51b60eada258ab3ccbf4f307871117e8f620836d474a68e419deee77162a923d952900cb72ad
-
Filesize
93KB
MD52710f275ad8355bee4a2d8b5d28f91b0
SHA16bc0cff406b5be3f9f8ac524cd9d92f8edacf9c8
SHA256e5e43a0a378294096aa15d2b11ba13076809bc683e93f78f79d3b29b2911477e
SHA5127138cf3e92bbed02c62e2ada64e071cde31be1a8d92a88fe3af6c736a62833909560a3c7e511a5f8d18f621dad4fe20c2eeceb9c2c565c158559a5a63f82ef9a
-
Filesize
29KB
MD5d3e4359600d908c202a5e47c59ea7be8
SHA1742491b67e86a35a755ce68af9caa31541500e60
SHA25666e736d0733f6ce88702fd4f7446e7590bf6f35da3eedd73173e00feb7542994
SHA512e516c7343f254f14840fc80a01af7f94a6692dbd0e0847df17c288eb7201734d4a4522d19f0137f24e8a1ae08a72afdf6aa8aabfea1a08f8614bb6cb00423560
-
Filesize
36KB
MD550b140b1e97d859d6d0603414f4298ee
SHA1500e4872ee1ba9cf89f1ba626d64987b0f9ab5c9
SHA256fdc9964050bfa24c27a3c76c6791b3674292a5f352cbc83d7a4dc49595bc3fb1
SHA51255ef84e956a7943e3fc61a8a349e64e9f35b7dfc63402ab52b995f43a7cd4b1d2acd300126dcdd610d0b106af426848f998ccf154f712034422d242d6ad9130d
-
Filesize
47KB
MD5015c126a3520c9a8f6a27979d0266e96
SHA12acf956561d44434a6d84204670cf849d3215d5f
SHA2563c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
SHA51202a20f2788bb1c3b2c7d3142c664cdec306b6ba5366e57e33c008edb3eb78638b98dc03cdf932a9dc440ded7827956f99117e7a3a4d55acadd29b006032d9c5c
-
Filesize
132KB
MD596087cdc394d5515605ef41c3ae8e211
SHA1351b1e64172fb1fe72fd3e101625ee1f1975a16f
SHA2560e9faec18d0a2d799b87303b997fab19e660d24f8c790fefe3c1384046b0b78b
SHA512c13b3804ead5c16f5b9287db14439509d0c164c986fd98ac60ea20e9e210298e1d6e96602d1dfd8d71021eb8b0be81f8adc1f52cef59be4b7a29437dec4afa9b
-
Filesize
147KB
MD5bfff21e56f9d0a68796183dfb051dcc9
SHA1b0234571befded5e60270e7ba40b994eaf052069
SHA2565674d4ebcf27233dba7dd8d049554966f418e596581a4828ac8abaed2e3e868e
SHA51295eb5f9ff470f8801a74a5c67f76cc97b16466a6686f9e33ba3d9e29ec9630cdc608ddda07972a47738577f12c6829533a88604197e2605237caf6c4f14d64d6
-
Filesize
20KB
MD587e8230a9ca3f0c5ccfa56f70276e2f2
SHA1eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7
SHA256e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9
SHA51237690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8
-
Filesize
63KB
MD523749f9493b322f248fbea6f0cb22a31
SHA1f3b23769dcf27f4280cfced2df12dc1b2fc393e9
SHA256c9b8a229b4d708983c6d4cf21466c256d3cb8c639521ebf636f9d95f6fd2d61a
SHA5122e6d86e3ac7070bf6be156d2efff70bda7147ec9f773506fbc126661458231318517e0528b03f0486f1d8052cead03bd78e5c1d3bf6e75f723abbe0603de8714
-
Filesize
108KB
MD582717527dcf3046d93fda2a6202144fa
SHA107fe2f57ad4a3cb3bf0fb7d3139ad0f4018b8b44
SHA25647c679aaf20c910605642a0a583a75befcc9a399cb0805e217ed189bec384c74
SHA512442e0968557d88d26576202f7894400c407b7ef7edfff6d468d2a664cf1443076d5c07267c56b6614832de60c18ebc7d82af6fc884af46083721ce644c80a5c6
-
Filesize
108KB
MD58be851b5ebaf94055bc5a2fc97afad27
SHA1415210d177f1e204d69f2f09c4d3351cb636445d
SHA25688c21534d72a08c24e8b7fda8ea8b3265490ffbb5b0721af45201f56dae62b6b
SHA512b8359ec3b9bc3953ff5e760ab9d6e37d488f72e15589d528274f05deaa0416a1a82b7cab25e23499edcd337092fad6ec2d6a58b6d245b32c8ce090980f7e148c
-
Filesize
29KB
MD54f67bddea4a4b56fa44f7cfe3d8e17f6
SHA1438d0068eea5ebebe51681e9a99f4ea32cfe15e3
SHA256b12c446b6906a8955e13fba049813b7367342208f2f605e636bae8cbb7c2a847
SHA512341ad30b36804ec19a0299e99e95ca576474ea85eb853f986f0e8199481e5e5f6826d71ed660f408b0dd7bce3e2d28e873e64799a24c5803247b7ab356a276be
-
Filesize
19KB
MD51b6683a023c24890dcd295929a9c7272
SHA1e60d615fc51b978e87aaf1202e5455b20c47050b
SHA2564e34e459d55e077a9057a319d235ae276d9929f699387e826f66eedc86e04595
SHA5124cf31ae2239caa5e7f6519e12377a44741c9aae54153d1e94acc6e2b200b1c0a999126feab9766bd0add7232797c7da2245cf8782938f43f8def64cce7ab9f45
-
Filesize
18KB
MD56c7282bbffcdf94e6bdca2515cb078e4
SHA176370163d2eb21c8b5c5d55af3d0a38e39e17773
SHA256975998b8e49f469ae6a0b4d3233cd1f635d4022f75ea5d8f806a6dc971b50d68
SHA512cf17825b804eb3659a888a2d5079795ad1ea7661e7477e18ff8f4e327ba49a6288cb0dbf46173e8ebbbeeb1d3f031aa9d176420e64840efb138b423ca1cac544
-
Filesize
67KB
MD560a30ef624fad5be472ee5d1acd1b2ab
SHA15dbb87bbc2e8a6143308e7928536ae778610794a
SHA256d0ec8a13c2eb6a38d628cd7adaed308116164ceee003f816889b4db1735bfccf
SHA512315e3ea4d4c6ccf6c14fc509933b01cb77c964b608cb95ce2ee8c331011adaf618e41cf4b8c499c4f6c9e137b88a34caaa7aaa44a69fdabed84df550e178d60a
-
Filesize
190KB
MD5248aadd395ffa7ffb1670392a9398454
SHA1c53c140bbdeb556fca33bc7f9b2e44e9061ea3e5
SHA25651290129cccca38c6e3b4444d0dfb8d848c8f3fc2e5291fc0d219fd642530adc
SHA512582b917864903252731c3d0dff536d7b1e44541ee866dc20e0341cbee5450f2f0ff4d82e1eee75f770e4dad9d8b9270ab5664ffedfe21d1ad2bd7fe6bc42cf0e
-
Filesize
54KB
MD5ab4aabe1131cc060ac3b69043eac8d55
SHA1e17c015295dc17b42cb0561b8fd78c173d6e5e4b
SHA256efee663898c53885c0ee83e65c3964ede99ce9d9e2d48a0e6dfa149b1490fe12
SHA51226099731f40397c2f61735a4b3f2e98e11a100dcc90252fec2b10d71aa5850aa6e1ae8b7c3d2b8f01df953d751d6ef155de5f0b6dadc07538766d0b6a99a69c8
-
Filesize
5KB
MD59dbec088771867dab86062069e7c2d33
SHA1519122987808e8b397a3953f4ffaa036acfe0b96
SHA2567e848ccfd9b6ebd9d177e7e4b8aafa9886d0a1361f781658c21a8ba6ab5ca168
SHA5126dfdf1e3f4fdb058e060d552f42d7a3b13923240e9764efdac16fe553a7ec8a7b4c14b3f41331644a51d30a64199931e316c5487d6695279218e69eaa0e27ebc
-
Filesize
69KB
MD570912c28cd3078e0b50ccc12dd223173
SHA1766c13b3ba839f23085cdb2451fd03dfde33663d
SHA256d7d26acd1a3115538a00c4b56e5d8bbd7809d67ef8eebe6f9e61e007aebe7282
SHA512dc535e3e336a8e8c90247f93fe89c7d645acdc4598fc46a6054232541e3aedf4de62794f2083250ed7d167a4a261c38a128c52925519cd2b8d5ac43f9dd1cfd7
-
Filesize
2KB
MD5d23f5e9ff61791b7f664c510fa3a61a4
SHA14c2e8525a1479f351a41d581ec4f55981527c7eb
SHA256053dae6c15ae1624a26bd77bbe246e2816bdf0c5172391885624093400c3cb78
SHA5120d2ea5876d68dcdbf8152cee3816fe2fde536b9a26cde6600cf13f564a5bc2a3d08404e58219964cdba361277878f4c94d9b1e8bda6f8ec8a71c78da30ec12ac
-
Filesize
6KB
MD54762d8b0f726d4b6da6de48f9ca74ef8
SHA1c8b6b38e1572dd73719047987dad73a461b08249
SHA256562373bbb3bf48c9a1a3de733ab3e3ce3dc232d770c89eed788c3715816e7d0c
SHA5126f1f279fd393f70ea0513275cd0076c133875f728f30d519cdaeff960973baf1462cf9e68196070088b888eef179a4b0e6b67c16b3796239e74e510973cacb68
-
Filesize
9KB
MD539679f9836b064846ba9c6dd8276f091
SHA1ef233461352d78c24b6c453425e41d096ec0a67d
SHA256a9459f88f0fd24026ab78fc52b7c2c86a391e6a2cfebe624c80273199ce95701
SHA512d2b104ec4c6d7cca409f515fc954f69f6653ce7f18143e7ca3df95bbbae639a48b63824389be7d1e0862492e3d57dcfddeba62096ab272631dc65f9509cb5f03
-
Filesize
7KB
MD5c7d8017a465eac9b145f8039eecc0eab
SHA1c04504dc1c322a0b00b3ffbaac68005d4c120e12
SHA2565f34642c5227744b4903d43338ce33c6124b3815a34a188905cd1856c3a6022e
SHA512276e8a4ec70415c018089bfbdbff25ed94528bb000671587063cc0dd14bd10239a9f0ea1821d3c0145017746af4163001598cd536b7df8b33acab990d4ab1387
-
Filesize
1KB
MD5754417588ffcb6a6bdd232f2f1d453a3
SHA1ffe7a1e5d90144ab602bccaf91040aeefbe57333
SHA256fdd28e3ca7bac5c71c6f1ab3132fa4d1bc513dd6e692a1f1287b077c933453f1
SHA5125e66d36b5d1dde0b63e11a0e696053f08a5d0cf4f9534aac80539188f13a40b387380b5e0c9ffa7ed773b95ad2ee832b58cf32b5fee462b06cd13019a070dc7c
-
Filesize
10KB
MD591618170f3730f3fc682321ea9d88c58
SHA1086933dfebef1c8c7fd20b96f973fa657996989d
SHA2566929ae0a8378400afab7d90704d6a3bfaa6a6f7fc72164bf6c7a037c91c3cf15
SHA51256b562748674b29cfee6f6594bb3f08ba5ee3c4e09483a840953cd0d178afdca44af7d18775a67f9cbcfde45d181b479d0964d78912f461eaf9ff299caa42a28
-
Filesize
262B
MD55a73506b66b1cc06502c21cd5bddb8a4
SHA1983dd9547ca7b39b0d4a3abd1e158cf9cc51b78e
SHA256f0ad994ebc048e3132e73dee9daa00cc20687deda978b209961aaa4f61e77b81
SHA51254d896cae38cac56539c0e722e13a80d36e396b14feb7491212ee2a9780d104238b155f201b21997aa61348e477bd997d6f0a84e5457fe49b79c0aeb3ccfe6b2
-
Filesize
16KB
MD503a591eeb4f451c8df37dcfc07ba0c13
SHA18d4d1d37ec7e744cae0ed567b4883ba6811478de
SHA25684f2a345e537a03cac65456781f73de894adea003a1e365495217adc04fe2551
SHA512982631fc822bdc3c541aa811cfb909ec4333b14ed9a98f73c6442f50defb36b2b9d268dae897e716834a280a60c815cea89ca9582f0e7718d96b0965d6e8c174
-
Filesize
262B
MD547922337458a104d738ac18a45a7a1e8
SHA138744a772618b619f6121f93dcae021f539059bd
SHA256c666ca709c25174a6e9abceb56851e30c6b3c6f202246b875512d20680e6716c
SHA5123891d361bbe4217bf2635a4dd596c3c2a38f2a4a7462fe7b6c8df131500b05b3e8919fad74d2b2027d74c2b8a1123c53ecdcdc9fc7e905b1098f56d3b5a364de
-
Filesize
1KB
MD56a3c5c73f52abde950aa0b2233fab086
SHA11f7e98af9b3f5bf41fb61679fa043df5f3b6d1e0
SHA256df2c4fc1f9ecbe74c24aa8f6d2ba75bcf364418b796c6917858649339b3c8836
SHA51255da11d7d2f9e95917d3aa23467fa6ed02d1e8f5a902cfef97c3d55b0012ac45135d723c869c259761b2fb3db88b2935e0e6c84624354e8a6340e1103258b5a2
-
Filesize
262B
MD593aafd523196f1ae0d7e503a20cb6046
SHA12d8b9899d27a5b6f78cccad27534f7eba279e624
SHA25627e94590703d30908f540007f37e830b86efbc38b0a5b454795b4d758d6657e0
SHA512867f8f4fea986ae1a5373b9068f0afeb867dca0c308f074dc5bfa75da6a0181adb0403cf580c7a2c5233b0167052601b183f7422e0d3494c363fafa021cc6177
-
Filesize
1KB
MD56b6cf4bfa3a97c0be9e2aef85433d178
SHA1e7f637d088317668f2ce789be418828f0668d9b0
SHA2561dbc4462325496beff4c9de107ebd3b24edf75b8c7699b75b34ad6dd7cf79755
SHA512ec7614d807088905143cc1066c025d117dd640585cc43c9e1cb8d668e12040dfd60f7b8d336775fca123a7e527edd45c7f1a4b56dfaca009fa944011e90fd8ab
-
Filesize
2KB
MD55d1bd219b678d0a5daaba28a211d6a17
SHA1b60c4a95513ae3a8290c08537b532e504ca32d0f
SHA256ea6b1f9aaebec1aaec8d7c60a63d28719e67fe29cdd72e6cdebdb321862600dc
SHA51291725aef73a081c098b50461ee13b3a32301906ede1e0d36f1851de246f53be7580a558b64ec68413a7877034c218bc4f957f5e532bd23253bb7076ed83d8fb2
-
Filesize
3KB
MD59cf7e4da2c028cf61ff62bfd9c2ca62e
SHA1d331d2ce229b8ea7f95bfa70faf4ddfd038cf079
SHA256dddc71292b1b7c0ce97b29989414865057bacff8c6b63843679e38015360deaf
SHA512017075acf0b633511ea57c2aacbb0843bfb21ac4eab7fdcf44f2cc2ba5f68dba18573b9806b09b4e3f6c8078078cf58363c9dd1b650acddf51ef6ae301775933
-
Filesize
262B
MD59295feb752eef3671980b9d2e31bd24c
SHA17c792d58ece0861ff5142c84a8bffab15b0981f4
SHA25666b325a46559d85627f5dac330ae08fafd516aec5ac7cdf34f0fad09dac7e067
SHA512ba944088d5fb2355e5bc060b024349fead8aa907e44df2094417c33d6011f5e19ff3c97288e8c9711183a115c9f70c7845919baa360a5ebb33a63d80d35f408e
-
Filesize
6KB
MD53568e6a6a23e0dfaba25a9820b5b4553
SHA1f7fa40a773ce0d4e655bbe75f2b52be4e7166518
SHA256f92c2fe35ae7267ddba23544b71b7cb695a38b892ca5eb2ea5902e158f97b1a0
SHA51202eb643d597e7f11098a9bfb859f669aeb04ad19f3daec6172c9ffd67d33757ee34186e1904617b7f427c1a572bcb6fd79d0a5f5bc3b2dbaf9561cad417b659c
-
Filesize
228KB
MD57c9d9fa679e0edf39311cb0121a4d905
SHA18a1055f77dfc7aaf96e4821105172b702076a279
SHA25683347eea16effa37ef66dcb348b749d22e6174ab96ad55a342e55e20064b854c
SHA5127c5ab9d3a1cf59001478a86da531454f08056a6f9f65bcb15f930c5311043b43f6ea9f6ad3a56a2b731993f18dc984f60c9db3817d68fd650f324238d3acc1d5
-
Filesize
13KB
MD53a52491477c2a1fe069e0ee7cfba4cd6
SHA1eb5ff2f05ba01ea11f440b5936f9922061a122df
SHA256b70f317b06d343d04d9cbb1bc9088ec0d64c9bcbee1c44899d1480432caf65d2
SHA5129cfd5e4298a32db7392be9b58ec90c1ac490e4b44a4cb332982aa46057ec2e4e409ba31a8bdfe9f6afd74df90e3776b0464ea563861aadbd7ebf3b041d1ff99d
-
Filesize
17KB
MD5c302b2c79c8d06c4a3d9133219c10a79
SHA185e5537377c71e049419bdc243dadca9c275ba97
SHA25687902d8134cdd3953cc9e5087b8ccc0690b7f498b9ec9a2f8d2eb0094df6c76c
SHA512258bead9f4cf4699dc68d1415afe92290dc198c1856e1348348fff41a9f29ccf3605892bc56cf5de1c5e00c61f2ef27e88a67ea000d919c641f0398bccf83196
-
Filesize
294B
MD510e06476a0cfa2ae90bdb4e3bc53d951
SHA18895ec09e642541f797b2256812bbc6a24c72c44
SHA256d2a11d91e17750fde49244d321215705e4d062c2a51b24e5ad7c7140deca734e
SHA512b44b6c1837f4f020ce00ffdebbc4b2bbc8c0a5b452f8c21bce002c566b29f5547ed922841851e31e8251582413f14c94d0e5d6828a3a9253becc0cd520236046
-
Filesize
1KB
MD519871ed1d1c1fb866212c4120c53a6d4
SHA1eab8f778f9047b445e67337fa3210093589a75b3
SHA25663004de21d2658270fa0245f4ef4867175afb942816a93afe1b27e79a3a970a2
SHA5123fef17e17e29441e99d6c1489f2f6ac3926dbce52a0c56a2fa07082cce298c10ea84c3f14e8ae0387111d3ce193bb9da1e81cbc2bbb2f2f950e2a8fa06245f1c
-
Filesize
262B
MD5ab8f91a60bb2ac3ca4d5644eefb23ce6
SHA1e00933906efe35270377148c1e2671c52924dd05
SHA2563b711f37d596758359111281f9795ab57f96f5545fcf27caaabe031ccdb78a5f
SHA5123d6611d9c2349f3611af225b66ec868e14e5ea765c5d5112543c04ba22e264a0dee4da9735c4f92a69060940b5bfb62c08fd979692b37b38d694b1d4b10e62a9
-
Filesize
3KB
MD5da4dd1fe94dc5de4a71aa0999563b07b
SHA1c8e172b6194e613fccd61e74c5449bafb85c27e6
SHA2568d27b2033bf5bb4e6f2d7d0e44d99727ae3cad0845ddd26e56299b98cad60155
SHA512bec1728d63e0bcf4bce22979a17ec43bc61781651382d3cc2fc5fbb41ac30493391a8c9cb1e14fcf9481f327029cc8994d1f26493b4aa9d84abfd4116a7d77a4
-
Filesize
123KB
MD5a2eea55bfa3a729edeedd6d62b080ea3
SHA1ec0fd5cba267a75cf20eec801a57d30cb4dc9989
SHA25691715c9ea70ade131f59811fae0c86c6db547f2f7c0e511f24c6ac643e78d88a
SHA512aa6c8724cc4fad5f8b339b628ff4984e5b89ecf27ae485e6984a76c850640ffcc71c7e84b9ee064e0528547bd9ccdb33532869deb318b4eb71debfd1e96b8cd6
-
Filesize
2KB
MD5589dc6bf022008b28696d51279ce8974
SHA14ee8931732f607d51db5633515a704e72001c8e7
SHA25628a4da03240166225c3c3cb8a383d2dd34bb234573004b9c927667baf304c151
SHA512730a0277f135068d9db783e7ba3aa976492d13661176a438c9105ae572767aa3cc685fbc302837bf27d5524f06bf099e8822b67e6cfec030606c931d4028b38e
-
Filesize
24KB
MD5e5f495629d940ccd5d1ef303237cff48
SHA10cd94816bed5d60eef53bd524d8689bd9c0fc1d7
SHA2560412a032ac7100518d7c0aabfae677c98afd4bdbb76396b250447d73c532b6d6
SHA5120509d75b9c1e161b9f86941d8f913fe7fc9beae1cb3d5b63237c0d18c179734a53273203d4a0e2a20cf8a3eb0b0ed2857eecbe748f2deea96c70e8ff9859b488
-
Filesize
3KB
MD53d548c3ff1059e73e547400548a04f78
SHA1015205110c3e7b5c27611829296373ebc08fd4a9
SHA2562adc387a524ea579375536592a97ebc3732410713a458b3a0a1c1310b0d6c3ef
SHA51271b337af51371e3e0cdd7e2c82ba66a154e0d97f4c8a9168ce0620e1bfb54769e8382f7e53d3f057471d96331ff2960a5275401d42dfb98eff9795e243dc833f
-
Filesize
262B
MD50832cb037834a7f8568a952cecbe5b97
SHA1db384421506a00cc770d2cf2f6d4c945cc236517
SHA256fba4a8d7a8e78764fdbb7cef76745bf62cd195199bdb71199fc9f2cddf92cf88
SHA512efeb06369ffb8e5614f8b467253c9a557bd5ac49d662ba54e7da2d2653676736ec16b078e0607fd94b659eecfe364b1820e2b06974ce422eb0141b61be0b50c2
-
Filesize
41KB
MD5f3070314dc233ed1bca5e8a565d2f222
SHA141e7770e7d6c15727411363b6d066b7a2c593137
SHA256a3aa61e7dacff0bbd62d70c40d233eb98d7b3a7599d7068d2ffe4c6ec342cac0
SHA512d15fcb493d1a1b06b697f8ef1cebe186b24fb302a4fdc93f24a951e551888a5d76e959e9b3e49a2b51cfcdeccfae009c393ff384f1077b403ebc53f8242eb839
-
Filesize
2KB
MD5b35846bc5c8edc198eb3ac8ff4c13a92
SHA1bac6b5e1e0b5b20110a5aac9a9551a9cda3b372b
SHA2560795a673c75e3dace0b89679a9c7999eb1e1b582b08273fe1453b16d252f8d62
SHA512901595efae60a3a66b6d34f5a7582108c54548c119b0615749ff93642b075c18352ea9471ff471862e85c143202bcae55e2934089f63d02a3b07f7e5359acb3c
-
Filesize
196KB
MD5c71c86030735f80f1fe6b536df1de2d6
SHA15cca3c65b720ed5d2579413f8b1688c300abfc8e
SHA2564882db99616fa563ba83f920634db0a7a5aa2bd2d5226a6e6e9fd1f83c401855
SHA5121a46f5c86b78c136ea7a9fda97b493c6c7891a087048dce865fc5152af68f394cf2069fb5cf61fa160b099292624a560a764fd35d32a7222e759fc220502924c
-
Filesize
330KB
MD5c1ee8888b4c48ed6030eac2d3221ecc9
SHA13d32e420d8654c3b2b0965a0bde1aa3f76ccdc2f
SHA2560a595bb1beacc6c06eacfb2e431192e41c21db538874dc25e98aade175eb96d6
SHA512ae72bf4cba9da5a9401f5a16daf2f3aee59753dc28e68b6edc1a02d47a9985319614066995339b5722c78103e80b68f6596ad993889eebe1d2b77b8c6d6c6cc1
-
Filesize
262B
MD5ac7fc1638c67e46a836460aab93089ca
SHA17bf2f5ff45d4939ca513c93dbfdcbc778f635692
SHA256c405e55aef3bb0b9ecd9627540c985de4b38674f34a59dec2a2e34a281d7ffc8
SHA512fb53dac1a9d9894e73f7858c0df8fa6f4791cc6af0eedd65ca091defb3c7d16d64d25097d9d6692b3587236a1ae497c3c0d87f72351f27e88e28f0ce34b8236e
-
Filesize
8KB
MD5acad387950f2b4b6c9fdcfdf355b96bd
SHA1f4760e1024cb53658b8f3a7d9bb66e17b03d7201
SHA25681b5f6b4ed87e009448e629a6148252176be83914edf8956b71629d3a1f75a09
SHA5121ffc649efd98edd0e6569c94c74b67ec30efb23df9450e51b9331f011de45bd7d0e3e6f4e66a84d5fdf0e73cd70ccb4dbd70d7c40c7470441b5b87c23e4250ef
-
Filesize
262B
MD589c3644955829297baa24284a006725b
SHA130c26c3f86cebf3dcd65884639507b9b7c322b40
SHA256c444cb0cd77cb86b3ab0150a33e8181105639d5dae76c49dbcbb32ed59e07112
SHA5127307a78ca04a835fe6debb51cd75dfd7ecae80b4386c6e9eb353925771382c4d5538ee7f5e4e0b0b6bd337358ba72120ee0aee52807542790d8443d31973d474
-
Filesize
2KB
MD53273fbd0fb7aea06f3511254d7d718b4
SHA17092eef475236ad9121f641cb1d282167755025c
SHA256dc247fe258dd80a9f8c249c386a5e1d1111a897924410b199eb9d68a8c732be4
SHA51270d17ea90d5ddb0e1705480e018695983166520a2c8fff8ffebda94d035fd747a41b9fa4e0c7cd15d250842172bac31483040c565d81da2a1609c7d1ed274c9f
-
Filesize
2KB
MD5101ecdbc46b8511b284703799aa0ae21
SHA1271b9dec4c077a16ff93d183218969bf4d60ea1a
SHA2567ce25525ce64f9b9d5013b64b25a72c7073d56e75f970f1cf0d9916d58c0a4c7
SHA512bc444781a2add7899613ce92f1959833d9f8ad86b491f2ebf662dd516c498b9cc0455ef8826509cbf266837a1c441a88f36a84cd22c1af9b60cf65fcec59d4c1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize19KB
MD520998ac8e0aa5959a6bac8ebc2e4f3be
SHA1f5275c3ee3a3345ac1c1567746e8ed9136009a47
SHA25608156c51fde0a85b65ab51bc403ae3d7fa1647bbeafc56c59e353d6f06eef8da
SHA512b94237694ac12cb5e8f92ef3d303b5959621ba6a3330314848a643912368b41e79e39b794242464a3b853b07c72dae84f53f6fd1d06c8c23b3e9ed013e94df31
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize20KB
MD5b332db8399d136fea9f8904e2617707e
SHA12d465e2c30e60ccf05e05b239255d12b741b1734
SHA25656922730d3a091863f425616d410ab5dae85027c8e9356da84244018cf6a53b2
SHA5120cf09094fc66c3acd5d62fb7005963ec5f15fbfa10679f586e961e9e83fe8bf460c5315d65d03a950d305e86a6dcb7666f04dab022d552e4dd9f095260fb94c2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize20KB
MD5828a4563551d2e5dd6a860cd2beee5b4
SHA12fc4e6dafb82a6d77c4d086dfddc75bc0a251747
SHA25635a5412dc5c1e539318b35fd5d5378dde86072e285f37630a6b3cadf20305cdb
SHA5121d54c15a2b33046c4c01f5eb764eb8dd982bd087722e08de7c033a5613e3e58196edbcd820f47591f18b3d7e468ad97387343714d0c863f2650d188c0de71183
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize20KB
MD56b89c02d33e2068cfcfd4e212a51e9fa
SHA1274b4dbecb5cb1eb164e0b65ee38c7f64598e5ab
SHA256aa71b555947b3e81ab6e8056947ab39de3882d3f420c2d840ae031fdb1fde5ff
SHA512a78855a48d847fd9841ff7ee97c8053672facc1ae5c3f8f0626f46bd0f314daf53a7339b31127301a086c57c657751d17775875d2f2312b9c542911cdfddd763
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD572c4bd034d2f0ed87df246bd131a94dd
SHA1d5c6dbaedf398b99cc641fa84d56dbc067868ac3
SHA2562e3e3504482d382c7ddbd889256b3d827c813431cee0e8077615f52f844a21ef
SHA5129cbbe98b3fd49a641adf39417899b868d6ddda57393fdf969a4bdf220055e94cd598f514fa162858f6d984d06f707b64927003614d9763695beb1b8cc2265a7d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize19KB
MD5f485f5f9c9545573c93b2f95bc3cbefb
SHA115dbdffccd1337cbfe302fea499c9f3a4d99cc9d
SHA256e72041464a01fb14223eb25dec0c568aeda80879812ac966dc0eff6216255249
SHA512717f425e0833e9f1e4a476bf4391bff10709a5b2540bcc83454bfe6680ae73eb42ca0796d529e45bac5639ee767e58fd9b43f4238c2f43a932bf5f32a0f63b13
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize19KB
MD54476eb9744451835660041883b37949b
SHA15ff328ec6a3b5e2f09582671cf3f924a7ee55706
SHA256a70d13ffdd7f8ea607a8b5ee61decb71687dfab04d1697b894965c61a5d473a1
SHA512996716b7457be5c866f18024211ce1d60030ed6bb9d94c96650a7688c7387dba0d4dc4d5762a2a7f2b7ddbb7deaaee445904ae6e7441e1b75e0c1e28eb6ce730
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize8KB
MD52fee8f2255c2efdf7e9dee1378fafbc3
SHA10b07936daf729221ca62ae1f4fa8b2f87bcb69b2
SHA2562ea229c9adf0d02a3e2c142ec355c63420fd947cdcac9455c4500b733c7a164d
SHA51276edb0ad41ac8653f6f2925d7bf29299e6f987db5f9c3c80313dd09eb1032ffa45b24dd860ea67c22c32b7342c35c01c9f9c254cd4385600eacce3e05c88bbaf
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57ff5f.TMP
Filesize3KB
MD54b3b3271e1cd82290878d2da2ebb95c5
SHA1f8df52d3e87224453c306d42ec57e51337c4a723
SHA2568a704ed7b35db0fae937220af301ff8c7ca6f3f1dbafc1104776f4f88f81c712
SHA512290c2cb3196c095ac6584430a7b4d0b9df278d85797d1125f8e0bf53869391ed50d6270fdfdc6736d9fde26eaa24da21c9364a47881c1207316b5a9719d35d33
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
69KB
MD5164a788f50529fc93a6077e50675c617
SHA1c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48
SHA256b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
SHA512ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
Filesize9KB
MD53d20584f7f6c8eac79e17cca4207fb79
SHA13c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA2560d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
SHA512315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\_locales\en\messages.json
Filesize126KB
MD584321cbf234ff333c2d230902ad22e9c
SHA14aa26ea245345afec853888b87a367843b999aa0
SHA256862142416accf817b61050488cbe44abf864ed91aefe2deb8f7669c4483944b6
SHA5121917170259b5b8e821d619199a09b59b9851da86a64fa059f39ebcf7495e4d6459715b240c1d6b97923081d5f9f021481927ccaf9c33f8336ecd4c68dd230876
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\content.js
Filesize3.5MB
MD5ae786223089c3dabccd1331b9419e1ba
SHA1ae78e6cdb520678925e0e23e22b830b4dbe55e35
SHA25608c205d164b3addcdd798a55ed16449cb626f5dbf1ea767291c3e782753ca91a
SHA512679410b3ab6e95d6c18d20daeca5967d46812a94fb6376fe2b23d25baf1f0657e864c359cb8d84296ba6ab8e22f25a62edab8ad165b2ea2c6dabc6f756d4ca30
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\font\Poppins-Regular.ttf
Filesize20KB
MD59a7ebca279f0a3b071f13d4e935ea136
SHA101250066e450fdbb17795aeeb14b168e213b2965
SHA25696cb6203cebcc84039fa1392b373058e57d831fa3516883d4a3a0826ce373747
SHA512f4f9d8cd8e02eb9a53e47b5c21d1642772dcdd55a1602333a0e9c4a8ad3fb68e8bed57288490bf8eca73d955fd3bf4ca49d0e3dd5362cba24ab31fea2d134361
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\font\Poppins-SemiBold.ttf
Filesize20KB
MD5614020f2e41841fd48ff38a343dbe864
SHA1fcc99858d90cfc9c00eaca1d51f09de42ed43471
SHA256479ccd096dc213d85dea922b56ef06a3a4d807548de91cc239b85b5f25c4d66d
SHA5124a3596dadb64362344ca8118092ee2791301db8e58182f0523e24e23133b70d16188665f31593440e83fd94aca10cc8c0cdafca1f2884cbda6c3a8593283cfa1
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\guide.js
Filesize2KB
MD5b86c1d7d318fa0cf593fa78629fb27d7
SHA157fb6ef84bc200dc6dc4cd7a4a21fc4e89196936
SHA2566446026091a8abaacb6b522985f81c6b243645a2894b0ff4e4954fb1d38a0d2b
SHA512ddcf0aec342614eab1214986b786ccf4c9f65b165b2f18660db170040fdf3a2dd0cdef6a177e6303663fc9b3f099178fb64a0d737a9d0410f0aadaf112582b46
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\icon\browsericon-on-19.png
Filesize921B
MD50ba17fb44d8871139be1404726840710
SHA1452fad2d829e3b00bd4e99bfb3e555bf6230bbf7
SHA256e85a05163433a351f0155ca76332e3f94db2b5f25a4d78c9d054b61218a2eaab
SHA5120999755de790b64b248a805736c8fb5d9e155ddd5efc672ba1193b52068690c0737cff6aa33b2f2eb9ba0a3afb4eb000c7cde3fe44259326de1095dcdbd378d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\icon\browsericon-on-38.png
Filesize2KB
MD5157cc265b16e9654996f643463cbf3b1
SHA1277e0656f326a8a544cfd2dcad02fe9954d3a0ad
SHA256eb9ff808d1bb7c5b2a7fdf7a6fa115a62c5a1237b035f309091948ccfc3953cf
SHA512ea175fbc8dbb839a311b00eecd6d049d42683b4c416f40cbc6516dca4db7a5b2f24d52f4f28cbee7c3477433b58a222329dc841fdd40d63a254190eed1a6c02c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\js\elephant.js
Filesize1KB
MD557ee17ac1d105dfd15ea9ab2c28bd2da
SHA16811ef14bf9499d8363bd1f136a7bc4f2ce282c0
SHA256790a758e04931deb83eacf4252fff9eaa744648786af7aec3ffc815c6368252c
SHA512071a790f77ffe53b45659d7f63baab05cc62421ec1994716881506a7d47834e557b193bb6e3f168fd76992e942e574003cc7e8f79608f1eb960ba5ad4024cdf9
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\pefhciejnkgdgoahgfeklebcbpmhnhhd\6.11.42_0\vendor.js
Filesize2.0MB
MD5e4be665355b4222210cafe0c34cc2fa9
SHA13958754214dcb10a0caf3680b907b1b7a2045e3b
SHA256917ebb2a7acc72c705f1f0a3d11ced8078a1535e1cfb5a83295dff09d15e9e03
SHA5123ffa7d4f6a098b5c0ad33503cf81520ee3fdc1061251a8b65b26dd10aa066ad15c51e011a6fac6a23ef259fe7466ed3b96f83880572feda2f3e3dc98b289fb84
-
Filesize
107KB
MD540e2018187b61af5be8caf035fb72882
SHA172a0b7bcb454b6b727bf90da35879b3e9a70621e
SHA256b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5
SHA512a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.coupert.com_0.indexeddb.leveldb\CURRENT
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
54KB
MD51bbd9e4b5c64b5802cc3753d4558a65a
SHA1c5cb0cfde7cefb8558582f05efe66090d1c5bc41
SHA256c303bf2566cbc1d78e1064c2fe9120823c953d09bf503c7132662f8c705e9420
SHA512c35956486b55c10cbb9e632b1de8d91d22f3ab80d5f00b3026c5037f15d5423b10557e7d35d7d538ba9f583487aac1a911756c18d77043ff7ffe6515a416c898
-
Filesize
48KB
MD510d454a2d0ea3f2446d6ec716601df10
SHA13fbc697dcad4dea6314391b07c96c2f9bb74bf50
SHA256ddf0b0e61c3b6c539a4b9bcd3aed63bc02eaf3c4c888431f18f4bc36f22a5443
SHA5126229cedb2c2ddb10fd72f50677f0144b5590c731bc4e88e4b4a10c47722daa07b0e6aee7e7b59d5b4af22ed25c120b4fc9f40c5ba92a31c5778f14df483b51de
-
Filesize
24KB
MD5b79c2ad0b49ac09a7bf21b2373b0c43f
SHA14d3a4a320ebac370454f92fc9beb4eb22c73b914
SHA25674975594d7299e7a5553a945198718ab2e048c024281cc2d4d0d2ef7edc728b1
SHA512a80bd87655079d3d83f1aaf8f55e5f7285756adf17bea639d817952514cd74eceefadb1f7c3560fd89de6d14d9b532ba7cdab269a310bdad7e3e3b6826d3a922
-
Filesize
54KB
MD57bdf20b3fe1e6a8d3bfe2296f96e39f4
SHA1edc86c1040acb02e496d82116359cc716739eb48
SHA256700b8a16b3faed55523091917ad6c94fe0084b296077143fda638c97d2fc1dd5
SHA5128e5f57b2868aa546936cb3551c0c0a691d7c7c239301256bb8b06e5e18aaa9772058752cb5c4dfae0b3a8501feeaacd7ce8a40d9c0e12ab3786eead84fe06b15
-
Filesize
12KB
MD5d767e02d55b9ec9edbb068998d362852
SHA1ce1db9843a001cee2136404000f1cca497f06713
SHA25674222506cd2e4ae064d2850232c9b2f956c067030249cc302bfef3e503d222b4
SHA5124af77f39062d1537727525cda72211a028ff7eadc07a5a83c8f2835a1df969cf3da907139ef14918523a7b00747ce3943c91498c0b3afeacba118789359a7342
-
Filesize
4KB
MD55e945c6f3f5b55c0db8eec2b938d3949
SHA1032e2ef8eea0d2b8e5427ed311ab05254d2740b7
SHA256e5ffe50c79dc76c8bb8ae74b41683480cf30de872bec4019e25b28a860ba6e29
SHA5127ff9738097668063db54f8823483405aef8d738f8863afaaaaae304087f1e7328bed80a0970ccfc7a0b3b4fdd4bfce65d59969756d020268cd5e48c32ca37587
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
211B
MD5de3193cbec6c4a1c8ed1f3f063da9fae
SHA160d520fb3184e4f0217eb7e4ebfac47478be6211
SHA256741e94046a7ff151f5f83ee964c6832d5cee6290bbe5e088f2f74bb6cc41f0fc
SHA512ec283652b5b17f6fd4cd7612fecafc70d7056ad11c16b1fc54d32c344093ac28057d2278c99bbbbfc884b883b1bb416206cb3e0aaac97080b215eac700dfe935
-
Filesize
211B
MD57be578108b8425903a009c900c77c414
SHA15b0fab491683b445139f479c1d860f652f1c337b
SHA256f12791f1a326a4fba24056bbc9c7fd1db2a90ba066e63bcd44f5341e3310eac7
SHA512e9fb07a9213019d7e94531cfd3827029d70ce1429f698e90176dfe132e2ac7667cc445b456a661581ffe4f0852d04e76bcfb67254b9a1033c2b9a73275483d15
-
Filesize
211B
MD5357a6ad173d4a8541ca8099f90b5a67f
SHA124a8b463ecc3eead77e85c8f528143c302e1ece7
SHA256b29fb7a511fb8ea48b8a7669708e5d18d1401d1cbb19b628a64157b07cb5e245
SHA512a7fbe70bcfb508e21203779bb3c82793e396e6f8310fcd8006f447d754cb6fb7387d46a73d497cbbc5ea008bee3d5b9a2e6bafbd53b138ade2372929b2740c8b
-
Filesize
211B
MD50c4972710ba99e979a9482ca897635ed
SHA130970ed70648a0fc48402915da038e93ab460d48
SHA2564655f7e44bd845c5077f036c5ad57acdda3ee0db859fcd6f9c810e74b5e45183
SHA512dde994db340787970bdd32436027ee17828ff64ec52b6c18000edf09031b27dc8161b3148c9f8fa079f51c9fdc3fe1a087632038a4197b9c446f6e1298735b6f
-
Filesize
211B
MD50121a37811cf90dcc03f7a9354f161fe
SHA12269b14da895729c8fbf75d09da5a097e7180339
SHA2565256a99d60be7150d68cefa0eb41660cc54214293695f25d9ec9ddae33ae9214
SHA5128f197e955b5e68adf617258101ba6b13303a1afc163fa5bffc617eb72a92c5ef400d168f4ec00977c53d53be5bb093c913d1a06ea1d4bf5b9ed27678c2874613
-
Filesize
211B
MD5183df44fca7b923621c91c67ea77bdb7
SHA1816505d357ead4d32386362f66bb42da56a9a259
SHA2565e256cbabfbe56273481bbb9df41546183f260b2e24600113c1217493b38ec3d
SHA51289442e1c85144c3635ec48bf29c74539080b2088375c5a60c9083a883c7a4681bf023c9f3a8d288896fbb0e018fd4f72db4a029cc396e6e253ad6576b2f97c86
-
Filesize
211B
MD5912087ed041b81b8568d077d9047adc3
SHA1f4ffdc94aa00455ed61a891cab4ea6c00eb7de8e
SHA256a77650cbe60d184b231940c4fae00386201696f10f658cb18e961b15e73944f9
SHA51274797654d327eeac59f94bae1853dbf846c71591a35c0fe63ef7c9a34aa2fc59e9ea99ca5816bfccb6d17b3fd7bf2ba983e02429838935352c32d21fee840367
-
Filesize
211B
MD58ab865b9f0ed8b3f3212849d30d49add
SHA125fecc0db031385d49ee53d0566d74c83da17ebf
SHA256cbcafccd39b0d93ebadfec2a6d823bfc72f181bd0ca1e6438337559c886fc188
SHA5126b2e50e071129cf99cc5dd336db430e0a901a2dd9e788e08e51faf9690483518b5c7656877323a63bf50d38a8dc9f84b9aca819b895511deb57179bfbca01c1a
-
Filesize
211B
MD5837dee7d92e4bbd77d8bb59cb8c988ce
SHA14fc247c6bc5e07d38ba2d705873fcfc4ba8abafb
SHA2569106fbb71fc73d85f96965e783e689cc94666181c2d94a4d66ec7913d2678085
SHA512a1270e82fec2e5db0176eff79ef0d30ee31117695798f0129f5ba369e39d52760edf8bef75f50fd728d7a9606372e4d02c8b292506a41bdfdf333f1b763fb1ef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5858aa.TMP
Filesize40B
MD520d4b8fa017a12a108c87f540836e250
SHA11ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA2566028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
SHA512507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
-
Filesize
13KB
MD500becac4b3d474253707f252cf234d54
SHA19fe8903eb024d2a44339bdba58e3f77481b29e67
SHA2560f213720dadcea875a955f7638503e2f441b04e5bed8c67f585453a8d7ed142c
SHA5122853a765131d7d0e8f0a6135d56003408944fc36ff565f4aed61aed4758f91ed4a58ec28260f5fb9a1957ef286fdfdad7c5c7735e5531911fffc5b892b7685a4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RFe61ed0f.TMP
Filesize13KB
MD5d288ed65351a5ab33cb41a9685bd8c5e
SHA11e4e5a553170d2a94569027d54f8f74679a4e8c1
SHA25639617ee3ccef407de6a792276f1b0eab71f9e432e78c5835d5420357e4a3e550
SHA5127de5c7cfbae91a2ccb2440227c3c7fe030c6c3aac34fb5268b24eea96483176fd8878babf545a9e757e323fbdeb71c4a97d2482e3318d5d0dbe28f29af72d780
-
Filesize
22KB
MD504fcba3f13abf49b4ad97aaf4a9dd1d9
SHA12c4cc81a96652e704b8a0df785865905c1a43af8
SHA2561c15a647ec563f31d0444c8150f2bc1e4c23ee89491999d7802458a71f350b2f
SHA512933bcd574c683fa61c2e7a48f828ac7a0a6b1bbf37d8e05557f92faec74201b35409e10294fc313d4babedb701e23040a53643f524e376eb2f4f3e19fc1e1777
-
Filesize
37KB
MD5dd94ee6e247836e3d8fd0d00af8096ea
SHA15c93dc30ee2d1371a02a405fdf82d69a62570acc
SHA25649f4c1d430eb85e1ea007b0641985ddf815c8a5365ec801f055b5093f8ccc080
SHA512e2840ffc10c81793b9fb61640459ac8e03a40808499f8a8298ad67fce13872c1519ca49d81341603d3e5a5988ba0463cb1f3c12225cd5eaed4ccf5f86b85f21f
-
Filesize
36KB
MD5f1ae9eceb58450f7d05ff8e777573978
SHA1944c104ad788a2e8ff8adfdb113059ab9f64704a
SHA2568bd1fbe3638d4a701d68b5f784faef27ea1a43cb5cd5bed039a45b087779d49c
SHA51204e60e093fe9105f5257bf944fd445a42014f747e36fc9ca2d60cedf0dee2d9fa5a2dad9e896d54a122bfaa9d59f24d3dc7a0898c9fd25213220438fc7a40e4d
-
Filesize
36KB
MD50396b0bb07040c346bc9b77cdb8c11c4
SHA165da53b6f2fe1140f35ca34edaa3f55c335e62a6
SHA25679740f506fb747385b125475529e029cee9f9d6bebbd56c1293668505f9810fb
SHA512e120adb2eb29402ae4c00dfeeb74baecb373a6b033812bd6b4454dacec5bbbb4521abe3b1910e0aba95dc739b0001af9d061d70ba9cd198ee4cb3a079995a77d
-
Filesize
36KB
MD58073f449d254e837b7c2176b6f183cce
SHA1a24a141d4da67a22db20756c6988718bc010d372
SHA2567cc3c9dd567572a1971c10c3f974fa70b99af33c3a835126902d1d39ee3c1f05
SHA512ef71005a10f48d7c4f8f9cae9ec7887c0e3ee31689603de16c3889a73a9d58e82246501044c58423bb84e1bd18ce72f16a67da2039a014fcffe1ff24fbf5e268
-
Filesize
36KB
MD5f06afeed860ab0fd4b699583f46ee851
SHA1b3a3a86fdba4308ad5b1058eb8ced99f9ba773d9
SHA2567e894186cf8ae5da011bdae412fcd51feb01abc108a21f06ec076d626a2be92f
SHA512b173328201b1cf8dfd30c17a933dbf9437397088cda2532e90c177c4bfff9e240dcf497c7935ce0f3ea75921295395ecb0b8fe9799159cc3d8166aadbd945906
-
Filesize
36KB
MD59f8c58f2777707eebfaf3cae80f7e299
SHA181535bd3ead1db95eb184b24bf37ca69126c7303
SHA256c41c9e54f3587a96b98b9494c0bb2623d14f89cdd387d96867f78a01884c18ee
SHA512d3669b3a58a190dc606975eacc111d9ef9e05ed7f0afb6cddb9501631d79101fb082ef9abc271b0664bce62632808797c2b872f44fb45543bef853dc7f1a638f
-
Filesize
31KB
MD5d5eb8ecfed7eec658c0ad5780a404c43
SHA1be0356b0dd860a44f51178d604946f64be1b245b
SHA25667622514dca4be0f14d9fb4f6e4e872511bed365193812da85a847ff63e10e85
SHA512987f32e696d1a88ccedf3a58e3205b7a1f1bd5198bf1f60a36080c72d2f3d6826cbd986d46eeea5eee3c8461b98efb785d0a6c2681a4ea81fb27e518672afb72
-
Filesize
14KB
MD571ec3784941e1a2f308468ba2adb3f88
SHA1cd333d5acc9229a459f7f8e1f514e074b986d4a6
SHA2569816933bb5996177abbbe638181081ea5f647d015c2a9b0f20e20b52c5d89856
SHA51270cef0f373a916ef729f8485abab71ea4ffe261e786efd80ed713dcf37acb98412482f82ee3936cce1214377830527d1c19e2bd6097ec5277bd06d334e634afc
-
Filesize
32KB
MD599aee89c62a8b8442266ae703bddc99f
SHA108ccc67686baffeb82f59c7107833f69f8ea274e
SHA25658e4d765665445cbb2ac7769fe0a1c9f2f1ca4d1189ed6ac17bb9e76701c76ea
SHA512f6e45570e53bf8cf5687543b3bc58f7407347ae93843a63a4d767b633d06de3ccfee6da95f215121819a94d7de6d2d048ceed53a8739e28b19460fe50620706a
-
Filesize
32KB
MD5265b012c3ceabee858efcf6e65fca459
SHA13f50cbcc6ef813b0391fe035a2be61fd82abd306
SHA256e8bc63549c3d945fc88a973d7dc8d43046f54b0c60536e439fa11033a4a6c5c2
SHA51247c90d3f3317fa128c3a4c840e8408c7ca290ccab4dbd51ae98987bf976c8a7830a709c909d4debe413f085de406cc5f5c8640176d8380e5c707b3a78fc0b3a9
-
Filesize
22KB
MD50d94ec434801ce2e8d7338852c625bc7
SHA17a39846977a3705467d2e4bca17a99ac27c998d4
SHA256d25ca403a7bacea46f823d3d7ed05851b5ff2845ddcd92305332fefb5d8a350a
SHA51206f0cb733a6bf6318793cfe3aa0b2aa254ca74585d90b02c7d947102fd53e4babf9205ab03154b80f7ba684dce8d7a5f656df476739bc07ad05087a0f54a275a
-
Filesize
15KB
MD580fba4371b80fa7766e82fe166001a3e
SHA1dac67231f87be68bdd0c00f983e099cd32f7d2f0
SHA2563b6f1a0056ef6ffbdfc65ddab5dacb9577034bbd94685d4e2137b6820fe463f2
SHA512698774fe055a458575bc76f26f69d9b54c414b2fef3fc18441f1c6fff386aa806e1c4eff167c6fd565702fafd5e7faa0a59853c406da92526fa7904efb026fdf
-
Filesize
37KB
MD501a7da8a51109c47e8f24f84b65c1255
SHA164734f40ddd220db5f05aa56cf2b322b1d936888
SHA25626c09bd26e10e8039ac4f2025c4edf0e5aef1888db52b32200ae4f296e5f0f2c
SHA512a632626ef80e09186dc897370792277292c4857ce1c4f426eae5c2600a71495c5777a3044872daeab489d6fe45212334ed6c2c54f6bd2deb7ea7aa00b003f638
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Filesize253B
MD5545190bf3a36bbfd2c09b7578045e22b
SHA13fad04bc2da34346e3347c0a511060a6bebdd3fe
SHA2563bd6174e6f87205f5aa4501ce97354734953c783f8ff10bbce87ce037c6a5fa4
SHA512d88ccc783124c077812fdfafc7a53324445c2a3b4ee000d9da6000cf3b23722a24b045be78a6026359dc5100519d87fa6bd88e18fad0e56950d626c91db75655
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize216B
MD586e85c204b4e51918b5c206e82a642b8
SHA160cf767d594e848d1b096f9108ee095f3c470106
SHA2567f94163676a3fd74da1db165f822f93f2ff62da36a0f11efde1a722f760a1414
SHA5120d6c1b3830902e910d6f865edb726577955f83a801ba0e3598876d168524cf598d6cc11b00643e06dd62d92990f80071baddc1a542ac18263b6db17c762d79fd
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize144B
MD5c320b646b000a0ee0fe792ed143e5995
SHA11afa8db4c2a4dc9a5b1896cccaa7ae648355db5f
SHA256f69d1f224711e47495a0d3b26c13cf2f0088599d7b3929b8ab66940d4be4305e
SHA5129a96833a804bbf99574fd77d65481c2e968e74977bb42290de278151879886d7c58c10ffacf90275b26c5be9c2d3562076151fa1a8bf77a6103882a34974e27d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize192B
MD566ba68bb0c26c0fa31ae397e2683d9c3
SHA1391caf0f3142eaaacaf01019575782a2edefc2ad
SHA256fbf9f5ae3d5dc8eeb68d208fda812ac2e7f9bb3ed7b1a256c2524e079b9784b8
SHA512f1692fb4125f6c721ca31babb4b95b838e2776183e2f0e5c7bc0a033b0df9af24d4656580fd4598e2dfaf78e41edf2068f9ae097ae192083732d396d7e9c289a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD511e9f3b4c5f1fb6d1dcd693d292c1b14
SHA1c8f10a3eeb81c19ffd3f4ed98176ad06521ac947
SHA25646c9c5111c3e2ae865b4e2bdb5dd88f5bd38e0866a4a20989555ce725b1ad33d
SHA512b3358a3865b964aa27b145d71c70526e28569737443bfd51527129ae593ed1fada4664b28fd255e6e324b203cd955eeee7c226f1230fca69e92437abac68d45b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590814.TMP
Filesize48B
MD532aecb95306cf1ce101e2e738014e852
SHA1e193df94e128b1f5928482988d765a5a743e2346
SHA256c290239eb46ecb85c906cfb08601d786c4a030a4ed981cc73bf127a62c6bd2b1
SHA512f9ba7fd9bdebd1ed74bd29a3ceb910ab373bbb87ecdd5be1cb07df6b81c59323cd2066bc20901e07d5708ba3a19620014a7b410ec6ee248841eed232d871064a
-
Filesize
4KB
MD5f1151b76283703551f53bae8115ecd74
SHA10ea376bd53a2c5d1038334e81e4ddfed7b650ed7
SHA256033b8f728617cfa152f86934bf75f51da76b6437a6757564daf69006d62261f6
SHA51219708630ab8bbd0ba355dddf530f1fa9a52c146d900c915da1333dd4462fe1475b2aecedadcdb98fff2a5c7a39029c9b30ebe9e7dbbb3a9bd97ec7a1c6538da2
-
Filesize
113KB
MD560beb7140ed66301648ef420cbaad02d
SHA17fac669b6758bb7b8e96e92a53569cf4360ab1aa
SHA25695276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985
SHA5126dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\009af9f8-a731-40c3-a543-022b5c141e37.tmp
Filesize21KB
MD597ffbea42e9a0795865f12dedaa14292
SHA182b1a9a09d849ca8e55914ceb05677991729de10
SHA25684db83a7515ea99283ea322d6ae8a7e806287e7e98771a53a5d0e3ff362ecd16
SHA512884e56e3e7419a5ce22725d8b39b6d9424c882185762fe6ebb3a5c67d65e87b846ecce8a26491019acd3ba79641f489a32e20e2c7b99576315352cca1f5a13a4
-
Filesize
23KB
MD5317fa176bd934da3d20838ff1cf79420
SHA1d49b61b47530244deda24083bb3236c1aac41d8f
SHA2568701a9b25c9a9a1b929b4bfcd584e759483ee75bece2c3ebf44cdf371bccb092
SHA51247afc9ffdb864c7253e182b750e052687f29d2f4e3232ee7677ab4809bd3689b639fd4ac3bbd78f7c8262a0d6ba7e007ae17b55eaa7056de7be0f9534ecd2c2e
-
Filesize
876B
MD5866f4b2f5d249b7c3e8ed4ad58ec5d7b
SHA1e63686af2857e9f9fc92ab53c3f3392ee4aaec8d
SHA25669c488841b428f3e2ddbee21b1fbb50757d94727465c8c73be35eb51b7deff78
SHA512fafddb736f675fe40d76b516a30a8e74a09ce2d6c56f39b75154ae9ce3f198f5768cbcb59f50f52b993602835ff3637886666d0901f21710e5c8f5519514ca3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog~RFe589788.TMP
Filesize467B
MD5acad3180169ae3a76668c3af513b87d5
SHA1cb7a133905d25325553a57b9491cf7a77d54cdd5
SHA25616f5da502f43716ca505b350d6fd3d15e38f71dfc321f41400af52beadec43a9
SHA512be10e3741233215ef093ac9ecead8a0cdd5ecfcac9226ab6688aca67919e292cf4716cabd814bea3434e3581b31087b2c880ba680b7b3489d2c5853b9131bcef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Filesize3KB
MD594406cdd51b55c0f006cfea05745effb
SHA1a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA2568480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
SHA512d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
-
Filesize
30KB
MD567e46ca347bcb7d00e2e52650fe72795
SHA1295a17c32dc705fb2c8d1ca25556e100ab340cbc
SHA2567e8c25b71f470967061972b45d99cb2888c681518e517fe95c9f5a4d6fd1b322
SHA51256fc20029f48fb07803bf5d74a39ce45d1ced587b8ef934d3471df8c07a0f6a26b41429e4699abdf0289b3d58bdbe871b807715c6863297251d4a5b615f90066
-
Filesize
41KB
MD557477ba52d3ef41619bb26ae2965ab0e
SHA1d7c3b6a6df716022c0090ca1f0d40d1f889f347a
SHA256cba5d60bf32463b2a23f7f263a186bf626a7092d84da30a7debffb723d594072
SHA512920d9505787491928307f9c6b887b7b40d8a614649eab6c91171f9588366f37210132266def13910206ca9ee56ca6ed22e2fecdc59bb74ec4f38b070bb6c8f96
-
Filesize
40KB
MD574d320eb98d9b0dd82dd697ac74d8a5d
SHA1469abb2b34981fe11451da7ba2dea55cd8e5400a
SHA256615bb11dd392bcc8390151484c4f904b20598a402a7e291fd0015cd352c068f5
SHA512b307435c721d6241790073240d21b01695053ac12577f9d3d8d40055f9c46adefbb8a991cc1b2da7b3e6aeb989659649802185b64a90178e85c7ee937f0a138d
-
Filesize
41KB
MD5babbdc309686fab4a78079c029f4dc0a
SHA1c3fc3ab7197b23c5298d93abcd1f5a5ad5cfee85
SHA256c201b922d5f7b70f95cd847e31ef8084443f0154b951f33e67d5f11c0b5009db
SHA51233eabeec1f5ef3d700ccff28a188b8f75e89b1a523e9dd140e1902ad3af67bb7120b67c8c4098c92a5fbc36ba83e716953ac91bcb3562d52da4ba0c0d37b7e36
-
Filesize
41KB
MD513ed38e0aaf04ac308a36c48f66c38dc
SHA13c128d7ef989e6867a7babac713344648b5ba1e5
SHA256bec37b1c483f3f513545afda8a09ab80af819d22808a7804b3554111d5ae6f71
SHA512b3f2176d60ce7df848a98ba219626a2eb1cff509c38268ce1b6d75a08165e311427ab7d95569bfa29201b2a94768607b634b5d2c5ec4e3bb03849c7e21d40d73
-
Filesize
41KB
MD5ccab5294e6e24d996081dc582fe81aff
SHA14e964a2e68dd15cb03cab2698fe95b961fe1e9b4
SHA2567a7ebb36bafb17f70cf680800d1de337151d3efe7a1e4525699153aefbacbdcb
SHA5128e863b3f1dc45208eb9d84ceac487679dc8c7399bb02c9b485a5f29420857053adbe5643784956285eef57f37f917e9a57c3467c0d04fc10c7e4936508d747c3
-
Filesize
40KB
MD56e9f3d9e57faa035c188cd06bb1eecea
SHA13183e718da43a614f337da7af151bc228c4228db
SHA256ddca4d892be85243039654652d3d3919d35c20645a066e694f76350fb041516a
SHA5123f2fa188dcb1e7d79fcf15ec0a86438908da6afa1299e6f5139e8edf498c6edcd07ca60e730972d0b713b9c396e82cd9cfe09543f0c6ddcfd9a1efe62da4236c
-
Filesize
6KB
MD5fb3fe1f1841d7c49756780df3972a528
SHA17deb6137a66c9d6b09d05aaecd4ad16b2f278ad8
SHA2569f05a50d0268e1c32dc9f3ebf7deddb2a105f0c22201b2f2e4c032f6ba742f8f
SHA512762bd44ab487646cd4ee14b56fad5e70c34b69227a7f3ab6419e69dabe346c381534dc2f5cdc559a5dc860b26a32d3cb2eaf285c01dc9523c9fd8f7360750fb6
-
Filesize
40KB
MD5bd9747b7c79ed7df243e29782794021f
SHA18b12f4027bf6d4bed59f938d32a5c229f5e8a0e4
SHA2565293f830fcd9616062b637e56b80b8bad87b21cd1083f9f9e83d2f3c425a1f96
SHA5124ae4ecfaf3b836b9220e6815cd4e25e6c7899f0dddf2f380839d2e992ed9bfcb21bb5e84873448942d5ed1c1df3cbf7b77bc5410c3022b00ed447820b33ba6bf
-
Filesize
40KB
MD5069be17419aef0e2dce1bb822ce41e31
SHA195b8a49ab552535abe7c6f360d2f2c6e61d2c244
SHA25649d221daff49939c7c6af44ecb5f1efd3086a08ec4c8878d4d300cc92deee33e
SHA5123483e5f3bebd639fa3b3bbaf0353569f9e660ecd396c9684eb2f95bba69a54fc7b162b8497c9006a8548de2e989396098c5afa8deb5f36dd53a9370f155c3458
-
Filesize
39KB
MD5f0648b38566be445bb5c464b076e38d3
SHA174d6ad0803a1fa61c91a3d1c3909dd63454b467e
SHA2568240e7e327f589f65333c3ae95dc5fc5cb65a2fe6280f71c5b2aa219fdfada4d
SHA5128556f41769b2cba177b14d46bd8eea8dcd56f1d0ad5c39e9b2cbd89c8c1831d5374b3d5f934a2c2c8051a684b916e5a7b0b7bd3bc8e5e430e7c2f95b8074af19
-
Filesize
30KB
MD552143bbaca6a0ce9885767fddde10cf9
SHA1a9d2e3f7ddc97b65622732c50ddabead0745ee46
SHA256f9d6d7fd6095f7b302f6df5681f858102db6eeb3a4216e70d6de45439b385f66
SHA5125262dfb68501450a4ed455c8c6cbd5d4c3f2cdddd188ea01096f3bc19ca3910f2bb6866c9a60c0f73baec90636610e18a102794adcb07d30adfe1241f5da8b1a
-
Filesize
7KB
MD5f9aec8e3f2e78f3eade06186d219cbf2
SHA1e410d36380a67c0e057fd0609637259f3c0a8afc
SHA256abb56690200f8ba0d6fd6868bbfb3846467f61295a32bcf8a988dc77f3fd9e52
SHA512451950ed8ee56f2a5c14d2f21793807e5ccefd66ad827bd38617c0515f1052adaee7c322f55f9abd3c362a673571a77282d41ca568441e2ee9992f88d6ac5740
-
Filesize
392B
MD5af9568857b42c2bee224ce1527bca014
SHA110d364f732ccd1a37e34a4961184169ada679ec5
SHA256bcd546e503b314bf38c76e9614b7d7be334feeb3d69c9c62b31b25cb263873c5
SHA512fe0001cc2b694292a8200fa36dcf9b4050b07bfd8c42d93ae5962daf60470e2783c16a17b08dadb0f4335ed162ac0f99a886670c58410485b1b63b9852b2cf80
-
Filesize
392B
MD57ca02807406ddb108fd91a8c8b5df7ce
SHA1ffbaf80171ab65cdc131975b88bf053bb3b4eab1
SHA256aff3f3da463bc6a642027f551b82474a8973a39f5f3771d08c1b2fd81dcdecc2
SHA512225efb8fa48a8497ef2e2f0d0344497bacabd94b845aef1b39e81e4b445f5a1b4b61ae90f02b0c7660510bb0686ff8040ddecd00f28ec005175e716599157f2e
-
Filesize
392B
MD5826dcbc3aa46ef0416c5e19584c60fa7
SHA16a966d5ecd766f466cbf04579476d8cea8e91a33
SHA256017a2add74edb8062e60e16db5c147a7f90a0e4a7f87000ea8610ce24bb94331
SHA5128e7e091b12d62e8a360ee9a3b97a08a2fb06a0e4bfb1b754bcc2c6357b9d0025dba8547c4611e7d2ab5036844efd11dd6e5ace7395bc8e9fc8432d657c21975b
-
Filesize
392B
MD5e2852f752a3163b109f5d8e419790d1e
SHA17637b9170747e55463de92ee9362e81023725690
SHA2565be6f64f339e2a2381f425b090d245d355222c727e5a6fea0157ec2e4abf6aac
SHA5121a5165bd3453a656a3e73a8cbbd56cfcc12b3f77fe13950680be0c6af641d79495aeca2f041c5ae5b98cc629af414cf6eb6316f4010965821a7dae249d65300c
-
Filesize
392B
MD505f037f382e8bbadf7ddd5005fb64bba
SHA106b76ea2bd8601504a2f804fa1f9f68b321ca5c4
SHA2563fcaebc0c30632a6d5d8bfcd6060d8db876cdd4c3ec63ea592d2cfe646203786
SHA5120c62762fa090096dd2d8c78454f8d3e4ec9368d3dd743856c37ab20ccec993582cb9a43f2cad21593ef6f1082244f1b52662e7ce1d9577531ac54a39401b1646
-
Filesize
392B
MD559fc47d79f1901c084932bcb0cea3b24
SHA186088409834a4f1bf33cab9d977ef4ab006fdcb1
SHA256035cbcf19b7b662b39db02243fdf9e82675011f9774258e8c02cb231333c0d3f
SHA5120d7b4fe1dc215154e46f131feee5065bde6f95f9be9b46a1d40c3077df60ab2dfb01fd1261d726ddd6daf584f68cb712a3f5f00bd4051d6f5020279030f900b8
-
Filesize
392B
MD59a97d43f3e7054979fb3c59bb1da60d0
SHA17633bb4e327f1c5eb51decfa67ff84d9af0d7ef4
SHA2566503b2e6bb66549f0b4de2d8505cd7ccc0ff6f22ec92c5f71a4d0a5aa0da2e7b
SHA512b513b0bc2ea280c7f00f8d5c709ded8aeea3ac80bff971a2f250dcb803fdf9ae66d9579d3044290de8283423ed611e82042cc5ef940814edc086f7b6d44500da
-
Filesize
392B
MD5e2af639053cd0b3963f09679ab7da28f
SHA16f4586a43067b54547a5a54278b569507f9adcec
SHA256c7cbf3e4d7d2c98b2a41811298145180ad3e7ab0ac8cd259d55e3cc00edebf4e
SHA512a57a48d3ef5f8d0b85ec79a40de247dc83c7f6ce1ae5b0d7549ddaf434a0798aab0d0fbf41caf847d54469a894f2431f1284c93a72f53e603cfa8deee6bee411
-
Filesize
392B
MD53a0590578c9780bb66aa6845b8348d61
SHA136e61957f1c4e223756b44ab98840bb2f93c26f4
SHA256771cfb55049a8e02e4513e05564ff576c630c042d1dc4be47cff462d692ad472
SHA512056b83e3be1d2c045bc02885e6255f04fcc2fc910d344b3e476f126c9a22b9503b6fafb0c838ad09ca3f4aa759c7b0ef153626e5270fbee830608bedb91c3c12
-
Filesize
392B
MD5f4a9b6a8ac0aee49f6ec21775bfd2f81
SHA1f908c96d9ad7bfbcccc96383c17c41dfff950c8a
SHA256a845ffaa2f5c06f9b5db745dc3a73896c167f570859f3307972b0ca175458693
SHA51287774d1a331c3a021bac0b1b07b4e3fb7edb11a2fa954c57fae66b8059822d7fed7efe1fb4078b1a51b07b796d03a2ae5a5a0d0129e0501e041815b2d977d21a
-
Filesize
392B
MD57a5aca1a242fa4c0014af89ba9f8f835
SHA195d54705222dd54c4ad3db4cb1aa1441e4ca6663
SHA256fb19348296fcd52def7a0919853e2dcbaaac76cfa6119fbef53f8a829e7265fb
SHA51214c0dab19c61001f50773a09703b68eaff0cce6062431a858374a25166f794d1e650250d2567a09d9848824f4133d14b7d6d7bcd11f709b46eeac3bd7a6409d1
-
Filesize
392B
MD5cb053be66da55d29cb4fb94a8ff5fdb7
SHA12f0f085f2041edd9ae1ca49c1fa0f0d6353a4ade
SHA25649e368f59f2dac45dd516e0d611a3a2ede95ad3d9debff2d9d4b4d8838cd1106
SHA5121c690d7885c717ea17572faa1e9400c8fca2fdecac3c9cea0486300ff1ec5be46f744c82dc07bee29094d255e3c67ed658cd4487b6ae4820e70d43f14817e0dc
-
Filesize
392B
MD5a3e8ba1dcdbc08ec6919d8fa716dae68
SHA100be94fd12e3f7462c2e42dc1685c7f7cbe369e1
SHA25617a246179840f3e1899aa5a27b4f78f6ce25fb4c8ddcde2f41e7bbe469343e17
SHA5122acd96192a18547a68d5662f0bf704069b0e8d2ec30a6746349e9137cd47d1e26b63a8d478fb1a110c6fb22dd1bae19bccf5dd0234442a36e2a998e309992b79
-
Filesize
392B
MD56b1e1c23e9312ec7cda86c7c35e6f3b2
SHA1bd45437d464a36a0bfded38b264643f28c32d99c
SHA25644b3f680927813b10647c5228f1773eddb9fb042068946dd2501f2146163e9d2
SHA51217e1aa85f8fa5949f178625220c11c3e10dfab2c29fa5a28001870a06f0f88f58f5a439e5dad209c376ba109cd884890ce1bd1a20bc91338cfdace699ffc9360
-
Filesize
392B
MD503a6b49d0fa2e39aabdab20a782ccc62
SHA1f3c0081fab4e58faec99249aea29f4b463d6321b
SHA256b10c8589b8560303f256d54ed223131a18906a5d813f1e8ca8cab2624b4f6bef
SHA5125cf7c3dc282154e638a77a3c3f5b20912a58af1b8ae81ec57aed944c569dde8a29e8f627f7b0fde5f0d987765fe1ab71c206303c28f0efe24546ffadf7e49875
-
Filesize
392B
MD57884ca9acb6519e0fb947f54ff9f8c17
SHA1ba4cbdf57914f0054fd39472a37f15741362547b
SHA2563b13283d0403884e2a866adfd3c68786ff9b876de3408d6a3ad3c53d31901b63
SHA512298bd9173ae5d0a79a87948476aa4672f897b8e890e57d4baa5c145a86ceb9c38156c5db04dd94aecea255da77209904fa8844d95ebf2f73808bfca7bbbd5963
-
Filesize
392B
MD597955d91bbdd3ac1311feb51cb892212
SHA16916fda05607abcb926cafa836847e1e299fadf3
SHA256f9809242e480397d060ff1d876959d849c18c3451b1a05455f7c525a41328d4a
SHA512b2bd1b68ab4ea1afcc68b296061d4fd1bf57b0688ca1f9390d096599e60fb6874a0e549c35ede51d5352f591ca19b8386f97540f6d5aee74ee2a365285d92b77
-
Filesize
392B
MD5ccaf0eb9e5911f716bbc25a6664ee414
SHA1b23d60e4a280fadbff40cf27c40dc4950ea638a4
SHA256ba8fadaea48f1c589dc8e843be8fc13bb6f749d7f0bdfc883ceaad06f400a690
SHA51224fc06cc437f335b91ae537ee08def191ff71754e3da1369536ec6b32ff5347eedf49728670a2af95333c3cded13650677997ae38a4a6ae3b089c149fbe3717c
-
Filesize
392B
MD50767a78a7fabfc8db2e3e99391898d66
SHA14373daa8842dc3bf4d5a98b3f8382478fd586a36
SHA25683999c46827c13162fbf5622b1eb77a5065b040de7b2947876b76941128345cc
SHA5127ddd693425378223d503b1d0f0bb5b0382871c772d77bdd5486ca6e2ee82d911644a7bfff65d70b156b9d7ac813dc6848d48a40bd5b859b75f9ff1ef7aa0893c
-
Filesize
392B
MD5fd95601ee5192223067c65dbbe63c7fb
SHA1adee815fa2cfed1e15688439ddeed7b2806bb403
SHA2561535768cc86a97dceda423400091b86972aa4fc2257afae7f2429acdb8b6e740
SHA5124fcc296862660ac77e038d4eeedf73c78bf6c220255a685ed92e160f72898a994c73dfa28a0b59505e7d9574a4a415fd1b70059a08377da06622a62dfbefed02
-
Filesize
392B
MD59ef7cded1cdccb26150182f21aaf67d9
SHA10881986827bb86b512684896488457ef4c6eb8c5
SHA256c5180dee9727753b48db179043ff4884f925d18dc24293fc1dff8427f2d537d9
SHA512b3d4c457dba7e31fd87233664449298e0a947604e166396f72083e73fbbea65e84c366e68242be6ba1e7b1d943c1c9ae164a44759712877ac9a50a8569fd8e40
-
Filesize
392B
MD562740ef4b8516bd5330ce5bf7f607838
SHA17b56f22aedcd5faa6322e40fa36d032df3809c95
SHA25653f69499960b8c57170ba947186d7839d922cb4ad555690263455b51d5bfff57
SHA5126d84e63e9b359f98b4eca5319b9ccd4af0779034c62d4094e9d95e7c9346a6b9f72399ef1ef23c04396c2aa07a54263daa8727ea837bf5a8f61cc48f2d1fc460
-
Filesize
392B
MD5b1157c92b9f8a5482706c224bec3fef3
SHA1fc469ceee2a148111068d48980e9b804ac9b0544
SHA256366abb1e568dacf4ceb0d09791d6c7bd41a93bc4750e1b7b62e768b682f09a65
SHA512a7d434d650d1ce1996911a21220c430af78ef43f9499f5a94933c23224b3190986f9c1f7c320f79d87ef8457ef56a640bf513243d9ee85326e2ec240151aa2aa
-
Filesize
392B
MD5f597f419356b0cd89e1d35b0d1c97e84
SHA19bd484d19b85c91c5847fc901113166afb761b0a
SHA25693b5504727a999c99f258c5890cadcd2d602748884517ceed6633dbde64e94d6
SHA512c0983ba7f924a1cb69ea02c4ad53b72bc53ffd262d5b52b5670a27eda5a4c8cb4a8a975a589b7847445495844da7eedf6323a9e29f7edbccc9a6bb6e4e0ec8fe
-
Filesize
392B
MD50542d3e949ffef0ceb729dad2cd0cc2e
SHA12da95fb82f32a05d5fd4826d399efff3522e1c06
SHA2560040668d96cb4db7c859fd8fa57cc64534ba7b19baa8fe3f6802c89b138c99ee
SHA51224049530b612073bf62b8076d4cf556219749d7ce372e76ac90d086c4df0c114a26dc214bc22c36e66d507f5b16e054ffd49ecc70313f8e37b40cb211c90d68d
-
Filesize
392B
MD591e97c0268fa9426d274d853a619be96
SHA1c48957ef60ace99890337242d025d8c914748bf8
SHA2565f7eb1e80c47004659e38717ed0b77f4f3eed4b3bc00202488c5cbf577912612
SHA5124779ac1c9d7ab7088e3cfc12ff9093c6d1de2a26b6e94c830a5871eff7a3328b480d625cef9bbe5acfe572ab32f17d864e756029307e770e8ed7a6b4c909f705
-
Filesize
392B
MD515a413364c8991340eb16421a331fd76
SHA1dee331b00ec38f70ad8acc4dec8831125da139e7
SHA25694dbcc3d72fa10b1839a366729dd8263c2b1edf4fec0f328e4000bd1430efd2b
SHA51214dcb8ca98f9d377efe17b460a542d363df67d81d5844497b0fe3b8c28b5a3bf2f1b76759d4ed5b946d56ea5398aa603b62ed71a154d8643d5dbca916711adeb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json
Filesize6KB
MD5bef4f9f856321c6dccb47a61f605e823
SHA18e60af5b17ed70db0505d7e1647a8bc9f7612939
SHA256fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5
SHA512bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Webstore Downloads\pefhciejnkgdgoahgfeklebcbpmhnhhd_10612.crx
Filesize4.8MB
MD5748094ecccb0eabb8c6665e0e2e1ec27
SHA16fd0beb6bcde865014aac13ba1055d9bc9aad455
SHA25654238965c3511d177c46b8a7662294767a3394ed9d6155496d73d6bdb7023f0f
SHA512ed46b3ac2c0c142267fa87bd76ea1fd7834c39c89503356231654aa871a0fe1b49d8589b34f5b6ad6d74c4bac75621f1f001ec3dfe401e2653d51ec1c1f2632f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Webstore Downloads\pefhciejnkgdgoahgfeklebcbpmhnhhd_10612.crx:Zone.Identifier
Filesize26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Filesize2KB
MD5499d9e568b96e759959dc69635470211
SHA12462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA25698252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
SHA5123a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\U8Z0WMOI\www.bing[1].xml
Filesize15KB
MD5b3d5e96870345e4690758dd2a0f3f906
SHA183e56649debd3e74dfc9988398f7fa865df467e3
SHA2564c81cb7beb2affd45e5297d06beec68c4ce85de6e8db226928828c41f0da12a6
SHA5126bbce5c04d9a9138ce216731520100e3bc57b5768a426997c7345e94c435b3597669fb65b5fb4465a22e54324a1c0df3493abd7ae2e4c82fd3e851c606f7fb1e
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133875101605625531.txt
Filesize87KB
MD5abce8c514ad40ef28ddba0209b661dc9
SHA12d220c5632096b964c1b750846dad88bb6e1e437
SHA256ecbf4574e5625b677a225bcb291fc2dca5cbf2d428148ff96d05d2e16e79a962
SHA51248a705c0b151c12f4206ab2bbe7597a833dd20ce540d5f12a17d7ea3d476e20fc66d3ca0a3e40b25eb214552e7eeb4ba70ea934d17c1a56b5f0e637468fcf80f
-
Filesize
386KB
MD532b7f8325723626fd47948e959050430
SHA1cb701be09cceb500567655bcd6070324d5d850e6
SHA2564f910a10791ed4a6650b73dbf79050f466d143b465c1197fb392861de8412de4
SHA512efc15b63a2e6987b705d56fa4e442f786edd0a23bc7e3b1a5b62a9b0c9342dc6fa46f7e69ac300ddcf86e3f95bbcac527712a4fe546ab37fab824c2d544bff7d
-
Filesize
152KB
MD5dd9bf8448d3ddcfd067967f01e8bf6d7
SHA1d7829475b2bd6a3baa8fabfaf39af57c6439b35e
SHA256fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72
SHA51265347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de
-
Filesize
652KB
MD5489b09ce6969dee31a4032c8c9bd34ad
SHA17479876e46be8e93b7dee5b37be25a13b2aaaf60
SHA2569046cb510b8472ccf6243ffd430b6e14314af3bc9113e3be133383751fdf915d
SHA5129e8aa19ab3fa7f054bc6a12f665311e127e08fd99113a32af69205e00485c9427f9cdf070b5d16aef848b77c678486d2cd049bb61647a7c4044e264ee7c7b363
-
Filesize
10KB
MD578e47dda17341bed7be45dccfd89ac87
SHA11afde30e46997452d11e4a2adbbf35cce7a1404f
SHA25667d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
SHA5129574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
-
Filesize
797KB
MD55813f14260adb068f4b289003dc97fef
SHA16272ede715ece3893f02b59267c766446e2b20a8
SHA2560f7c252831041c590b60f1ca997750c58a8f10a1b1aa8a7b4ad8ce844c7e413f
SHA512d88b9fd1e6994e55ce9a190e68a7117004d622dc81bc8027bdf1bf03eca419acaa8d87fcc3284ca5fc0ec6ee3a0768e4276f019d7e60c61392affd5fc9637b44
-
Filesize
1B
MD55058f1af8388633f609cadb75a75dc9d
SHA13a52ce780950d4d969792a2559cd519d7ee8c727
SHA256cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
SHA5120b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
-
Filesize
127KB
MD56bf5d0912f3efbb5ae444588f2297552
SHA182e57be3298a2e6ae2105807d4996fa74958bbd7
SHA2568b63bf51a35540e6fb811c4d449df16eff86c4a4fe6b86191b575c302902eb3e
SHA5127f9d7977fe83131fe82e084199899b322f518e316daa16313c207e07b156ab8fcb54856cef23a91753527d62c4101ac920b1fae1f6f72307f1535404542e9da2
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir5280_214923297\CRX_INSTALL\assets\index.ts-loader-6484aef5.js
Filesize341B
MD550a0826f95d1278fed08122205d3b889
SHA129759d060605c46df5261283c25ba063c6ee2db7
SHA2566484aef5fd0d645239932e1668f17b8c88accfe7ed2b5325b1f6ae3fb7d353fa
SHA512f5f6cb6e48faadf207b8344108075dc232545dd5cc9c87ea336bedfe60049de0e903780e235ba1a2677daa1acd74a32b2ee97d752206ed685583d2bc34359baf
-
C:\Users\Admin\AppData\Local\Temp\scoped_dir5280_577443417\CRX_INSTALL\dist\contentScripts\index.global.js
Filesize460KB
MD5881f74023799458887b2d6e46ec37e19
SHA12a8db9856738f56046eae3f62b4390d3c2dbe5c7
SHA25622d69ed2a117b18629cfb4f16b2b5d5004f081d9993a52645fc0e8610014cbf9
SHA5120a4e12a77a3c77bef1eb17e4b653f6648a3cf5466b22ff1e7ea011cc73f33492404df6a34cb75476bf43d9f20d03b5103760fdf115b8f0d59cc89b1800d2cb60
-
Filesize
323B
MD53f103efd4f66692e4c860dae1388449b
SHA1db72b6a5c269226fc24a42ea03e0a181857b929e
SHA25694f7abca55b8cf1a466e705fd24bc8e16a4efe0fbd60d934dfc274e6440d8e69
SHA512eb609b79551d2140c7ed503b8dabf09f8c18a759d6768a3abeda1b06e7d6a28079cb1a25178a6ae0405af3dad892fcdf0ebeb0f4fc3675009a46a8301a01f79a
-
Filesize
638KB
MD569b8dd8af2173d5a4e53ce3eb134ccae
SHA14bd4ded042e488adc4c4a3f2d0127f9fbaceeb6c
SHA25668fdee31562eeed89509bff3372b52c4f665825c918932ec7aca741676ebb510
SHA5122f8772592ef36e6ae435909ecf2b4324bad5b9d1a259b6234300d9b261553e35e52a62b234340850464d24f44e6306bd03f426e4ea0e4fcf24c1ecba8d1fadaa
-
Filesize
40B
MD5d5f94738fc806343036e88611fe2a7dd
SHA15347e67c037016ba43626a8fa64913d95f079d02
SHA25692028cd894596a9f46ed11d9c1b91d451b012fba8b0d8a2a8fcc678635df6515
SHA512503a18b1a8199dc05e6fc6fe3a909780d174c474a9837f9a6e3ce141a19a7f05bda07d785a074792d5fce7959d10e4f2a3402b4355397cb1181febde7dc387c5
-
Filesize
13KB
MD523796e7a9396f1f199d44533186a050a
SHA184ff8d95254072bcf0c56550acdad0aa48d7e8a6
SHA2569802877b4d04815fa39bdd167e32c8fb528eb1845c143ab5b6b03cf9a369d301
SHA512208714774397df21dfd7cc42d0d26b59879d80312d2d8eced729b93451af576802adb476a71b815e4edd63e15531a03af97e8cd1bde37e102b8d858b680fb560
-
Filesize
173KB
MD5c30a3e8f3e6a8a236cdc1d58adea97c4
SHA1088c616ddd1e0ac605a0cde72f91b484db404853
SHA2563f6c91bbb2b842af6d53144f0767f6db735a7b7706e1c40e6bed7c4ce2a0a9fb
SHA512d83e01aea95d890a1dd6ab1fb006f6b58e975af87078edbce844b5dcaf972735064a36c5098cebdf14efbbfc5c7dd5d3840af760eca7564f96137c6f2fac5cc4
-
Filesize
28KB
MD5098cac260210a0af165bb3126dfb750b
SHA11898dd339cd33796b2baf327c682abf03da5a7cf
SHA2568a4cff5ffe092712c735e96f97f5de822ef91ef67a72af45bfe373875f2301a3
SHA512e6e565fab51d971ac5953267a4e26fe3fb5675f3801afdc54ce2b2762a04ff02721de2983e3d4fcce1d7a07b92123288224116a429b9a12200bd4092326af6ff
-
Filesize
888B
MD5eebc5beeddbeb2a4d62813189c5c4b29
SHA18741f4d95c59b1c4e8706b1515a40c86cbfeb754
SHA2563fd8f54c0d3d73cbdff69ea577f5baaf0c4c25ef62badc350eed668210698ff9
SHA512e7bc1e9c30527c0227321868991a47183e6c1d7479238bdd478aeb5495f9cc8441f27ec80690d359efb335e298355282f5979cdb065f1c66ff6b85652ed9e0bd
-
Filesize
888B
MD58a7d98dc6bafbffa1defc5dc5dcc00ec
SHA13da49ca98cb6820b85bbf8e4ed1e94c6915b090d
SHA256e941cd88e477c9293a819abd80d238fb9ec74c7651c5e181cdb4e706c07ad456
SHA51239f8c534fc8a106bb775e10e445efe90543d25e80837bc04afefc192b1968ee8dab856ace3ab380e7f91b4abc1b20c7573b4fc93e0941793c3a50716787777dd
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5be03b.TMP
Filesize48B
MD587e498244c9af9235521fd72f3cc8b45
SHA17f4ef1d549c19cb2023b38d762af33adb931a336
SHA2561290aed2fc54c89e995fbe701093742e631aa745d3da9a726054df2d5ed013d9
SHA51231848976a30b1a7724cd7cf43b97955a91bc731e2d9e31ece02bbc24b1b09c87554728195eed600121c5be2f196720a576a6fc1416588d5a1d78371bd469b62b
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\assets\index.ts-4036d7dc.js
Filesize74KB
MD5239c3f8749670a288b249e2f8a39140e
SHA1ae3597c04fb487e1fcf52d16a46990a2b35408e8
SHA2565b35ebbd4698d711ff122cdf5d30358e9fa2a6e7b5d6ea08d6b50fc804556010
SHA512a7487206a2eca18e8e5652ecefc289de3efabf8d47d9552b50a055fa56c022c1171dd31e7d9b2ebf847125f05255918d2ef555c77d49997ec3ddb035e1324afd
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\assets\index.ts-df6d84d0.js
Filesize17KB
MD54226f557d9bb9492182cfd0d6481aeaf
SHA1af8799fcf752075c3507b810e1f714ff13c906ea
SHA256721e1641b8262f6aee45167cca277162db83ae0f9fcc28f4ce29ad268bc8235d
SHA512f71ea60034857d16329657913b95b59352226d14ced4ed75ba09badd5a39d176ddc1ee8514c9aad63f6180c207bb428669058be2ac081fe9b64856475b1a1f9a
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\assets\messages-86fb7e29.js
Filesize21KB
MD56d62c5de88a2381b5627e0d2df7b9a30
SHA108c76dfb73e09780b0b3f98e5da414494904417e
SHA256068f97ff81dc092e4d201f575a2d330a0f5830e847edc6e0e80f8a97684ba75f
SHA512a193d284bc5c017353e8ce1a51f2449e2e58f0f35fbfbe8173f812bfaa91840f2cdede70897c64d271601f8836ef4f694dc099c2271c18b448b9892e5043e291
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\manifest.json
Filesize1KB
MD50abd6801ccfc67059c72828f8a2b88c4
SHA1dd31000b017b617624ef5da552bbdb74c71b3346
SHA2562923584fb829d6cc869a1b43ba67adb760283cb979f8d4e1282cb4f858b26763
SHA5121b021fa84181c1038251228144cd25420d59d74fe90e24ff0f6c82d7d1e00cd5dab8be78c11a4d778f4cbaf37a91d047e80936a77ef06ccef32160e2c5a4bd95
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\service-worker-loader.js
Filesize40B
MD597cccc87d903a7d679b5da853081fded
SHA15175b566666cccd0206c72d801e837ac4eb7a852
SHA256bbcb29de568773afda20d2379a89ad01378a2aa2b53c8ad95b1ad6198f4f09a1
SHA51212991a3fad71c15dbb3d13af478b325b301e6ab3e51f645b3521c9e63068e5e9401d3e181f657ced4df9bbec4589d4db20a81de5f0068c0395828c07dd09ae15
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\icons\icon-128.png
Filesize3KB
MD5af719a0c95789b088fe4b9f82dd5ee98
SHA1cca49d2a728cd456b450cfcc20f91acf781c3105
SHA2565b861963c613fca1dc4aac9a416e43b2165b05a4277478f74b7f6562a378ff5f
SHA5124a6f77684b3bc459897ab2709754849868bac64f4e099c1e74970339c944738278454d6c043ee8a2a0337e9891e7e7126bfc41e6fb0f5fac544b978ae36f5082
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\icons\icon-16.png
Filesize425B
MD546c4711e8452178b9c2471f9c59c2667
SHA1e020f7ba4a787f840d204525e8eeb21d0c21e2be
SHA2564e1aed06fc4105c64aabe9580069d0cdeec3464a693241e7c02771e1beda860f
SHA51242f2161205f28003aff9ea4a8bb33a0a0ebbdbb9bb5e9446efbca4f000a4315b2bf7184d79254c148da40597cc15bf8f22a02a3da78cf5c9026ae35e4bd695bd
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\icons\icon-32.png
Filesize764B
MD59caefef512720012470700a11b0bd456
SHA1bfc11bafa996fbbce1566a569a79d5d72b08f1e5
SHA25682c0a843e1df5cc10a8c6beabee8416281aa89c73798d7bb6a2cf4a237a24ae0
SHA5123bb42b23babd54cb902e595b84a398ad5b2c9bd2e4bd4951a8b0cdfdbf91f6d0e04bb1fa944c54d673babdbcf0400c1947d0e12fba8057c3f69ab1e61b89aea1
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\icons\icon-48.png
Filesize1KB
MD52184400582c25500a74577359a1f7e7b
SHA1e69eecf84f7d2d98bf236edbcfc143fa42d01bc3
SHA256c6c3593c7d0af5c9a7f2e26b98ef2629e392c5da87df80653d94ebe412d5c9c0
SHA51224858ebec11fc0bb586eb2d6f555f5e798ec9708ad89b0a94957a1537dc150a584b70865d7fed53d3f122789812d390eb6af6b68ff4cd93296b2b0e5a21b103f
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\images\adblocker-bg-1.png
Filesize16KB
MD5404ead15b3040c2a16cada6a18088aab
SHA157d6d1b3d601532d1825c738ee51d0971f137af8
SHA256bd474396ecae2864798b9b33062afe3b599dc834db30b6a2f4cff0d0cbb9f9b8
SHA51212173b41f487987aceac82c13f63b1318107c48d6803dc1f89053245c1c08d092761399ab397da44f0ccca5d9ee3c79ab98081cbdb25a78ab5b97f0b52a4f784
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\images\weather-bg-1.png
Filesize68KB
MD58f158754f161c02baf061d230c993455
SHA141b21d1c3e2aa029ecc77dd6aa5b174d0eab34bf
SHA2560055b3b2ca2078823b01d4cf064d4ebfac5cbce03fa38c8b5e920b92b3b47f6e
SHA5128e417897690aa540ffde4ecc541a7a0a7071f355b6b663601647e6099f67310f540a40b12f6c0a2984965123d9ff3ac9e78f0be7b4abe2d6bc9ae941fd869106
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\images\[email protected]
Filesize234KB
MD5d336d499edc3d7205948e09647ab5826
SHA1797b756310da1f67d3df61c821377992a305cb6f
SHA25663f3d2622f4927d830412c8b089dfbdc77dbb880f9c49f072c6c8dc0b3cdbd00
SHA512fc0d6b3c8ae83f3db7c5f9ed4a999b090b2a1e8fd80f4b91ce1a42f804cf8c8c49d03dc0f362617c0df130a7b607b5ffe36fdc0edfa5f4a18b308a4a66ca8472
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\images\weather-qr-1.png
Filesize5KB
MD55cdc09bfeb0cc136c4b8e45114c8b910
SHA19d15f710e94409fc854c30630d70c66959871410
SHA25670697bb3558c12efe9b34ca34b05ff39dadae04df9e4928e0de6811b3efb3a99
SHA51229b8d495506291d46554e0a3951cdcd6fcd5f3c43fb52ac15c4bc13180d88fe91495c616c3e12a2c7edb7a2d64f90c391faa539199ba7532c45fcb827270e131
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\Temp\scoped_dir5280_1740938157\CRX_INSTALL\src\assets\images\[email protected]
Filesize6KB
MD5e86f7685206ae12b271a4c50620f1f81
SHA1b5a96bdd23787dc994406c408c8db08cccffa646
SHA25628cb433c90e6ca9cfa6aaeb6ec60ee2c98d02a255d671c7c47689f9799cdd14f
SHA512fa2fb8ca2050b13193898a48da639673e706b156b666e8159b6a71d417aca7490c4faa8953776fded46226c7ac0b6465c44729cb452fd93fc961ca2bcbaedbba
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Extensions\hbgjioklmpbdmemlmbkfckopochbgjpl\1.0.0_0\preferences_schema.json
Filesize7KB
MD5a192304f63ef26c80086f835cc4b7ada
SHA16963e90e752209132b728a938844c4c64dc94d43
SHA2564f72309f9378f04b3f1cb8f46b031ff513ac63e5056d96272f2bdc6d39dcddf9
SHA512be619909cd0c3465966a4018847310c1493bfdecad6f07bb28293f3dcea73dc377f5d52cca040d626368e17828eae28384fe51d20c4a71925c5f31eea8e18561
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_cmedgpckncgempanpegahopilddagioh_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\000003.log
Filesize24KB
MD5aac8f98bd4704ca4bc3824f3942d3dac
SHA108be8c605ce4d6ef563badd2ca1fe9da6afaeaea
SHA25665c6e778531a181d4b96ef87421e3649cd34e7b58fe33fcc80ff72140c6b7573
SHA5121c2a6afbe622e6233ef2c642cac8c24bc8aa5002d5686b4b6dc3a0245131dc40992a7972c96b332591b4fdcbbe1df95bb47c2043bcf22f73da97f280720bdbca
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG
Filesize444B
MD5b04b34b42940e36428fdbe9dc3ebda15
SHA1641ba07f1020bd2937b4849e744692327e756b9b
SHA2561ce55294abf1ea1d76d5533b4916a05e2dfbc7a814a2937ce4e371742ecdf5ef
SHA512d3bc62a7896da815681edd66ac1cb858136ab320a8538b8efdb0f6a6368be1aac84314e03eb0928e5936124382c6c124889d4665e6d2cbee7a40557dc1d1de51
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG
Filesize444B
MD55004830a9aea4b387c71c3a0529d9676
SHA11286a7f1ecb596500d581e4246c622eb3bb288dc
SHA2565f1dbcc401f2a6567680ba57c10213def071653bf6d9383f4b72ca5a048ee1bb
SHA51200ccf5c91a206023e578240356560a110e1bae464e36ff8ad5f55619c4ed3b1fa46db4c451111d149bf28fa3602e3b27db7c9cdd554204fc6493f27ee69adf12
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG
Filesize444B
MD58e4795c99db2cce39bb5de13eaa9e92d
SHA10ab55aeb6b517c5c3a5ce2452c5b8cd12edbb1d7
SHA25609f3c802483d8a8de199b0e95e68ff3495cf95d36ba1582012e243b6f57afabf
SHA5120dbb511e57a9a81aa978a496c411ee29085b5c094700c9c26added6d48520eb9702c2cfb199205bb11294ceb4b62003185a1eee528d57be1c68fb75497d3133f
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG
Filesize444B
MD5057c3d9237e7db84be508a1025dce79c
SHA1133b355ca9b032742e067da3ae764385175c87d8
SHA2569c1435aeee32768dc163431871df2ab8fa0f2e05b34f31f1766091167147a67b
SHA512a323c173293893d9d4d8caeac58662271b4886bf3d76972afd45b54f92e43b34443fc5eb5f2c02725188f84f3c514de80dfb8f78ff1963dde705705b6dd08296
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG
Filesize444B
MD5ab116b1ee70bdc871ce159b65c1ac4a5
SHA16263decfacb4edbcf8436df2fe8938e6bdadf757
SHA256117ac724830641e178fd5169f4118e54cf2691c7eccbb073ba01448ed005e3ae
SHA5126b781cc1e0491417b952beef878eb70afacdf63b634a33fe183035be050181d97fda2f29f054504558f97391d2eb9302250b0c0f36636572ff3c21c47b78ee6f
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG
Filesize444B
MD5937db8c083af38245a5407f4c60c8595
SHA13062cad17cd844b2f12ccd642423d5c36850334e
SHA2569fbeed86ad69fdb37d10a7d4257d6bfbf021551dcb714434157059784fc5d8f7
SHA5122f9fb81511d1fb763a13e2067eab38cc3a40c86ed4d3987a71a4e21882c20bbc73834c7f0a1b91695418d7c14ad7a2a73f89531eb724d97326891753fed3e83a
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\IndexedDB\chrome-extension_gbohaofhodnpniflcnancekmknlomeck_0.indexeddb.leveldb\LOG.old
Filesize403B
MD53937eb9adcceeb991d0b5a430f017168
SHA1c2808179b973121c6c9432025f3a23f7511bc668
SHA25687f23820e24071464111d7197e1a3352034e72a07efb2ac0e80147d6903a8c91
SHA51289e6bdd212aa94a6251e6662b475489af66c917a7f38f34972134d54678f8a18580e1d883aecca56fda16de5a03e4974e6ea4695e871111e27b27d367ec28eaf
-
Filesize
10KB
MD584d961291c5a0853565e0cc2b794c1ca
SHA144e72a818146659149d85b783cfc0e06e65f68c6
SHA2561ca61342d69c72c4457b143c3949a6b844b9d8e500b8e2c08f6e5da4fdfe33be
SHA5123f3d39031a810af47fcd4c5468ed68d3044bf9f1dc0c765efc6f0deec47198178a6a2778bcc04d83eeff43358e4f7763b718c5cb5227238c0c6b1f1ea41fdf29
-
Filesize
59B
MD52800881c775077e1c4b6e06bf4676de4
SHA12873631068c8b3b9495638c865915be822442c8b
SHA256226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
-
Filesize
7KB
MD5eafdd44b35d7dc7431c07f7c3fb1f19f
SHA13252e1caa8db652de546ea2b654bcc462510780d
SHA2565f576cc244d5606e7e864bab9d3bec0f33cefebebb60f6d6f1a49f310bb2dd14
SHA512c4907ea906a1387ed9c75ae61f4fc4b4cd246743db5bcb64328b4a55c5910ea1f13b5a3910900800caa7d14d71b1765fe3c779c997bdd28e0a13dd88da8c270a
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Network\Network Persistent State~RFe5b8de5.TMP
Filesize59B
MD578bfcecb05ed1904edce3b60cb5c7e62
SHA1bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA256c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
SHA5122420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
-
Filesize
1KB
MD523ce6ff9d066148a8591106d9a119e91
SHA11b05c3cf3b88d2ff4d27cdb3ad03edb129601415
SHA256e4c91d7671f7f60ba80e30f51f5b80d14106df8799864f191df6e56718cf4e65
SHA5129b76906c24a6bf87495e9f8a420eb880647905a0d99f85d360890270cbde79c735c3785946fb8a6d6dce9ac1ff477784840f211c60bed282541eb2de04673775
-
Filesize
1KB
MD5d526d24577b28b550e84150527fec49e
SHA1b7f46325c5b09eefa9fe1a6d83fd891475a6aeea
SHA256757a2844592ad68986fed4bcd8a7186e3833a13ba75846b3c4083568be708b92
SHA512d2f8d0b82f186402e395b2420afa4d2d80d98f552792ae09c44b811f741a98bc7e81a2cde11a6165fdac77e4698b75228f787c2f9bb78c1edf13896618c3aa51
-
Filesize
1KB
MD50624950040677aa3ad8360434e8ebd0a
SHA1019f357767253c6a4580939f249378fe65622c01
SHA25628423940d96d14df2ec464c796632aa24a11c925fcd1c7abf707c1d4da99d174
SHA5122df0470c21cb683403d8520c51ccd389ef603b7ddf5cd1c9377a517872095f11440283f21693a96e5e061d277ab4f87f657b2876a5db92dc519b938d2dfb65e5
-
Filesize
1KB
MD5e00861f07420058962747a3fa51c3b42
SHA1e0d36e5746d3b0d49989ea8b2d534d6fa226adc8
SHA25665412748779b59a1a83d34ec5554137932a2af9e9a96ea9093e6edeb66d6470a
SHA5125f7f35ccb74522fb84aae8151dca43d1eba4b0951fbed26a6c9142f5a9ea55d7e733833b610c7bb487a17094a7fe608d455910047560930a6ea9b9b5e8ddf29d
-
Filesize
1KB
MD5e77c9c74f4bbd243c49db150d47549f5
SHA138e70f53e764cd45d4f84275e3595416b2d1f28f
SHA256789bd6782c886c38ba46e8cca9014a09e29f351113232d14f93565cf45584bf2
SHA512494a08d7970c0e27e7cb127f09121ee30b60d846eba93322ad311de96420f94c6b7fba071df9bc7d0ce5c70f48dad0cf03b8de613d2ea656078f3d4d7207d2de
-
Filesize
1KB
MD54d04c3fcdf5213388651c2eb2c560581
SHA1c3a465f10fd381d028acc5964bf11014b4593c31
SHA2560d366f110313ab7eb693429eb624640a178be6cc52de03991deead3ebe5a69c0
SHA51214ab523e8f1b2d915477c0c79ab30e92bb24fb697b4e8f4fb9cdcf12aab7b9b57fca2e7f8d82b581920093ab4f877e7485a676d198c0decca3ab287718b4419b
-
Filesize
1KB
MD5e120fb40c7a762b5a48fe2dcdb5f98ee
SHA1a40e60acc44d7a26d829581dbc6c7702d94cd360
SHA256f80be1b2784bc744eb75f20f3758875c3307c6d253c5498f02da9fc5e6dfdc1b
SHA5125a5194dc10570f4f6ab2cb413da54dccc96f5d22d63f0a2eab5b9dc3d3e994d97c3032a94436abe953a3b1c22ee0841d912ac8c551cffa437d8fcde44e1eff05
-
Filesize
1KB
MD56a55bded376bd8d007b5d415a6840c9f
SHA114018af7bbf9d42598db46201e70dcec03c79e5b
SHA2567634f64afd10cd8677cc1023ed86b9635796e7be1a0ff0fec35e4404a49df26f
SHA512fa15d8f678556946a1da4cebec7a3cc88c9cceaae1c01bf3b388342423571b8657717522a3510750dd6bfb2f682d8b8369a92860f0a07383a8bd9cd3428cdece
-
Filesize
1KB
MD5ef828803974cc8d09ddd2896b9dc722b
SHA180482de6bd344bd6f4b6c8046b29ab0ab99f4a13
SHA256f39a97d552b02e62280d940d988b0b45cc630dd5a91f27becb5497b4ff576b77
SHA5129fb6952497c5cf0331f1f6e94a95e1e3829cdec87e1a043943fd5fe7561d91cce8d96e73f674cb4b6f24d28478db54d6acd890122c7edf347270131b9f0a2137
-
Filesize
356B
MD58de4d874aec9626c6eb968e209149294
SHA15445b72b4c1f15210c0dbd991d5cefe030d27651
SHA256dbccaba98dbb6ea2478cc974d072f30f19179132c03f36f51543d6d8f73cb3f3
SHA5128fb1c0dd15ae7a7df8b2284bf81e3f01c893e4ef1928d03fcbf41290ae246ff692e947d255e6f0d64dbf20f2c3b12758396dfdf6a0ea9b824561a6a267fc5e0d
-
Filesize
17KB
MD5232575b0fe70ff7b9f27da8820c198cf
SHA17eb16ce63fe752d227005d503303e70e9d89e289
SHA25698addd9bf962528884c283c5b44e8e1d755a2e50eb8f45b122f4d4e7001d8990
SHA512754c0e97bfa9fba932231e19abc59fd73326fd5bae363bc33e330e6f8a3ad87f8acfba5801631c9dbea0f49d3b5f8050ea514bfa2acc4897c05f62ad71a7398f
-
Filesize
13KB
MD52c9347aafa57b0c47680f24d20724df5
SHA1bd7ea494ca701ed5b074daf069014defad58e18b
SHA256b3c73560ac15ca72e1b4972b471c1ca5283fab46cbf351662256c5757de1e9b7
SHA512ac8476a140742e7c24c5a1089e572836117feb1ca762345c7f2bafb703186144407e1fa0ab08131deabcbeac7f44b989b750ec3b7bdec6b154431bf3f5a126d0
-
Filesize
14KB
MD575e8175994a0f3a4ce170baca6d83a58
SHA14df51426c8475427904f3b0531fb926178657c91
SHA2566790f758a031d229fd10b0f4247ca956719ecd479cac787bfde00787c4001ce4
SHA5128648ff247cdf8c28bdc1ab9989884c50aeb3b56af6ec78204bb88bd976ee62b2ad910c2acc7d386ce7a8f229406287d028a2772d9330124981e60431610c5294
-
Filesize
17KB
MD5a0267785fb1773c69519989305d36931
SHA14ca70e78766cb944761b00b2f4f568ef2bc8f1d8
SHA256439bf1c12db7c6ec0bfa644ead20d9a9b06568b2709487c91874e337ea365dbf
SHA512c2d5a357a3734d56091815019e8539d9cae936ddbf1f63da947c6767b019841bc70dc3fbca2d1e4223a1fb738dd07a7540af16222f8f8b892cb934e8d18c9e61
-
Filesize
17KB
MD5a9f480b213e9dbffd700019cad5fa5e0
SHA124778e01dd37040ae2ed1350839c342a3988ce6c
SHA256f4f5eacc9636bf5055370ce1b4cb10ea0b23a7aaf28b3ceaa0e588dcb5301a06
SHA512d13f0a4d7ec620a868589c4f3162b3a2983c1bda8fefa809da3b25c58da2b24b1e382aecb71e0de58d60b998132540f5d9db813ed127694511b7f7b0d2f68c4a
-
Filesize
18KB
MD507b758ba9e934175cf285d220aa2fbba
SHA1d5cb12fa70ddff61e443108b3986b6ca5f471ce4
SHA25632d35cc8dcc81539606980b765085858fab8ca03e8ffd65390c894cffca40c4f
SHA512ce67f0fd14b9937a55b24497c66c94a0e5efdcdc0c845886efb96e9b8e2abedb115e75e54733e251928dc147debd858e670ac95fd74344a1ff5204b3006dbab8
-
Filesize
6KB
MD5473082b7dbc9c4d79d102e92d74c25c7
SHA16cd3da76e7f162244eef06f04167b98b13397993
SHA256ae3fa3c0a235dcd9db2c601ca126c1c36d1e019577ae4e80de1aa9c542ccc7a7
SHA5120c0b7e44f15798cc4a2f92d48bc2a0a03c11948ba817cefefe2b337495f5d8706173802658e784649a41624b2a3b4ff0a552a69070de3a3a2ed75c2767b5106e
-
Filesize
45KB
MD5a2855a11afbed1a9cdd5e7f298764f97
SHA1a79c44535033278230db9a4b105a0ab1112e2e50
SHA256ec4bdc1e5b72cb65e28bf7199a94ce29a234f8bff6d6cb115f0d3aa4386108a0
SHA5121891fc214455db51301e955dfb2b25ff35707f1d9650f55a84b16d70194f49317b49d32dfcb4ab6b65edbe72c6826cfa544b073c87cb2911ec8173865689753c
-
Filesize
13KB
MD59fdb4dbd9de374307840a30ef1d2f787
SHA16c39d24cf9e67171b327d4e4f72b91b623574a1d
SHA256a345df67ec0e5ca2e43273437f39f5a452b964b7169e0dd5903f3a85c38a3729
SHA512cd7ab374022aad2e82ffc93f5fc03b79423946b201cefde1a0cf00d42a65fa9dcbd1e0a2e4dff8e0f1e91b56dae84b84fff12f3ab0e83f971db74641c545a042
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Service Worker\ScriptCache\d0757ff92c7cde0a_0
Filesize168KB
MD586fda5f6e203706dd78adb8531f14c6c
SHA1f3072853b4da44af82db29254b9c805c7454731f
SHA25652813d12ed9d19d82febee10a7a2c90f0fbea6c6e473e46d62c7f105ad89786d
SHA5123dfdb7b12b379b8740bd1b603cc541093f895a36be908f11c94ddebbb13871f8f18892910de7f6289dcd5c0b1f6030db92623ffd165f817704359e9ed098610c
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Service Worker\ScriptCache\d0757ff92c7cde0a_1
Filesize372KB
MD5220047e7236070759bab8b1901141409
SHA17cbe9f148563213183cb449d49c3ca69b88f02b0
SHA2569516bffb93c1550b538169ba104dcd957124133eceb13339ef24c1e785a9403a
SHA512edec4dad824813692a024d58756788c9f04be09538ec8b3b1285a73e09a9e656f8ba0171c9320899a1216aafcc097eb37a498a502d9fc7d4ab30d4f42e382772
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Service Worker\ScriptCache\fa813c9ad67834ac_0
Filesize449B
MD55a186de3cd1aafb9941a0eeae887cd3e
SHA1daa9c1ce1b967ffab43c663073bb9205b7930c65
SHA25606192ff1c2be03d00aff4de6a4e3af56604e0740860fbfb31ab819c54ae770d4
SHA5125e6d1a3a36becbc3ced2ab3f114383848feeb345656c427dcd7f2d442e8d2884c1e861cc6c8fe4e951cbb143b52934cd6f1d5262b29a6030627c027456d1219c
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize264B
MD5edfb7884f85ee2bec9ada5dec677b448
SHA1d1d272a23eeae2ff62fe60eeeb4eeb33c21ecfb0
SHA2569856c11fa88e9afe292b2a44bfbf08569fcaf30d3a4316e59d3b5d24c1135266
SHA512f6a19462586371aa1eaceb1cd19492a6bc5a199551780495a23c5eda6c0d96c8ec015cce12222bb05b595a36247b42a6ea9c46acb8a008dff97dec9f11d40a6d
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5be9b1.TMP
Filesize48B
MD5d246c95e22fc979be31bfcf8511deac2
SHA1d613fbc5ab53570fdb5f729ba3baa11105ebc812
SHA256e6cdc45a00438232fe5a8bfa0199a5440c3218224b69bb67685cf143bc13f3b9
SHA512bc205914b27119e913a6678aa83745b07cd43451abc17e6918256e2856acb1055193159369f1b6696126ef143f93952508107cdfe5ecaa14fe96eddff7324129
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
7KB
MD5d28b6246cba1d78930d98b7b943d4fc0
SHA14936ebc7dbe0c2875046cac3a4dcaa35a7434740
SHA256239557f40c6f3a18673d220534b1a34289021142dc9ba0d438a3a678333a0ec6
SHA512b8dbebe85e6d720c36dbdae9395fb633fb7028fecc5292498ac89276ae87bd6de36288fbf858f3476e18033a430f503acf6280596449dd0478b6ab7139f3cea6
-
Filesize
8KB
MD5cf89d16bb9107c631daabf0c0ee58efb
SHA13ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA5128cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
-
Filesize
8KB
MD50962291d6d367570bee5454721c17e11
SHA159d10a893ef321a706a9255176761366115bedcb
SHA256ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
-
Filesize
8KB
MD541876349cb12d6db992f1309f22df3f0
SHA15cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
-
Filesize
264KB
MD5d0d388f3865d0523e451d6ba0be34cc4
SHA18571c6a52aacc2747c048e3419e5657b74612995
SHA256902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
SHA512376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
-
Filesize
11KB
MD5888571e2120874f3e5ed475505f9217b
SHA1f0fa661f2bafa1e2ea63f3fe745b9910c5d380df
SHA256a858832f9bf3d9843331dcaeae9ae7bf799d7226c6d41c290bb1b823213175e1
SHA512ba4a338046661a2e7ce08e03dbb3ee3d6a2f8052511c79b26a69a775fc40e7870f13f18201e470653fdab07da47409caa19fe2177f265192bbeb917a495eaa0c
-
Filesize
31KB
MD512a404369ea07453f32d4c58e3845bc8
SHA15e0e766b83c8435d2da04ee5aac322dbd8426e81
SHA25619314c47bf38384684445a046c9940716517cafdad4b801ca3a75e86afa62971
SHA51222cdad8c3df4186be41e3a7ec8175a02395ccfe06f6e7708c129346972bb73bc91b08124ea867999c87d252f902c5a68431165fd5f71a4ee5c5f119715704ce3
-
Filesize
8KB
MD5709e1ce95c8ba7594235ad8878674d85
SHA1247f22bb2ef02cdddb7be89900368cfc61d6ac96
SHA256a64df6bc3ab670b5f3905bf683de9af16424665f128c8ee21c05fa6e39e72928
SHA51244c404ee64e9811a79ed4df289c8ba28a99ae8ce7c05fa178afa7eb6f77677f41b25785e299e59679ba7f65f5ed99479b9f578134ece2a54343dbb04cd239aad
-
Filesize
5KB
MD5603a7ebd0bb56c83f6d61a889fcbf847
SHA11bfbcdca3216b9daff12bc71eec16b4e273c08fa
SHA25679056fbe36c0927355973624bd1bbbcc4fdbf584799545ba7a5aa516cd814e9d
SHA51211d288899f5a7666ddf8163052cfae710ee2d2e225f81d201a6e035fa755e74e9bcdb4ad1db0bd1648f443e988d2b82bc7c3b885298d2bdf1a6421ef39298211
-
Filesize
7KB
MD50230704d7d3a62050a04529e5b273b38
SHA1807a46c6b0bf7fd04e60a6dd0ee6276f2a784fe7
SHA256379a270511ffdc39aa3ac4fe0e594c3402892fe2a17e1252fe227d64711a723c
SHA512c3a0cd568305c101ad27d17cf2546c5475d339826952cef2f81b8c130b9b8c09b0c52b0904f18f4d08f65f5e274afdeb56ebe691205728f63ad3042a6baec417
-
Filesize
4KB
MD5b2118c20e1ff22dbaf8d11020a10956c
SHA1809e9b02aa9d8f6606a84a030518bb208f7465b6
SHA256167a7b09f3f7137259fb7002277e3346c455334a5c6af13fd9e853faaac3eac7
SHA51238b4b652d2bc795dcb4393f381d5d3686728ac7b02e3885a98b9b5b3331f00a0dadf4a43b3bb9fabee18a3d520f49375c78150f3a6ef1255c5be8ac8c7007d84
-
Filesize
141KB
MD557086b02f74c3fe7b79a5e2e3d852322
SHA16420387225ddcd5210175de4f3fdb0ab2be8ee9c
SHA256a1b5be8d4aab349aff58ed34e1f3bc6647cf440830da0a12a8bd5a1c976c6407
SHA512b195eb9a9129863e75be603b00b85ecfe46360910529fb38513af6940f9d17efd56f234b47963452329cd85b16bebb5a85ab5d304743e57d33bafd5b59900468
-
Filesize
11KB
MD5c176adf929e0d9e7e0ccf191b899da4e
SHA139170f660b7af2a7bde91fa637e979746094a2b9
SHA2566625651737a3707af89f06ba20f90bf4789ee52977e61145bc83aa7db96afb73
SHA512304c834e80ea3818ab1b16d8b73f77774253478a64031983629fd1335980e638a149ccbf5b7ba67b263bcc5326e3dc505042fef94d4f4c560097396a5bf569fa
-
C:\Users\Admin\AppData\Local\WaveBrowser\User Data\PrivacySandboxAttestationsPreloaded\2025.3.12.0\privacy-sandbox-attestations.dat
Filesize7KB
MD5ba9eb9f524a133feb268463ce7be918d
SHA1b91835a18402b8652939b5a25f8ddf1dbd0418a0
SHA2565103766f23c8fe7fd12dc97f4b8671bc954943bcecfca4842346e9f2f5fb27ad
SHA5128fc4b4c4eddc5ef2addad4fbc52a289c5f59018aad09a8891ae0f4457908153632b6575155a2256ea13754c1eb329ac9f93050316a3f27429b9cfac06d9725a0
-
Filesize
2KB
MD5e2f792c9e2dd86f39e8286b2ead2fc70
SHA18a32867614d2a23e473ed642056ded8e566687f9
SHA256ac354a4723aaa4f06bec385ddde4a4d0983ad51456f52b31a8068ec97d5b5ea7
SHA5126a7af0ca1efa65a89a9ca3b8df0d2e24f21d91673c60cdfeeb02d33647442b01d535497249542f40e66e0d2dd3e9f8ed1f4a201fd97138d07a2b71366737e580
-
Filesize
168KB
MD58a9fbbcb4b8c100c11db9c4a5d8470c5
SHA1924cf222cd4f8ac2f351a7a0c5a4bafb7ce342f6
SHA256127faf8b83a7677b8c9c65671055278147227b4f21b6cb7d26c5a1db9e16d818
SHA512c62990ad8b2a8a42642bb1185d365a9d3ab88afddc6a614f82497425e70ba16f494fbc07d5fb35be915fc0c507cb80c35e36fdf2c8569fef55c1c16fd6a66bfe
-
Filesize
33KB
MD50f83ea8aad2d94a32037e90f2812611d
SHA166a2879b881176df793c94f6833441fe153e5135
SHA256628b2de57b5dde868a30e9c45ffc6ff35a820c93a90d3f4ff61a1ff5396eaf54
SHA512e676aa774c099e43c00ecd42d2f10ae194910d9b694629abdba763aefc1d2c541cb1133ad3bf74df08fc6f8fb32b3f3047c07375977ee8d0f8bad9eddb7bc388
-
Filesize
865KB
MD5959460a18173908111523bbf4c39073e
SHA1c42a9a7042f6d87a6a9de7f9bf378f1fe9485fcc
SHA2565820d0bf9cfc363ff929492b1eb6df430039f4ac0e212a5b5411f7c2614f79d0
SHA512291decc0f58cf71d7929a52d2c21a07590c02bcd202b73fb20391d6d0c7dcbe3aec24e02606f22dbd589ee2546a0eb8414c232f74ec646a1f26496c280705600
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize11KB
MD5fa1a7cfe5ec208cd785fd921adf676ed
SHA1f85647be26efc6688bebb864760e51fe1da3ace7
SHA256514aa5dc32c58e76971a6c4d05fcec7b898d730a54e45db035a1b0bc7e10d682
SHA5124b85885d086a54a1c4bd3f4e7517de81ee0de2dba4ae7ea04929104f583293a2335e5bdf660383bcdeb844c98635dd6f045ffc16cd7ca483e1417f8c5026d9de
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize11KB
MD5feed4cb2c06e5eb286f0179e1ebee388
SHA1d9b75c82ed1460446332686b10626145179008e5
SHA25654d692ff80ba253d55abc7f8ee3fe80b74f21d9d141c44fb95f5c714ff7bca80
SHA51240ff17f8811b88cf38f2cff6ccadce9da1da47c5f18a9c14523fe0eebacbbd02934e82b42d3b775ffa23668ba1ad47d69727214db5f2bdfa39f1434a6b91f823
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Filesize8KB
MD53a2bdd4d549b6e8f86d6c061f69c476b
SHA1881dfa7e88578d746427b14c677c7b81993a436a
SHA256573c411d822313201fd47f931efc18c152a7bf326c6d8537dcb0bfa57c7597d6
SHA512a8cf3ef0b0ba75a5260636954f9c1f553499b4e823cb4505d62c638ed7fcec2ec1e5c6f3d07c6a10aa3496ced6b6ab967ccac540b88bb7bea09a7cb92610ddc9
-
Filesize
2KB
MD5c022f49c16f0852d54e568882a059d65
SHA1d69b90fd31bb567794a10e278391b29ba737feb6
SHA25684de5d7157e720fe84207b1eb17bdcb21783a9f07c7bf11aca3c721ff021163c
SHA512835dad765b2a22d3f469011363a952b382d952c54fe8f3ae7c3a77948a6f4ce6ff435264075f37555ef904ba1d4eccf7a6212fe73ed1d6c0b92eeb17d3507323
-
Filesize
48KB
MD5ab3e43a60f47a98962d50f2da0507df7
SHA14177228a54c15ac42855e87854d4cd9a1722fe39
SHA2564f5f0d9a2b6ef077402a17136ff066dda4c8175ceb6086877aaa3570cabb638f
SHA5129e3365c7860c4766091183d633462f1cc8c30d28871ae2cd8a9a086ce61c0bccf457f919db6826b708f0cf4f88e90f71185420edc4756b7d70137e2096f8797f
-
Filesize
3.1MB
MD5d8f28050e243944878f1e680f782d8a9
SHA1bc31401689faa54e61b1acde35356c694a5210fa
SHA256b87fb21bcbda66c31038a54b726c77738cad2b792fed237a4a1b44170da4f047
SHA512d23179842ec241e25fb8e216365d206e55457689a7c21e63cf41c242d08c2e242c646d9eded8fcdf4d3763c2bd5ecbb7d5bf15d8fd4caea24f04166a14068ff6
-
Filesize
1.6MB
MD5166d9aea5e83e3c9ef500d9c30fc4667
SHA14e43db9cf7a481f163567e65943eb26be004b619
SHA25659e1828b3053cf45e3a7e50b81f241980869fbbf9fcf37372e8a762f11dad4b0
SHA51242eb19da931cc48492e00e6390b3a6504c926e9c47fbfc59b8a88037cc705acd9272ff95ee5c4f5d75013f2c88f115801e0dcdfba7987430a82570171fafa8c2
-
Filesize
108KB
MD56dc889107d15512bd4a8f544f96b751a
SHA1c6ef13ec8e3cb6032063763c8aca2ca33881221c
SHA2560f990fa4cc71c1954b300d2b56cef02d1c0d3cd33fb4981b02d64f6488a51ce9
SHA5123db92862d8b0db5ca57e83eaf8f5a821b1409cc2b3ceb23405d84a340c0a1e6fa35255b1996b2d12920aff78067f8fd30cbc886529426956d4cc93b9c7fd6d4c
-
Filesize
4KB
MD58f914f583c7b7195a68721c643cabf23
SHA16e0590dabef75d37b60debb6b78379df48df7442
SHA256dc2d444ed951e4dac4b447d5d80343a9524c193bf3e46618253fcba04d613b83
SHA512510798a0428d41d8928d854ac0d849d5ba213818b3d9b9529264d83fcec20d5ac283eed2536c2b2ada3eb792c762a6547451bb8941681313f9967fd49da92400
-
Filesize
135B
MD54055ba4ebd5546fb6306d6a3151a236a
SHA1609a989f14f8ee9ed9bffbd6ddba3214fd0d0109
SHA256cb929ae2d466e597ecc4f588ba22faf68f7cfc204b3986819c85ac608d6f82b5
SHA51258d39f7ae0dafd067c6dba34c686506c1718112ad5af8a255eb9a7d6ec0edca318b557565f5914c5140eb9d1b6e2ffbb08c9d596f43e7a79fdb4ef95457bf29a
-
Filesize
114B
MD5e6cd92ad3b3ab9cb3d325f3c4b7559aa
SHA10704d57b52cf55674524a5278ed4f7ba1e19ca0c
SHA25663dfb8d99ce83b3ca282eb697dc76b17b4a48e4065fc7efafb77724739074a9d
SHA512172d5dc107757bb591b9a8ed7f2b48f22b5184d6537572d375801113e294febfbe39077c408e3a04c44e6072427cbe443c6614d205a5a4aa290101722e18f5e8
-
Filesize
119B
MD5f3eb631411fea6b5f0f0d369e1236cb3
SHA18366d7cddf1c1ab8ba541e884475697e7028b4e0
SHA256ebbc79d0fccf58eeaeee58e3acbd3b327c06b5b62fc83ef0128804b00a7025d0
SHA5124830e03d643b0474726ef93ad379814f4b54471e882c1aec5be17a0147f04cfbe031f8d74960a80be6b6491d3427eca3f06bc88cc06740c2ad4eb08e4d3e4338
-
Filesize
43B
MD5af3a9104ca46f35bb5f6123d89c25966
SHA11ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA25681bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
SHA5126a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
-
Filesize
1KB
MD5ee002cb9e51bb8dfa89640a406a1090a
SHA149ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA2563dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
SHA512d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
-
Filesize
79B
MD57f4b594a35d631af0e37fea02df71e72
SHA1f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57
SHA256530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1
SHA512bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360
-
Filesize
134B
MD558d3ca1189df439d0538a75912496bcf
SHA199af5b6a006a6929cc08744d1b54e3623fec2f36
SHA256a946db31a6a985bdb64ea9f403294b479571ca3c22215742bdc26ea1cf123437
SHA512afd7f140e89472d4827156ec1c48da488b0d06daaa737351c7bec6bc12edfc4443460c4ac169287350934ca66fb2f883347ed8084c62caf9f883a736243194a2
-
Filesize
53B
MD522b68a088a69906d96dc6d47246880d2
SHA106491f3fd9c4903ac64980f8d655b79082545f82
SHA25694be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88
SHA5128c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff
-
Filesize
238B
MD515b69964f6f79654cbf54953aad0513f
SHA1013fb9737790b034195cdeddaa620049484c53a7
SHA2561bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
SHA5127eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
-
Filesize
176B
MD56607494855f7b5c0348eecd49ef7ce46
SHA12c844dd9ea648efec08776757bc376b5a6f9eb71
SHA25637c30639ea04878b9407aecbcea4848b033e4548d5023ce5105ea79cab2c68dd
SHA5128cb60725d958291b9a78c293992768cb03ff53ab942637e62eb6f17d80e0864c56a9c8ccafbc28246e9ce1fdb248e8d071d76764bcaf0243397d0f0a62b4d09a
-
Filesize
85B
MD5c3419069a1c30140b77045aba38f12cf
SHA111920f0c1e55cadc7d2893d1eebb268b3459762a
SHA256db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f
SHA512c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1
-
Filesize
160B
MD5a24a1941bbb8d90784f5ef76712002f5
SHA15c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA2562a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
SHA512fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
-
Filesize
160B
MD5c3911ceb35539db42e5654bdd60ac956
SHA171be0751e5fc583b119730dbceb2c723f2389f6c
SHA25631952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
SHA512d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
-
Filesize
108B
MD59766c549a30b7093f85359b64d0e6500
SHA16e37c461d5d3b0954f10ed508b47d77b1503086f
SHA256e969777f266f94167d888caadd29ab0c9d3bf43b349426a5e517539db3ea4a60
SHA512dfc7a2880a19d13e54443a4c757dcfc29658b07fd2372194e4fc9582588921a4f7305988236f0a4fb9a2bf77f45fc9478886f172f8f00ad531eba1a24c28f101
-
Filesize
72B
MD50cdbe020500bc14578408a453cb34b35
SHA1b111e182f5b190181f6bea831809e2571db63485
SHA256a51a609cf33708ff6712f83cacbc1f8c0f5882c7b30336fe38c7a0113ec839d7
SHA5129274aa318a586fc2cdeccf0f4a0b2e5e5a821d1b6b3e568d1eb2fbb2e5b53864fccf5bfe2536865aab44a86371d2cf51d56154388285d9e71b7082bf3bb6ce70
-
Filesize
98B
MD505c5976d715ddd3cd7c7cfb35ed3ef25
SHA1814895d5d1b3e221dd20fc175aac0214ada6f83f
SHA256a5f3d847ebeea9c9e21bc1640672ba84c0f15f0010758a50e384780f337eb119
SHA5123951a45638e6f615eb022dd65b5e00fe5d4d77b79c18fc4cc5714a59053125b3b14ec7655b3405193ae27a035f2b3dc9e98bb76d7da6fba1266549ec709506fd
-
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5280_1306663305\_metadata\verified_contents.json
Filesize1KB
MD528706ad42e4c615a683c2494bc0bd2af
SHA16b0465b3d5e85a3ea76c646ba8652c4dc0248dc0
SHA256709bbb3e3a17e2b7bbf9f4afdcf465312695342ce4eb203df284233eacee086f
SHA512e95da92f1ad5f56ef61a5992a1b465d46f36eff1fc85643cc5ab3f357b6f14d81a5b5590d0e18d4da5fcc3ac537a469fd0c15b116a3471536707a9716119fa5f
-
Filesize
95B
MD568b80d08cd7255f7565c519209e536a9
SHA19f905d4c8280035a8a2780015f96c73b2f21b909
SHA2566665672d45d5ec5232540a6134fad9b25c2ccf47aa20f56b103cd7460e65531b
SHA512a5387fda1aec78a9748b3f295d97b8ac23f596da29de8172ddf112bd9f5d52f626369737f43644627e1abb215f294a916fef3f2dfc305c982dd4f63529530878
-
Filesize
300B
MD501f3de10093b3b262105724e85817fa6
SHA197dee66ece41b53a27cbd4579f44c204e35d19d6
SHA256be1b2d4b5880584961c46ec8ed276b6ee43ea595da56720268e05bd3d5c95340
SHA5129646b13e23c4214bcc45715fbc60eb9afb29f934d5d33b3471ee89a6f399a68d83b5bdff14748f73ce6a7c2c9fdce782a4ce849f855a900514636b529e9b400f
-
Filesize
110B
MD5fdff1fc54679712add857542517feea8
SHA14f9215d5056458896d9e5f1ba2f855efc0b84c30
SHA256c95f66779fd026e572da01659ec93c05dee31c8465daf50c97ae4e75f8546fcd
SHA512f243de170439498d5ac322c1a97ef66ebd24b193783f8d1ed38a9e37a69a5a49929a358784d751ff3be3732b46456a12f01c1686073496d6f97821146689c457
-
Filesize
69B
MD5fb195043cfc35ce711b45934e387267b
SHA16f1aaafee57a3da2687e9fc8defe2dbc7cba0e07
SHA256aeb364b60303212808fac02eb490ee5b054ae843ce084376e5981ef8767e5198
SHA512bd7fee1d6f8e51137c849d76ff53f3b501d60ddce83cce18f3a217703d3d8b1a1cc7696b656c666d4f6de62a17ea2407c857137d12e0b6ac7bcdde4b3c8ff86b
-
Filesize
76B
MD5c08a4e8fe2334119d49ca6967c23850f
SHA113c566b819d8e087246c80919e938ef2828b5dc4
SHA2565b01512276c45ecc43d4bfa9a912bdaf7afc26150881f2a0119972bffdbd8ab0
SHA512506f9f4fa4baaa4096ce10007eb09cfa95c9188082053b9ff7f2dec65164ff57506b6a8fea28d58783700f257c982aef037afc33f62da8da281e67636430dc23
-
Filesize
97B
MD5a6b4ee3137180cad95e7befb62cbf122
SHA1fa26a56140944b21d6a1ecc7fb3efc0d97d3ef23
SHA256a1742392406ff6dd5bfd1b2c080eb66bbd7474561a62fd8ab3ccd8300597135d
SHA51235ae8b940797600b727daced0acf856263d219697db923747d745d990c8798ada5159ac36544a6ec5952f74809d5489a371c6bb44325dee7bbe52965240188e0
-
Filesize
108B
MD526b64a5f67d4e61368545553bfc7d9fc
SHA188132a3a6840476e9a236eedfcaad6f9c74d7a44
SHA2563191913cab6f8317afe2d79054918b816f51fbc705b9d7055c5d3b6ab54eb35a
SHA51227d9af46cbfcf90470d913bd6bc9b066f7b138e46140204a8d254e5090505a4fe9a03b46f6e97d0aaa9b4e57400bd25e6b5c2af5ab786998ed1eef0258760591
-
Filesize
76B
MD54aaa0ed8099ecc1da778a9bc39393808
SHA10e4a733a5af337f101cfa6bea5ebc153380f7b05
SHA25620b91160e2611d3159ad82857323febc906457756678ab73f305c3a1e399d18d
SHA512dfa942c35e1e5f62dd8840c97693cdbfd6d71a1fd2f42e26cb75b98bb6a1818395ecdf552d46f07dff1e9c74f1493a39e05b14e3409963eff1ada88897152879
-
Filesize
73B
MD55b101f76ee7b9c60094bef9be603d5cd
SHA194aa6a3a234ece22a953a14d24c4d434e92fb6b4
SHA2568a59b4af14c0285f72f77f06a93c9d290d394f22eabe4798d529a64faf003595
SHA512a14f6f1284dc0e27e85680f9f82dd7a09ee1d2348133472793680ac80a7f0af12ded1f98870c4de5bc4b697506532fb396f5d61fa0610d99d92f80e908eed4c5