Overview

overview

10

Static

static

1

WhatsApp I...42.jpg

windows10-2004-x64

10

Resubmissions

23-02-2024 11:31

240223-nm1jwsfc9v 1

23-02-2024 11:30

240223-nmex7afc8t 3

23-02-2024 00:21

240223-anpbcshc73 8

22-02-2024 20:41

240222-zgssmseh9w 10

Analysis

  • max time kernel
    1200s
  • max time network
    1205s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-02-2024 20:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    WhatsApp Image 2024-02-22 at 18.48.42.jpg

  • Size

    275KB

  • MD5

    65fbd7e8560a33804c5fef01fbf1031a

  • SHA1

    ec1dd94fa010f3f870bbdad28f0ac1c196d085b7

  • SHA256

    3f2d3f804b2ec5bd87c6facac593090ca47553e8f9a824c9911ad840b61cc113

  • SHA512

    1bfc9edb18260dc5c268bd620f6b5de7fc30fff36d0d9e7fab5387760a7b8231172a91c1c08ee1ca771ebca365dfb047eca0e19be0727a46827353f63e133853

  • SSDEEP

    6144:bxAACWr/TO73Nnjrk4rp4kL02lZbctlepL+Cy/j/zGjd4Utbtqqi2rH1Dbf:bmACW+pok4kLtZbc7Gz4g4+rrVvf

Score
10/10
cerbercrimsonratwannacryxmrigbootkitdiscoveryevasionminerpersistenceransomwareratspywarestealerupxworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___C20DWOIS_.txt

Family

cerber

Ransom Note
CERBER RANSOMWARE ----- YOUR DOCUMENTS, PH0TOS, DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ----- The only way to decrypt y0ur files is to receive the private key and decryption program. To receive the private key and decryption program go to any decrypted folder, inside there is the special file (*_READ_THIS_FILE_*) with complete instructions how to decrypt your files. If you cannot find any (*_READ_THIS_FILE_*) file at your PC, follow the instructions below: ----- 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://p27dokhpz2n7nvgr.onion/F378-3542-4B6D-0446-96B0 Note! This page is available via "Tor Browser" only. ----- Also you can use temporary addresses on your personal page without using "Tor Browser". ----- 1. http://p27dokhpz2n7nvgr.12hygy.top/F378-3542-4B6D-0446-96B0 2. http://p27dokhpz2n7nvgr.14ewqv.top/F378-3542-4B6D-0446-96B0 3. http://p27dokhpz2n7nvgr.14vvrc.top/F378-3542-4B6D-0446-96B0 4. http://p27dokhpz2n7nvgr.129p1t.top/F378-3542-4B6D-0446-96B0 5. http://p27dokhpz2n7nvgr.1apgrn.top/F378-3542-4B6D-0446-96B0 ----- Note! These are temporary addresses! They will be available for a limited amount of time! -----
URLs

http://p27dokhpz2n7nvgr.onion/F378-3542-4B6D-0446-96B0

http://p27dokhpz2n7nvgr.12hygy.top/F378-3542-4B6D-0446-96B0

http://p27dokhpz2n7nvgr.14ewqv.top/F378-3542-4B6D-0446-96B0

http://p27dokhpz2n7nvgr.14vvrc.top/F378-3542-4B6D-0446-96B0

http://p27dokhpz2n7nvgr.129p1t.top/F378-3542-4B6D-0446-96B0

http://p27dokhpz2n7nvgr.1apgrn.top/F378-3542-4B6D-0446-96B0

Extracted

Path

C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___UQWVK_.hta

Family

cerber

Ransom Note
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>C&#069;&#82;BE&#82; &#82;ANSOMWA&#82;&#069;: Instructi&#111;ns</title> <HTA:APPLICATION APPLICATIONNAME="QhAXyL" SCROLL="yes" SINGLEINSTANCE="yes" WINDOWSTATE="maximize"> <style type="text/css"> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 13pt; line-height: 19pt; } body, h1 { margin: 0; padding: 0; } hr { color: #bda; height: 2pt; margin: 1.5%; } h1 { color: #555; font-size: 14pt; } ol { padding-left: 2.5%; } ol li { padding-bottom: 13pt; } small { color: #555; font-size: 11pt; } ul { list-style-type: none; margin: 0; padding: 0; } .button { color: #04a; cursor: pointer; } .button:hover { text-decoration: underline; } .container { background-color: #fff; border: 2pt solid #c7c7c7; margin: 5%; min-width: 850px; padding: 2.5%; } .header { border-bottom: 2pt solid #c7c7c7; margin-bottom: 2.5%; padding-bottom: 2.5%; } .h { display: none; } .hr { background: #bda; display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { background-color: #efe; border: 2pt solid #bda; display: inline-block; padding: 1.5%; text-align: center; } .updating { color: red; display: none; padding-left: 35px; background: url("data:image/gif;base64,R0lGODlhGQAZAKIEAMzMzJmZmTMzM2ZmZgAAAAAAAAAAAAAAACH/C05FVFNDQVBFMi4wAwEAAAAh+QQFAAAEACwAAAAAGQAZAAADVki63P4wSEiZvLXemRf4yhYoQ0l9aMiVLISCDms+L/DIwwnfc+c3qZ9g6Hn5hkhF7YgUKI2dpvNpExJ/WKquSoMCvd9geDeuBpcuGFrcQWep5Df7jU0AACH5BAUAAAQALAoAAQAOABQAAAMwSLDU/iu+Gdl0FbTAqeXg5YCdSJCBuZVqKw5wC8/qHJv2IN+uKvytn9AnFBCHx0cCACH5BAUAAAQALAoABAAOABQAAAMzSLoEzrC5F9Wk9YK6Jv8gEYzgaH4myaVBqYbfIINyHdcDI+wKniu7YG+2CPI4RgFI+EkAACH5BAUAAAQALAQACgAUAA4AAAMzSLrcBNDJBeuUNd6WwXbWtwnkFZwMqUpnu6il06IKLChDrsxBGufAHW0C1IlwxeMieEkAACH5BAUAAAQALAEACgAUAA4AAAM0SLLU/lAtFquctk6aIe5gGA1kBpwPqVZn66hl1KINPDRB3sxAGufAHc0C1IkIxcARZ4QkAAAh+QQFAAAEACwBAAQADgAUAAADMUhK0vurSfiko8oKHC//yyCCYvmVI4cOZAq+UCCDcv3VM4cHCuDHOZ/wI/xxigDQMAEAIfkEBQAABAAsAQABAA4AFAAAAzNIuizOkLgZ13xraHVF1puEKWBYlUP1pWrLBLALz+0cq3Yg324PAUAXcNgaBlVGgPAISQAAIfkEBQAABAAsAQABABQADgAAAzRIujzOMBJHpaXPksAVHoogMlzpZWK6lF2UjgobSK9AtjSs7QTg8xCfELgQ/og9I1IxXCYAADs=") left no-repeat; } #change_language { float: right; } #change_language, #texts div { display: none; } </style> </head> <body> <div class="container"> <div class="header"> <a id="change_language" href="#" onclick="return changeLanguage1();" title="English">&#9745; English</a> <h1>C&#069;&#82;BE&#82; &#82;ANSOMWA&#82;&#069;</h1> <small id="title">Instructions</small> </div> <div id="languages"> <p>&#9745; Select your language</p> <ul> <li><a href="#" title="English" onclick="return sh_bl('en');">English</a></li> <li><a href="#" title="Arabic" onclick="return sh_bl('ar');">العربية</a></li> <li><a href="#" title="Chinese" onclick="return sh_bl('zh');">中文</a></li> <li><a href="#" title="Dutch" onclick="return sh_bl('nl');">Nederlands</a></li> <li><a href="#" title="French" onclick="return sh_bl('fr');">Français</a></li> <li><a href="#" title="German" onclick="return sh_bl('de');">Deutsch</a></li> <li><a href="#" title="Italian" onclick="return sh_bl('it');">Italiano</a></li> <li><a href="#" title="Japanese" onclick="return sh_bl('ja');">日本語</a></li> <li><a href="#" title="Korean" onclick="return sh_bl('ko');">한국어</a></li> <li><a href="#" title="Polish" onclick="return sh_bl('pl');">Polski</a></li> <li><a href="#" title="Portuguese" onclick="return sh_bl('pt');">Português</a></li> <li><a href="#" title="Spanish" onclick="return sh_bl('es');">Español</a></li> <li><a href="#" title="Turkish" onclick="return sh_bl('tr');">Türkçe</a></li> </ul> </div> <div id="texts"> <div id="en"> <p>Can't yo<span class="h">dt</span>u find the necessary files?<br>Is the c<span class="h">o</span>ontent of your files not readable?</p> <p>It is normal be<span class="h">M22KyW86AL</span>cause the files' names and the data in your files have been encryp<span class="h">9JkG2DkQ</span>ted by "Ce<span class="h">xr3IlMxt</span>r&#98;er&nbsp;Rans&#111;mware".</p> <p>It me<span class="h">NVa3EF7</span>ans your files are NOT damage<span class="h">y76F</span>d! Your files are modified only. This modification is reversible.<br>F<span class="h">XWSG</span>rom now it is not poss<span class="h">Obl6</span>ible to use your files until they will be decrypted.</p> <p>The only way to dec<span class="h">RR</span>rypt your files safely is to &#98;uy the special decryption software "C<span class="h">wALdHn</span>er&#98;er&nbsp;Decryptor".</p> <p>Any attempts to rest<span class="h">PcbPBZ9Yj</span>ore your files with the thir<span class="h">C7W6cdnb</span>d-party software will be fatal for your files!</p> <hr> <p class="w331208">You can proc<span class="h">O5WK</span>eed with purchasing of the decryption softw<span class="h">Kh7Y</span>are at your personal page:</p> <p><span class="info"><span class="updating">Ple<span class="h">nr</span>ase wait...</span><a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/F378-3542-4B6D-0446-96B0</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/F378-3542-4B6D-0446-96B0</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/F378-3542-4B6D-0446-96B0</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/F378-3542-4B6D-0446-96B0</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/F378-3542-4B6D-0446-96B0</a></span></p> <p>If t<span class="h">8M5Ey</span>his page cannot be opened &nbsp;<span class="button" onclick="return _url_upd_('en');">cli<span class="h">UhHn</span>ck here</span>&nbsp; to get a new addr<span class="h">U64Q</span>ess of your personal page.<br><br>If the addre<span class="h">xp0HmDqgQ</span>ss of your personal page is the same as befo<span class="h">Rc7oHO</span>re after you tried to get a new one,<br>you c<span class="h">zg5d</span>an try to get a new address in one hour.</p> <p>At th<span class="h">QWejbU9Y</span>is p&#097;ge you will receive the complete instr<span class="h">kgjJbUY</span>uctions how to buy the decrypti<span class="h">C1cffn8R</span>on software for restoring all your files.</p> <p>Also at this p&#097;ge you will be able to res<span class="h">cBsM9btEB</span>tore any one file for free to be sure "Cer&#98;e<span class="h">An7OACxj</span>r&nbsp;Decryptor" will help you.</p> <hr> <p>If your per<span class="h">NUm1HVopzF</span>sonal page is not availa<span class="h">WkUxTyD</span>ble for a long period there is another way to open your personal page - insta<span class="h">tVa</span>llation and use of Tor&nbsp;Browser:</p> <ol> <li>run your Inte<span class="h">5Fbyoz</span>rnet browser (if you do not know wh&#097;t it is run the Internet&nbsp;Explorer);</li> <li>ent<span class="h">qi</span>er or copy the &#097;ddress <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/downlo&#097;d/download-easy.html.en</a> into the address bar of your browser &#097;nd press ENTER;</li> <li>wait for the site load<span class="h">t8a</span>ing;</li> <li>on the site you will be offered to do<span class="h">mRgPI4</span>wnload Tor&nbsp;Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>ru<span class="h">GnflL</span>n Tor&nbsp;Browser;</li> <li>connect with the butt<span class="h">TWx</span>on "Connect" (if you use the English version);</li> <li>a normal Internet bro<span class="h">pJ</span>wser window will be opened &#097;fter the initialization;</li> <li>type or copy the add<span class="h">9Rdw51</span>ress <br><span class="info">http://p27dokhpz2n7nvgr.onion/F378-3542-4B6D-0446-96B0</span><br> in this browser address bar;</li> <li>pre<span class="h">vRorg0YR</span>ss ENTER;</li> <li>the site sho<span class="h">l4pKXhY9</span>uld be loaded; if for some reason the site is not lo<span class="h">J0e</span>ading wait for a moment and try again.</li> </ol> <p>If you have any pr<span class="h">G7oBFO</span>oblems during installation or use of Tor&nbsp;Browser, please, visit <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> and type request in the searc<span class="h">OUKOx83h</span>h bar "Install Tor&nbsp;Browser Windows" and you will find a lot of training videos about Tor&nbsp;Browser installation and use.</p> <hr> <p><strong>Addit<span class="h">RG9YU</span>ional information:</strong></p> <p>You will fi<span class="h">Uz</span>nd the instru<span class="h">2HBin</span>cti&#111;ns ("*_READ_THIS_FILE_*.hta") for re<span class="h">3</span>st&#111;ring y&#111;ur files in &#097;ny f<span class="h">4sb4</span>&#111;lder with your enc<span class="h">mSYwy</span>rypted files.</p> <p>The instr<span class="h">tyC3Afqv5</span>ucti&#111;ns "*_READ_THIS_FILE_*.hta" in the f<span class="h">RVsZN7O</span>&#111;lder<span class="h">i</span>s with your encry<span class="h">J09DmdDF5</span>pted files are not vir<span class="h">7TPBJUY6s</span>uses! The instruc<span class="h">lWl</span>tions "*_READ_THIS_FILE_*.hta" will he<span class="h">fypRP78eR</span>lp you to dec<span class="h">HswQ</span>rypt your files.</p> <p>Remembe<span class="h">CHxWb647xJ</span>r! The w&#111;rst si<span class="h">e80cTII6p</span>tu&#097;tion already happ<span class="h">NmyGc2oF0i</span>ened and n&#111;w the future of your files de<span class="h">M9</span>pends on your determ<span class="h">ua3fE9Ih</span>ination and speed of your actions.</p> </div> <div id="ar" style="direction: rtl;"> <p>لا يمكنك العثور على الملفات الضرورية؟<br>هل محتوى الملفات غير قابل للقراءة؟</p> <p>هذا أمر طبيعي لأن أسماء الملفات والبيانات في الملفات قد تم تشفيرها بواسطة "Cer&#98;er&nbsp;Rans&#111;mware".</p> <p>وهذا يعني أن الملفات الخاصة بك ليست تالفة! فقد تم تعديل ملفاتك فقط. ويمكن التراجع عن هذا.<br>ومن الآن فإنه لا يكن استخدام الملفات الخاصة بك حتى يتم فك تشفيرها.</p> <p>الطريقة الوحيدة لفك تشفير ملفاتك بأمان هو أن تشتري برنامج فك التشفير المتخصص "Cer&#98;er&nbsp;Decryptor".</p> <p>إن أية محاولات لاستعادة الملفات الخاصة بك بواسطة برامج من طرف ثالث سوف تكون مدمرة لملفاتك!</p> <hr> <p>يمكنك الشروع في شراء برنامج فك التشفير من صفحتك الشخصية:</p> <p><span class="info"><span class="updating">أرجو الإنتظار...</span><a class="url" href="http://p27dokhpz2n7nvgr.12hygy.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.12hygy.top/F378-3542-4B6D-0446-96B0</a><hr><a href="http://p27dokhpz2n7nvgr.14ewqv.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.14ewqv.top/F378-3542-4B6D-0446-96B0</a><hr><a href="http://p27dokhpz2n7nvgr.14vvrc.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.14vvrc.top/F378-3542-4B6D-0446-96B0</a><hr><a href="http://p27dokhpz2n7nvgr.129p1t.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.129p1t.top/F378-3542-4B6D-0446-96B0</a><hr><a href="http://p27dokhpz2n7nvgr.1apgrn.top/F378-3542-4B6D-0446-96B0" target="_blank">http://p27dokhpz2n7nvgr.1apgrn.top/F378-3542-4B6D-0446-96B0</a></span></p> <p>في حالة تعذر فتح هذه الصفحة &nbsp;<span class="button" onclick="return _url_upd_('ar');">انقر هنا</span>&nbsp; لإنشاء عنوان جديد لصفحتك الشخصية.</p> <p>في هذه الصفحة سوف تتلقى تعليمات كاملة حول كيفية شراء برنامج فك التشفير لاستعادة جميع الملفات الخاصة بك.</p> <p>في هذه الصفحة أيضًا سوف تتمكن من استعادة ملف واحد بشكل مجاني للتأكد من أن "Cer&#98;er&nbsp;Decryptor" سوف يساعدك.</p> <hr> <p>إذا كانت صفحتك الشخصية غير متاحة لفترة طويلة فإن ثمّة طريقة أخرى لفتح صفحتك الشخصية - تحميل واستخدام متصفح Tor:</p> <ol> <li>قم بتشغيل متصفح الإنترنت الخاص بك (إذا كنت لا تعرف ما هو قم بتشغيل إنترنت إكسبلورر);</li> <li>قم بكتابة أو نسخ العنوان <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> إلى شريط العنوان في المستعرض الخاص بك ثم اضغط ENTER;</li> <li>انتظر لتحميل الموقع;</li> <li>سوف يعرض عليك الموقع تحميل متصفح Tor. قم بتحميله وتشغيله، واتبع تعليمات التثبيت، وانتظر حتى اكتمال التثبيت;</li> <li>قم بتشغيل متصفح Tor;</li> <li>اضغط على الزر "Connect" (إذا كنت تستخدم النسخة الإنجليزية);</li> <li>سوف تُفتح نافذة متصفح الإنترنت العادي بعد البدء;</li> <li>قم بكتابة أو نسخ العنوان <br><span class="info">http://p27dokhpz2n7nvgr.onion/F378-3542-4B6D-0446-96B0</span><br> في شريط العنوان في المتصفح;</li> <li>اضغط ENTER;</li> <li>يجب أن يتم تحميل الموقع؛ إذا لم يتم تحميل الموقع لأي سبب، انتظر للحظة وحاول مرة أخرى.</li> </ol> <p>إذا كان لديك أية مشكلات أثناء عملية التثبيت أو استخدام متصفح Tor، يُرجى زيارة <a href="https://www.youtube.com/results?search_query=Install+Tor+Browser+Windows" target="_blank">https://www.youtube.com</a> واكتب الطلب "install tor browser windows" أو "تثبيت نوافذ متصفح Tor" في شريط البحث، وسوف تجد الكثير من أشرطة الفيديو للتدريب حول تثبيت متصفح Tor واستخدامه.</p> <hr> <p><strong>معلومات إض<span class="h">XwLYVwOPr</span>افية:</strong></p> <p>س<span class="h">g0yLGK</span>وف تجد إرشادات استعادة الملفات الخاصة بك ("*_READ_THIS_FILE_*") في أي مجلد مع ملفاتك المشفرة.</p> <p>الإرش<span class="h">Hxf</span>ادات ("*_READ_THIS_FILE_*") الموجودة في المجلدات مع ملفاتك المشفرة ليست فيروسات والإرشادات ("*_READ_THIS_FILE_*") سوف تساعدك على فك تشفير الملفات الخاصة بك.</p> <p>تذكر أن أسوأ مو<span class="h">KVOyFdlEua</span>قف قد حدث بالفعل، والآن مستقبل ملفاتك يعتمد على عزيمتك وسرعة الإجراءات الخاصة بك.</p> </div> <div id="zh"> <p>您找不到所需的文件？<br>您文件的内容无法阅读？</p> <p>这是正常的，因为您文件的文件名和数据已经被“Cer&#98;er&nbsp;Rans&#111;mware”加密了。</p> <p>这意味着您的文件并没有损坏！您的文件只

Extracted

Family

crimsonrat

C2

185.136.161.124

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • CrimsonRAT main payload 1 IoCs
  • CrimsonRat

    Crimson RAT is a malware linked to a Pakistani-linked threat actor.

    ratcrimsonrat
  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • XMRig Miner payload 1 IoCs
    miner
  • Contacts a large (1141) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Downloads MZ/PE file
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 15 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner
  • Drops startup file 10 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 41 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 3 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 38 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 5 IoCs
    ransomware
  • Suspicious use of SetThreadContext 9 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 19 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies registry class 10 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 4 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\WhatsApp Image 2024-02-22 at 18.48.42.jpg"
    1⤵
      PID:3268
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9963346f8,0x7ff996334708,0x7ff996334718
      1⤵
        PID:4872
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
        1⤵
          PID:1948
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
          1⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1972
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
          1⤵
            PID:4936
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
            1⤵
              PID:3824
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
              1⤵
                PID:1444
              • C:\Windows\System32\CompPkgSrv.exe
                C:\Windows\System32\CompPkgSrv.exe -Embedding
                1⤵
                  PID:1336
                • C:\Windows\System32\CompPkgSrv.exe
                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                  1⤵
                    PID:2136
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
                    1⤵
                      PID:4592
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
                      1⤵
                        PID:3168
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 /prefetch:8
                        1⤵
                          PID:2632
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 /prefetch:8
                          1⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1192
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
                          1⤵
                            PID:3636
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
                            1⤵
                              PID:3648
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5556 /prefetch:8
                              1⤵
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2272
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4176 /prefetch:8
                              1⤵
                                PID:5092
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
                                1⤵
                                  PID:4288
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                                  1⤵
                                    PID:3260
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
                                    1⤵
                                      PID:3488
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                                      1⤵
                                        PID:4448
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
                                        1⤵
                                          PID:5088
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                          1⤵
                                            PID:3248
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
                                            1⤵
                                              PID:2944
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
                                              1⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:660
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
                                              1⤵
                                                PID:396
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3412 /prefetch:8
                                                1⤵
                                                  PID:4028
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1708 /prefetch:8
                                                  1⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1088
                                                • C:\Windows\System32\rundll32.exe
                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                  1⤵
                                                    PID:660
                                                  • C:\Windows\system32\OpenWith.exe
                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                    1⤵
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4952
                                                  • C:\Windows\System32\WFS.exe
                                                    "C:\Windows\System32\WFS.exe" /SendTo C:\Users\Admin\Desktop\WTEpZSFwgb
                                                    1⤵
                                                    • Drops desktop.ini file(s)
                                                    • NTFS ADS
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2568
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:8
                                                    1⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:4868
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2380 /prefetch:1
                                                    1⤵
                                                      PID:3568
                                                    • C:\Windows\system32\OpenWith.exe
                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                      1⤵
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3216
                                                    • C:\Windows\system32\OpenWith.exe
                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                      1⤵
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4028
                                                    • C:\Windows\system32\OpenWith.exe
                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                      1⤵
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1756
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
                                                      1⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1532
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
                                                      1⤵
                                                        PID:4248
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6516 /prefetch:8
                                                        1⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:4540
                                                      • C:\Program Files\7-Zip\7zG.exe
                                                        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Ransomware-Samples-main\Cerber\" -an -ai#7zMap23777:154:7zEvent27662
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:744
                                                      • C:\Users\Admin\Desktop\Ransomware-Samples-main\Cerber\cerber.exe
                                                        "C:\Users\Admin\Desktop\Ransomware-Samples-main\Cerber\cerber.exe"
                                                        1⤵
                                                        • Checks computer location settings
                                                        • Drops startup file
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Sets desktop wallpaper using registry
                                                        • Drops file in Windows directory
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:440
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
                                                          2⤵
                                                          • Modifies Windows Firewall
                                                          PID:636
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          C:\Windows\system32\netsh.exe advfirewall reset
                                                          2⤵
                                                          • Modifies Windows Firewall
                                                          PID:5008
                                                        • C:\Windows\SysWOW64\mshta.exe
                                                          "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___L8DZ84_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                                                          2⤵
                                                            PID:4412
                                                          • C:\Windows\SysWOW64\NOTEPAD.EXE
                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___UHLZEB_.txt
                                                            2⤵
                                                            • Opens file in notepad (likely ransom note)
                                                            PID:2632
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe"
                                                            2⤵
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:2280
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              taskkill /f /im "cerber.exe"
                                                              3⤵
                                                              • Kills process with taskkill
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4600
                                                            • C:\Windows\SysWOW64\PING.EXE
                                                              ping -n 1 127.0.0.1
                                                              3⤵
                                                              • Runs ping.exe
                                                              PID:1880
                                                        • C:\Program Files\7-Zip\7zG.exe
                                                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Ransomware-Samples-main\Cryptowall\" -an -ai#7zMap14164:170:7zEvent3497
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:2224
                                                        • C:\Users\Admin\Desktop\Ransomware-Samples-main\Cerber\cerber.exe
                                                          "C:\Users\Admin\Desktop\Ransomware-Samples-main\Cerber\cerber.exe"
                                                          1⤵
                                                          • Executes dropped EXE
                                                          PID:3272
                                                        • C:\Program Files\7-Zip\7zG.exe
                                                          "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Ransomware-Samples-main\Jigsaw\" -an -ai#7zMap15879:154:7zEvent8339
                                                          1⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:2368
                                                        • C:\Windows\system32\OpenWith.exe
                                                          C:\Windows\system32\OpenWith.exe -Embedding
                                                          1⤵
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3628
                                                        • C:\Windows\system32\taskmgr.exe
                                                          "C:\Windows\system32\taskmgr.exe" /0
                                                          1⤵
                                                          • Checks SCSI registry key(s)
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:5100
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                          1⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4464
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9963346f8,0x7ff996334708,0x7ff996334718
                                                            2⤵
                                                              PID:2044
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
                                                            1⤵
                                                              PID:4948
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
                                                              1⤵
                                                                PID:884
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:1
                                                                1⤵
                                                                  PID:4268
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1072 /prefetch:1
                                                                  1⤵
                                                                    PID:940
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
                                                                    1⤵
                                                                      PID:3116
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
                                                                      1⤵
                                                                        PID:3496
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
                                                                        1⤵
                                                                          PID:468
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
                                                                          1⤵
                                                                            PID:4720
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6116 /prefetch:8
                                                                            1⤵
                                                                              PID:3144
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault109807f2h77efh44c1h8a7fh9716865d3c83
                                                                              1⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1380
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9963346f8,0x7ff996334708,0x7ff996334718
                                                                                2⤵
                                                                                  PID:1080
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1484,651274027005803014,9565149116155597276,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
                                                                                  2⤵
                                                                                    PID:5172
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,651274027005803014,9565149116155597276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
                                                                                    2⤵
                                                                                      PID:5180
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7a8f2ab1hf50ah42bfha88fh30992dc76234
                                                                                    1⤵
                                                                                      PID:5356
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9963346f8,0x7ff996334708,0x7ff996334718
                                                                                        2⤵
                                                                                          PID:5372
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1388,3684198891026293840,3479851282859125483,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
                                                                                          2⤵
                                                                                            PID:5644
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1388,3684198891026293840,3479851282859125483,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
                                                                                            2⤵
                                                                                              PID:5672
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
                                                                                            1⤵
                                                                                              PID:5840
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7140 /prefetch:1
                                                                                              1⤵
                                                                                                PID:6064
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6396 /prefetch:8
                                                                                                1⤵
                                                                                                  PID:5200
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7228 /prefetch:8
                                                                                                  1⤵
                                                                                                    PID:5252
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7268 /prefetch:8
                                                                                                    1⤵
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    PID:4016
                                                                                                  • C:\Users\Admin\Downloads\Avoid.exe
                                                                                                    "C:\Users\Admin\Downloads\Avoid.exe"
                                                                                                    1⤵
                                                                                                    • Suspicious use of SetThreadContext
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:1116
                                                                                                    • C:\Windows\notepad.exe
                                                                                                      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                      2⤵
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:6096
                                                                                                  • C:\Users\Admin\Downloads\Avoid.exe
                                                                                                    "C:\Users\Admin\Downloads\Avoid.exe"
                                                                                                    1⤵
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:2208
                                                                                                  • C:\Users\Admin\Downloads\Avoid.exe
                                                                                                    "C:\Users\Admin\Downloads\Avoid.exe"
                                                                                                    1⤵
                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                    PID:4136
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7460 /prefetch:1
                                                                                                    1⤵
                                                                                                      PID:5288
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
                                                                                                      1⤵
                                                                                                        PID:5224
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7068 /prefetch:8
                                                                                                        1⤵
                                                                                                          PID:2236
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7576 /prefetch:1
                                                                                                          1⤵
                                                                                                            PID:5156
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6832 /prefetch:8
                                                                                                            1⤵
                                                                                                              PID:1572
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7944 /prefetch:8
                                                                                                              1⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:5880
                                                                                                            • C:\Users\Admin\Downloads\ChilledWindows (2).exe
                                                                                                              "C:\Users\Admin\Downloads\ChilledWindows (2).exe"
                                                                                                              1⤵
                                                                                                              • Enumerates connected drives
                                                                                                              • Modifies registry class
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                              PID:3836
                                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                                              C:\Windows\system32\AUDIODG.EXE 0x478 0x33c
                                                                                                              1⤵
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:2124
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
                                                                                                              1⤵
                                                                                                                PID:2428
                                                                                                              • C:\Users\Admin\Downloads\ChilledWindows (2).exe
                                                                                                                "C:\Users\Admin\Downloads\ChilledWindows (2).exe"
                                                                                                                1⤵
                                                                                                                • Enumerates connected drives
                                                                                                                • Modifies registry class
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                PID:6096
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7296 /prefetch:1
                                                                                                                1⤵
                                                                                                                  PID:2056
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7672 /prefetch:8
                                                                                                                  1⤵
                                                                                                                    PID:2220
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1276 /prefetch:8
                                                                                                                    1⤵
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:5996
                                                                                                                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\chilledwindows.mp4"
                                                                                                                    1⤵
                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:2988
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
                                                                                                                    1⤵
                                                                                                                      PID:4572
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1276 /prefetch:8
                                                                                                                      1⤵
                                                                                                                        PID:2664
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:1
                                                                                                                        1⤵
                                                                                                                          PID:5288
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7676 /prefetch:8
                                                                                                                          1⤵
                                                                                                                            PID:1876
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 /prefetch:8
                                                                                                                            1⤵
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:6056
                                                                                                                          • C:\Users\Admin\Downloads\xpaj (1).exe
                                                                                                                            "C:\Users\Admin\Downloads\xpaj (1).exe"
                                                                                                                            1⤵
                                                                                                                            • Enumerates connected drives
                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:6048
                                                                                                                          • C:\Users\Admin\Downloads\xpaj (1).exe
                                                                                                                            "C:\Users\Admin\Downloads\xpaj (1).exe"
                                                                                                                            1⤵
                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:3932
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7800 /prefetch:1
                                                                                                                            1⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:3080
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7388 /prefetch:8
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:4892
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
                                                                                                                            1⤵
                                                                                                                            • Checks computer location settings
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:1444
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4924 /prefetch:8
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            PID:4448
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7308 /prefetch:8
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Loads dropped DLL
                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                            PID:5008
                                                                                                                          • C:\Users\Admin\Downloads\CrimsonRAT (1).exe
                                                                                                                            "C:\Users\Admin\Downloads\CrimsonRAT (1).exe"
                                                                                                                            1⤵
                                                                                                                              PID:3240
                                                                                                                              • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                                                                                "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                                                                                2⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1376
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Unnamed_0.zip\Ransomware.Unnamed_0.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Unnamed_0.zip\Ransomware.Unnamed_0.exe"
                                                                                                                              1⤵
                                                                                                                              • Drops startup file
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:3164
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t50yo0un\t50yo0un.cmdline"
                                                                                                                                2⤵
                                                                                                                                  PID:5548
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9351.tmp" "c:\Users\Admin\AppData\Local\Temp\t50yo0un\CSCC85F17F1F4FC4663A37E01BDF426D24.TMP"
                                                                                                                                    3⤵
                                                                                                                                      PID:2080
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                                                                                                    2⤵
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:1572
                                                                                                                                • C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe
                                                                                                                                  "C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe"
                                                                                                                                  1⤵
                                                                                                                                  • Drops startup file
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:5524
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0a5gxxfz\0a5gxxfz.cmdline"
                                                                                                                                    2⤵
                                                                                                                                      PID:5624
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE48E.tmp" "c:\Users\Admin\AppData\Local\Temp\0a5gxxfz\CSCACE7099299B148C4BD74DB8F238B4AFD.TMP"
                                                                                                                                        3⤵
                                                                                                                                          PID:2220
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                                                                                                        2⤵
                                                                                                                                          PID:5840
                                                                                                                                      • C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe
                                                                                                                                        "C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe"
                                                                                                                                        1⤵
                                                                                                                                        • Drops startup file
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:3440
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nwrvebf3\nwrvebf3.cmdline"
                                                                                                                                          2⤵
                                                                                                                                            PID:5288
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3FD.tmp" "c:\Users\Admin\AppData\Local\Temp\nwrvebf3\CSC56FBF4A91C064783B550D5A3C32598C7.TMP"
                                                                                                                                              3⤵
                                                                                                                                                PID:3088
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                                                                                                              2⤵
                                                                                                                                                PID:4452
                                                                                                                                            • C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe
                                                                                                                                              "C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe"
                                                                                                                                              1⤵
                                                                                                                                              • Drops startup file
                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                              PID:5784
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\45ijkqlc\45ijkqlc.cmdline"
                                                                                                                                                2⤵
                                                                                                                                                  PID:5600
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES96C.tmp" "c:\Users\Admin\AppData\Local\Temp\45ijkqlc\CSC780B9DF2E6E4490584FEDB5D4E718928.TMP"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5036
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2908
                                                                                                                                                  • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                    "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                    1⤵
                                                                                                                                                    • Drops startup file
                                                                                                                                                    • Sets desktop wallpaper using registry
                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                    PID:6004
                                                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                      attrib +h .
                                                                                                                                                      2⤵
                                                                                                                                                      • Views/modifies file attributes
                                                                                                                                                      PID:4596
                                                                                                                                                    • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                      icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                      2⤵
                                                                                                                                                      • Modifies file permissions
                                                                                                                                                      PID:368
                                                                                                                                                    • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                      taskdl.exe
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:6056
                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c 173601708635319.bat
                                                                                                                                                      2⤵
                                                                                                                                                        PID:5700
                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                          cscript.exe //nologo m.vbs
                                                                                                                                                          3⤵
                                                                                                                                                            PID:3556
                                                                                                                                                        • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                          attrib +h +s F:\$RECYCLE
                                                                                                                                                          2⤵
                                                                                                                                                          • Views/modifies file attributes
                                                                                                                                                          PID:1636
                                                                                                                                                        • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                          @[email protected] co
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                          PID:5880
                                                                                                                                                          • C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exe
                                                                                                                                                            TaskData\Tor\taskhsvc.exe
                                                                                                                                                            3⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            PID:2700
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          cmd.exe /c start /b @[email protected] vs
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2864
                                                                                                                                                            • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                              @[email protected] vs
                                                                                                                                                              3⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:5680
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:5560
                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                    wmic shadowcopy delete
                                                                                                                                                                    5⤵
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:6108
                                                                                                                                                            • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                              taskdl.exe
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:4028
                                                                                                                                                            • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                              taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2296
                                                                                                                                                            • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                              @[email protected]
                                                                                                                                                              2⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Sets desktop wallpaper using registry
                                                                                                                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                              PID:4868
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qqacpqnwqsp929" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
                                                                                                                                                              2⤵
                                                                                                                                                                PID:2220
                                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qqacpqnwqsp929" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                  • Modifies registry key
                                                                                                                                                                  PID:6124
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4612
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1676
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4604
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:6012
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1488
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5036
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5624
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 296
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:948
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3556
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4732
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 296
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:5176
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4640
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:2816
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 296
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:3624
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3136
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 240
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:3948
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1880
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1880 -s 296
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:3496
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:5316
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 240
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:6028
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:636
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 296
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:2816
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:3948
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 236
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:768
                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:1496
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 1496 -s 296
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:5908
                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                taskdl.exe
                                                                                                                                                                2⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4632
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 236
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:4032
                                                                                                                                                              • C:\Windows\notepad.exe
                                                                                                                                                                "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2664
                                                                                                                                                                • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                  taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:5564
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 296
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Program crash
                                                                                                                                                                    PID:6060
                                                                                                                                                                • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                  taskdl.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  PID:3972
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3972 -s 240
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Program crash
                                                                                                                                                                    PID:5016
                                                                                                                                                                • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                  taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1576
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 296
                                                                                                                                                                      3⤵
                                                                                                                                                                      • Program crash
                                                                                                                                                                      PID:4248
                                                                                                                                                                  • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                    taskdl.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5024
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 248
                                                                                                                                                                        3⤵
                                                                                                                                                                        • Program crash
                                                                                                                                                                        PID:3168
                                                                                                                                                                    • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                      taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4024
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 296
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Program crash
                                                                                                                                                                          PID:4180
                                                                                                                                                                      • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                        taskdl.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:5720
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 5720 -s 236
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Program crash
                                                                                                                                                                            PID:4968
                                                                                                                                                                      • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                        "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:2152
                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                            icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                            PID:2948
                                                                                                                                                                          • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                            attrib +h .
                                                                                                                                                                            2⤵
                                                                                                                                                                            • Views/modifies file attributes
                                                                                                                                                                            PID:6108
                                                                                                                                                                        • C:\Windows\system32\NOTEPAD.EXE
                                                                                                                                                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2224
                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4920
                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                              PID:5544
                                                                                                                                                                            • C:\Windows\SysWOW64\werfault.exe
                                                                                                                                                                              werfault.exe /h /shared Global\270e6513d51e474a9e366c8ce8b169c6 /t 5800 /p 4868
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:5784
                                                                                                                                                                              • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                "C:\Users\Admin\Desktop\@[email protected]"
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Sets desktop wallpaper using registry
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:1112
                                                                                                                                                                              • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5204
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 304
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Program crash
                                                                                                                                                                                  PID:464
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5204 -ip 5204
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:1908
                                                                                                                                                                                • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                  "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:2636
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 252
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Program crash
                                                                                                                                                                                    PID:5812
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2636 -ip 2636
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:3112
                                                                                                                                                                                  • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                    "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    PID:6056
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 252
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Program crash
                                                                                                                                                                                      PID:3120
                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6056 -ip 6056
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4716
                                                                                                                                                                                    • C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe
                                                                                                                                                                                      "C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      PID:5676
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4bnxbpxt\4bnxbpxt.cmdline"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5928
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4D2.tmp" "c:\Users\Admin\AppData\Local\Temp\4bnxbpxt\CSC85BA2F1AAED844C1B15DD99C7641FCBC.TMP"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:6108
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5224
                                                                                                                                                                                          • C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe
                                                                                                                                                                                            "C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Drops startup file
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            PID:2792
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yda5qzit\yda5qzit.cmdline"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3572
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4B3.tmp" "c:\Users\Admin\AppData\Local\Temp\yda5qzit\CSCC81DA7B6B7864D7F94A9B495415B9DF.TMP"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:6024
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1576
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5624 -ip 5624
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:3544
                                                                                                                                                                                                  • C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe
                                                                                                                                                                                                    "C:\Users\Admin\Desktop\Ransomware.Unnamed_0.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Drops startup file
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    PID:5976
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0pyyumj5\0pyyumj5.cmdline"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4940
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE58.tmp" "c:\Users\Admin\AppData\Local\Temp\0pyyumj5\CSCFC8DDA1864D8489CBAAE2E20B45F47A0.TMP"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:3252
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4732 -ip 4732
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:6100
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6160 /prefetch:1
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            PID:5812
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6380 /prefetch:8
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                            PID:5720
                                                                                                                                                                                                          • C:\Users\Admin\Downloads\CrimsonRAT (1).exe
                                                                                                                                                                                                            "C:\Users\Admin\Downloads\CrimsonRAT (1).exe"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2008
                                                                                                                                                                                                            • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                                                                                                                                                              "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:1828
                                                                                                                                                                                                          • C:\Users\Admin\Downloads\CrimsonRAT (1).exe
                                                                                                                                                                                                            "C:\Users\Admin\Downloads\CrimsonRAT (1).exe"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2732
                                                                                                                                                                                                            • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                                                                                                                                                              "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                          • C:\Users\Admin\Downloads\CrimsonRAT (1).exe
                                                                                                                                                                                                            "C:\Users\Admin\Downloads\CrimsonRAT (1).exe"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:5224
                                                                                                                                                                                                            • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                                                                                                                                                              "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:3064
                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2816 -ip 2816
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3136 -ip 3136
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                PID:4136
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 /prefetch:8
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                PID:6100
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1880 -ip 1880
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:888
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5316 -ip 5316
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5364
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 636 -ip 636
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5036
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3948 -ip 3948
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3136
                                                                                                                                                                                                                      • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                        "C:\Windows\system32\taskmgr.exe" /0
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                        PID:4092
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1496 -ip 1496
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\werfault.exe
                                                                                                                                                                                                                          werfault.exe /h /shared Global\977debaaec74436a9ee297c3c2148827 /t 980 /p 4616
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5892
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4632 -ip 4632
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:5800
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5564 -ip 5564
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:1548
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3972 -ip 3972
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:3584
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                  PID:3728
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1576 -ip 1576
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3164
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5024 -ip 5024
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:3932
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=87 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:1240
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:440
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7900 /prefetch:1
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:6084
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                                      PID:4148
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4024 -ip 4024
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 5720 -ip 5720
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:6140
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          PID:5312
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,17935673318771047476,6382517667815550577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7324 /prefetch:1
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                          • Checks computer location settings
                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                          PID:5664

                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                        MITRE ATT&CK Matrix ATT&CK v13

                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                        Scripting

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1064

                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                        Pre-OS Boot

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1542

                                                                                                                                                                                                                                        Bootkit

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1542.003

                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                        Indicator Removal

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1070

                                                                                                                                                                                                                                        File Deletion

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1070.004

                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1562.004

                                                                                                                                                                                                                                        File and Directory Permissions Modification

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1222

                                                                                                                                                                                                                                        Scripting

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1064

                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                        Pre-OS Boot

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1542

                                                                                                                                                                                                                                        Bootkit

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1542.003

                                                                                                                                                                                                                                        Hide Artifacts

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1564

                                                                                                                                                                                                                                        Hidden Files and Directories

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1564.001

                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                        Network Service Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1046

                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                        4
                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                        5
                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                        Remote System Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1018

                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                        Inhibit System Recovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1490

                                                                                                                                                                                                                                        Defacement

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1491

                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                        • C:\@[email protected]
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          240KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          7bf2b57f2a205768755c07f238fb32cc

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\ProgramData\Hdlharas\dlrarhsiva.exe
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          6.1MB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          5c04248f3b1e6a072b2cd9615d007bcb

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          8ef5eb5b12504f5c412420c5bf618896e4d3da54

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          aefc731ebe32e902c6be703e9db02246312c5add7a808665f62fcd91539e23e5

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          569825687eead866e31018350a71d2399bfe23d3024285041e7b93b2aba8b8e3a97d283fe68236d14e55b39b5c6f9ec9a2f5b1098943d9684cb36c6f53524782

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\ProgramData\Hdlharas\mdkhm.zip
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          b635f6f767e485c7e17833411d567712

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          5a9cbdca7794aae308c44edfa7a1ff5b155e4aa8

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6838286fb88e9e4e68882601a13fa770f1b510a0a86389b6a29070a129bf2e5e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          551ba05bd44e66685f359802b35a8c9775792a12844906b4b53e1a000d56624c6db323754331c9f399072790991c1b256d9114a50fb78111652a1c973d2880af

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ChilledWindows (2).exe.log
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          2KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          6d1fdaa0eab80613585a67eddff3c32d

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f270d9d29c067a7b03d381e52c922ad20a594de5

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          8e4e4153f0340300a69b3f25bfbc9ac720e7595783d683ccfbf7982267e0af1e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          97ac919b5203bc5d26b57be5173cc22f98e6a19eca7822d7e99eed7011d653bbbce64bf4d5e3c35cfc7ed8214d4efe54923819ff41fda95aaa40d485068c54d7

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          152B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          58670ac03d80eb4bd1cec7ac5672d2e8

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          276295d2f9e58fb0b8ef03bd9567227fb94e03f7

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          76e1645d9c4f363b34e554822cfe0d53ff1fce5e994acdf1edeff13ae8df30f8

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          99fe23263de36ec0c8b6b3b0205df264250392cc9c0dd8fa28cf954ff39f9541f722f96a84fbc0b4e42cfd042f064525a6be4b220c0180109f8b1d51bbdef8ff

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          152B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          0d555f014bb8e786a806bc07484ef719

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          0210db8b3cae5fa112103a12cddbcfd13f396c1c

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          58a4da67ddcdb2a8df0a5956e1c8c5bf52baf2a883f7271255d23dfed83caf9c

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          2b0251c8f6060097c317954eea00c3a8a92d70065c60baf77ef07e20c87899b598eb894e2efaf8fc0de9e162b56916ccae542ee2d427ad6b901453981ebad33b

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          152B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          4d9626d24dc5cb7e3752366fd379d42e

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          5cbccb404caf1daff0dd3b02d6dfffef3b55fc1e

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          550129c1788c9d1db6e8cf870164d7c7fd7777e9ae21ae12ed99eeaf1bb0baa6

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          89f799e2fd48660ddf38c943149ec20ebf41206e4f1121f24f852fe7d44230c961170a14e1c90500f0e9842cf668d5616ae5505280d4856e1196a53ed97dd68c

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          30KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          e2bcdc53d14e50b8f40ece616c16731b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          178ce09ecf9a1afe10049d794aa2594f5ff57e0e

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          b986c5addc350cb3047fb0bcdecc1e0e37457c524bc1d05d93a5b5bfa8b7b685

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          9ead10afb785eb54c27271e2ce359d6c0efd7bc4e3d4646a5dea03463b093daf5e7fa7432cb93148c66f0c9db82d8a4d45596834a72de9973ffd2d13063d9c96

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          67KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          88a552e6be1ac3978c49143983276b3a

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          dbf4f4dc62a3da564b1a87b5191dc9a72a9b9423

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          927121d8118a41fa3460b9ad84daeae59ea60dc9607e462b7e1341bea60da8d5

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          125b13be3d209ff5cc12d8f9f12d01d271cd50c2800059241ebb419167c21adfa9d979ff6b8d88052f5d302e98090b7c8ceff4894b397168d8ba6d8a6204fb9a

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          19KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          76a3f1e9a452564e0f8dce6c0ee111e8

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          11c3d925cbc1a52d53584fd8606f8f713aa59114

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          d6b36c7d4b06f140f860ddc91a4c659c

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          63KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          710d7637cc7e21b62fd3efe6aba1fd27

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          8645d6b137064c7b38e10c736724e17787db6cf3

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          88KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          b38fbbd0b5c8e8b4452b33d6f85df7dc

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          386ba241790252df01a6a028b3238de2f995a559

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          37KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          17da64fa4c58f181ade8ed83a36b9311

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f6b6b6e543ce831ed6534ff725956841dd5c8d69

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          96f35b994015bb949352ffd8ba75a0d555a9a7fb3d70afd09f93796218a924e1

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          3cf2a86c54c15577d7258d9ae44d72b724c7b3eb600fd9bdbc21bcdaef5dfe0910999ad16e1bd4301e26eec72858b53b68373928baf891e48d1f9297a2b9c67b

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          eeb2da3dfe4dbfa17c25b4eb9319f982

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          30a738a3f477b3655645873a98838424fabc8e21

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          fbfee0384218b2d1ec02a67a3406c0f02194d5ce42471945fbaed8d03eaf13f3

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d014c72b432231b5253947d78b280c50eac93ab89a616db2e25ead807cab79d4cb88ffe49a2337efb9624f98e0d63b4834ab96f0d940654fc000868a845084fe

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          33KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          3cd0f2f60ab620c7be0c2c3dbf2cda97

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          47fad82bfa9a32d578c0c84aed2840c55bd27bfb

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          29a3b99e23b07099e1d2a3c0b4cff458a2eba2519f4654c26cf22d03f149e36b

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          ef6e3bbd7e03be8e514936bcb0b5a59b4cf4e677ad24d6d2dfca8c1ec95f134ae37f2042d8bf9a0e343b68bff98a0fd748503f35d5e9d42cdaa1dc283dec89fb

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          74KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          bc9faa8bb6aae687766b2db2e055a494

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          34b2395d1b6908afcd60f92cdd8e7153939191e4

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          4a725d21a3c98f0b9c5763b0a0796818d341579817af762448e1be522bc574ed

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          621386935230595c3a00b9c53ea25daa78c2823d32085e22363dc438150f1cb6b3d50be5c58665886fac2286ae63bf1f62c8803cb38a0cac201c82ee2db975c4

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          105KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          24cab279a1b1479cd2848b4cf4db97d8

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          c59c889167dfa25ea85e0ab5b93db29270cd9a3a

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          2feef54f715ea3e6192ec7a9d30e910044968a41d8fe91fc9b1b469ad574df51

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d1ec7ed765e5ec1b5e095a917437ddcd783ad01a1d6025f1125906617afc24e1d3a9cd702616d18c4231e5ffe60e5326a8dee855db42bc417568283c310e5c10

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          155KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          65b00bec774c969842aceb3199fbe254

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          bd464411b9578497f081a5f8b6c04180b6ee0f0a

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          d604e67e9d16b6b3d2f10687a36ec00597c48288fa60bfa957bd3ca78eadceda

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          0c89ad2ca25ecd9058e42ed477bf6cd1512859c7ac63701206a82f2591b2878acc7f9354b6a23245fd186ca9b3c809cf7700c0e3e43f469c37580d8531d3beac

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          109KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          bb3fc9718561b34e8ab4e7b60bf19da6

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          61c958bedf93d543622351633d91ad9dda838723

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          d6ea500b6752094a4c340d4f5ed01afdca1925006077560d9a3f56054cd8d141

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          97da30e9a0d14e6f9151539b77b2216e0f6b6cc4742f075077f9ff92f46f8b97e82f020c562625261eaa01bcf810ce81c0b7b71340ac566aef1bef5a07dac63e

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          53KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          68f0a51fa86985999964ee43de12cdd5

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          bbfc7666be00c560b7394fa0b82b864237a99d8c

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          f230c691e1525fac0191e2f4a1db36046306eb7d19808b7bf8227b7ed75e5a0f

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          3049b9bd4160bfa702f2e2b6c1714c960d2c422e3481d3b6dd7006e65aa5075eed1dc9b8a2337e0501e9a7780a38718d298b2415cf30ec9e115a9360df5fa2a7

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          3051c1e179d84292d3f84a1a0a112c80

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          c11a63236373abfe574f2935a0e7024688b71ccb

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          992cbdc768319cbd64c1ec740134deccbb990d29d7dccd5ecd5c49672fa98ea3

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          df64e0f8c59b50bcffb523b6eab8fabf5f0c5c3d1abbfc6aa4831b4f6ce008320c66121dcedd124533867a9d5de83c424c5e9390bf0a95c8e641af6de74dabff

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          24KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          1deeafca9849f28c153a97f5070355d6

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          03b46b765150a2f308353bcb9838cbdd4e28f893

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          b1639f4ce0285c41f4bd666f3fae4767094e3042b0379646b5ccfe04ef01ec19

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          52122b7e3ca9b58eab42fc652c24b4b8c17c43970f88860372d8377c49c540c31ddc81b519f4d59d34e199571758f82ab2fea0737ac1f847b3d4dd75d7acac19

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          49KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          4b4947c20d0989be322a003596b94bdc

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f24db7a83eb52ecbd99c35c2af513e85a5a06dda

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          96f697d16fbe496e4575cd5f655c0edb07b3f737c2f03de8c9dda54e635b3180

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          2a3443e18051b7c830517143482bf6bffd54725935e37ee58d6464fac52d3ce29c6a85fc842b306feaa49e424ba6086942fc3f0fea8bb28e7495070a38ce2e59

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          43KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          8d1ef1b5e990728dc58e4540990abb3c

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          79528be717f3be27ac2ff928512f21044273de31

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          3bdb20d0034f62ebaa1b4f32de53ea7b5fd1a631923439ab0a24a31bccde86d9

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          cd425e0469fdba5e508d08100c2e533ef095eeacf068f16b508b3467684a784755b1944b55eb054bbd21201ba4ce6247f459cc414029c7b0eb44bdb58c33ff14

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          28KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          bcf8a9566c19c82f4bdb43f53a912bab

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          aedbcfb45eed11b7ad362b53ff32bacec9f932ee

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          52c97dd2602b4d9ac70b61c3dd9b0f9869c5c211e2a4b52e94eda5e150349ae7

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          cfec8603b3eecc261735ddb3d9f292f47e5e34761d73c33b8a1fa1efcf8e07b9b5595a28eac3b238842cf1f63a155b0376840f42ab22ad3186390bcfbc62adfb

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          20KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          8b2813296f6e3577e9ac2eb518ac437e

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          6c8066353b4d463018aa1e4e9bb9bf2e9a7d9a86

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          befb3b0471067ac66b93fcdba75c11d743f70a02bb9f5eef7501fa874686319d

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a1ed4d23dfbe981bf749c2008ab55a3d76e8f41801a09475e7e0109600f288aa20036273940e8ba70a172dec57eec56fe7c567cb941ba71edae080f2fdcc1e0c

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          18KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          d07f175cbd2c52604838bcbd34bf7386

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          1e32ac6ef3b42b664a681867b8243ac04a1d07fa

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          0e733fc8c782ac8a05936c392d72e3079f49dc348019a84103184efd011d8f45

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          8ccd985d4100190e76e1443a1bb4a5b1783d1318200ad51a0ed7ef675ba0e8a4e7f6ba16268240ab86d6e38b9d8b26136ab297672889f6a415fbf11132819973

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001a
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          19KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          382e5a265d13d3280b41f54973289ab3

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e36e2cadb13183bc03fa209b8bceae3384dbb0c4

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          827c580a692dc92d7ae2d2d6acb946352dc61cf7676e27b796548cf793161463

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          1b7b50d939d9db580800fe556149107fb4e062d28fdad79b8481af8e713731a1671e6a8a52f966bab82fc13b7a41fdaa225e133e66aef616048b39beccdad251

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          59KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          063fe934b18300c766e7279114db4b67

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          63KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          668b709219a3bc003ac35038ad55daa8

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          65d4bd0e7a79f6717d00656d3774c9cddce8c536

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          075482464634359e34d7d49320b08882ce1f8c742904910caddcae0db6d86989

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          6bf60d57cd41c555f4f2a205994690882d44da5617de36a144219983f71f6e06112d15816b138cbd7bd37b29b9802f009c3503204c7e2b8b0354b3b3ac16b941

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          153KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          2f3c7b5f9221520efbdb40dc21658819

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          df12f010d51fe1214d9aca86b0b95fa5832af5fd

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          3ba36c441b5843537507d844eca311044121e3bb7a5a60492a71828c183b9e99

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d9ed3dccd44e05a7fde2b48c8428057345022a3bcea32b5bdd42b1595e7d6d55f2018a2d444e82380b887726377ab68fa119027c24ac1dadc50d7918cc123d7b

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          23KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          bc4836b104a72b46dcfc30b7164850f8

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          390981a02ebaac911f5119d0fbca40838387b005

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          0e0b0894faf2fc17d516cb2de5955e1f3ae4d5a8f149a5ab43c4e4c367a85929

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          e96421dd2903edea7745971364f8913c2d6754138f516e97c758556a2c6a276ba198cdfa86eb26fe24a39259faff073d47ef995a82667fa7dee7b84f1c76c2b2

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          01369d5062d49b270c8dd6ab535bc403

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          39c654df64cd7386081da8108f23573f331debab

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          ed672ed37bfdadddb835de8c346655a17b653094197a2d6080e6777fa59785ea

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          de704934135717cb62e4d15ef1666e78b3d43c17ff5d50b279c21a5318ac2ce0cea88ebeb17b66f4668e1ca1a8801bdd6bab0194b157b1da6bd90c71b29da08e

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          27KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          8f388e8f26b9883f0553dc04de05b0ac

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e5be74eb878a6048058ed7f202cfc3b1fd31b85b

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          acd50cbbfd8f330b7ba3845fbebe6583ba3ce08e8516ac8c69c7795327230f1d

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          7290f00bc74e35e3d367d9b187dfd38e6cc578cf334f61dd286e43eca3e344562d024ee9700916abf20f80a0ad80e4c075d91936379b1677e68d4b4272d93f01

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          77KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          3a3dc85ea79c241ff89f0b498140ae78

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          b9cc8d8215568ccfdf38155f700b230f74c8c40e

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          c594ea36aae724386a3a8f93f0cd8c08cbb9e79e8dcdad298ed63b83018fd6d6

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          921c00dd16f9e1c1889788c908d6ea05fc2d731feba66dab44504c243055fd69340e3fc3abfcb7a47858761a1a708b3844f48d3fda38224d3d552c3028bffa1f

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          7836bb99944f630bd23ab0120af532e1

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          cce2f4287655bbc6309ccbc9ea482d822347fff7

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          b9f78b7f679c0c1f6ae679ed5e5d3a02ce33f883dbb681bb5d43c2b1cbb5496d

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          cf9038d5648b13368a147b08f31b2fceaa81e406fd18721d5f3c5cc6dfc1b3fa759b42126aaf423b69cd57539191f2f717fd79d5edba577a5f7a842e145e5989

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          111B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          285252a2f6327d41eab203dc2f402c67

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          819e633581c4f0e1dc5ee7c5e1e901ef

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          37f5354f09f183abd0e30213818d634de311a4dc

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          7f3bf8f728fc25adf2d92c7fa759f6789b2ea6ecdf7b2789ca9da4c454a523a7

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          32d79f5ecd0521a835972f78fa24c60280b15fc5acefbd71f6cb7df8b0bb0c3bf0807cf23ded3dcdb1b85e07c16e3970c29b4102b40bb57f4d0e14d9f9ed6bc4

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          950B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          6b803ecd92d6380e652bd0428b54a5fa

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          fa7b42479cf1613a5894a2920d21cd14d75941fe

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          9859a828e3462ceb0da7fbae5517802eac33560edc7686e75fa2f614f1910262

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          e62d8e507bcc1c7cf98678ddb288db865a7066c6c4be575b8c86a1c8d79c2454204805e607b189aed866eb186c543168a6d4f3c0c72163c48cbb51388eaf0c7a

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          6b29d2fa532cf455036ebd81cb7a36e8

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          8e3509e219fa253c47b0caa64e0f50ca4bca7ed4

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          8ce8805bb0d0779dd942988801ea9af7191f7cddc4e9c01fb40a2e455fd24013

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a4432b5ca046d4afe649e67eb135c9eaf1b1645d40fef2722d6524b10269d1ddac472d04f467b676558701d8107121a1fdcab6e6355a3a9d053ea9c5f47a49e9

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          4183d59e953c6b39cf707b810e06bd75

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          23b77ec5357281b03206385785c626b6c5130a23

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          0370465b69d5ff65e7daa2fe1c8b11b1d93608a93e576da5fcf9808e64b65c73

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          6e6c908128adb0c706f3bad8eb0b7f7a783f36298856d7d3f80891f522d63fd1f90284d74fba20b2b3679a872b6e15ebfd4101a4da9b03a03697564b92fe3b0f

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          6841f0ab7f6b3aad244213ff5f4e33ea

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e109a6a5e382a3ffbe0beaff6cbb09f20f2e3f25

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          1644a40f1f8058d4e042d61db640f56cd2be0eecdeaaa744187ed9262bfeca51

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          bf7129727940d945d82a9c9c1507b462e9a791818505e042db562ad472de848764816310fa800253fc0b792e8d2b21aba91baa0dc07ceec7278622da36b1c9b0

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          5f2b2da1c651846c2bc0e756f4722f6e

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          644d967886d678a008d2cdbfbce43ba9fdb509f2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          2a51568be96d49c580517f8389efc53a00cd2044d33beef866e3567f5bd9effb

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d009c2bcb075f86748096b489b4fa691835c1dbc184f584e07baa2e64f0b611791d7435d6073e29b3a1ca359830ccaa14942604a74f0c7b5972f7089eaab1cb3

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          dbccbbcff54cdee1207e0da3d6ffc491

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e8178e2f92d5a9cdaca00718817f1cef911b1f7d

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          dd78e454a8e6af6b2281bcf81bc8e1d2bc5b2558e49ab59a4e4fde1bf290d519

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          c0e213b514dd3c501557d78e7d2569a0f497ee0243ea238c47f7c086989672b29ec46e03a9e230ce81fe62394306b9102df4309009c64d699f442c92f4a94e05

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          4d905d0793d6d1f57ccae28b0401c584

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          be172554abed25930645fd025d7b70faa8d2f014

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          a15fe46a3025b3153882c34beffb1e4559e02a2eb31cbf08b42132aa52b2b9f6

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          c1717dd332a10e813d7f678d66331cb0cf47b3072b57c2449091d130885d8615c58ead25653733644b692ac3b75c5ecdb3ddd194992c16e8bae357083020dd8f

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          d316d5deb8b68cdc1f45818461719fcc

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          ae6fc41b20560597c76cda5799c7f9000b3aff3a

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          7c0d13585308f67286262ee118f28edfdd6e0b4d94db5275286e35e2be8364c7

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          889c4176278e2432414fe3a03b4683df85e4f61054c3c85845623d06edcd8d49f68f0eaedf975677735de536513ba42b276de6d141ec3dc7e3b5352e360977c0

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          3e91e5077f12c614aeb9f20ecb176f1f

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e54f48a8f58249d2f3d0e5d0183932fa21b02a60

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          fab1630a606958063d432621ce9febd93cbdfcbefd40dad62c145f0b3f82ddda

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          f2a7cefc6cd8cf9f92e3fd5b607adec2a76532cb16463b51aeaecb0f93a1051bd0c71f0e3337b5c108eb17ba1baa3e4fb8690c726dce5ff949773fa252527a9e

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          59419b1e9637ba1997c9a9ad0bda6446

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          85779ed26cdc0dbe79aa54dece7422eb3f8324c9

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          d318be624de3f0e28e8b4fd68af25b1da6b34b53d298251ba68d070f4e17afc2

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          633a1b5e58358471a8daaca601b8ea51b0cdb7a9dfc66a6fee14f5be164e9082e8b4a97ffde21a9b43c19a835f27e69e4a98c354740375110370c1ce7e1e47c1

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          89d0127e9955aad800d24cb7a14d2ad2

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          52dc877d31d2c9f014a3c7682a13b83785501ae0

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          5143246e0602ba22669fa4f4ee089aa19fd0f98a913e911d098bfd2d09717b29

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          4a89687f1bc4fefccc01d34ac18f99e0216f67f41a4c6cbd75684abf7841a8df1608ca44760bdfc9c96ea78ec94ae141e20b41226fd627389a48c025f32bea2e

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          5e49076768e90aea8abdb3b7d0be95fe

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          80b26ffd8f5158d7b136bdda4febfcf4bcdbb864

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          87229a063e66494fc0e36380fbb67d669a90bdb43aec1bc6d1703d571b68d32d

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          053b47bdaed6ccb716e747756f001025a9ded9ef759a154cae40318b8305d419fc11a5a34519211eb6d0ed09bed53e8eb0d75a51c68cbff6a36e4f89c2e3dc90

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          eec5cf80433fdac201691c495de62af3

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          cbf2bd15c570be160323914df51caf223950bd81

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          a51a06b2bdfa8a09207574f85016a147afaf75a844fc0b5b0d89896685442f2e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          2506215dbdb0c8deaf4daad13fbf5938ac724c2c1569076d267aa6538392f6df28b9d05632b123f8c43c54fc47242285ac99c53d6f2a6081acaea9b8c0238b55

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          65852c95fac2ac59423d6919f6b9997b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f12ef558c9d553451d865f72877af3bf78e7f157

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          ca5a7df1e3433fe2903b64203efc97d6dcbde315ae937214b5dbe212e3b12f1d

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          01dd3323bfd2cea29ac718e8d2039e3db1760b90c4e67ac178d509e1a8f3d9266bd77ec43ab41165eae066ef2eced4bd3f451594e589e0b9e3cc6b980b412418

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          e5403c9936dbcb4927bbcfb208833a9e

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          6d6bf23d1ba2ea9f20a0d16d0173c83bc2eb5e02

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          adbe5050f5906bd2148303385178c0ac8ac5271d5c05f5dccca3e285809753b8

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          f21dfc41dc5031b89887180c3060b45afc2c12afbac122b1cedc60227af2f99116be885c12dbcef9b6e5832d676130c1d86d34d07b67bc1838492c3def0e4a66

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          a37fd8907b50a27619485fc6b84b4e2a

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          5d834e36f228629ad44c742c712abb841ebe160e

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          eacbd44c878722c91f5e4aa17a9bc3632e164ec1c88a910188de25f4a0317714

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          7bdfac27cc36fd4cc48ee0c179eb58819fffc91033d330f3d2c4af71ad7ef57a450c6778763a590acbca468f24c4436997ef41f0fc6e1b376361733dee79c416

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          d9f7e9a444384710d80e1d7015b8ccf0

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f1cbb01f78992a5d428b625d80a6f1c6b541e9ce

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          a2ed9f4f3bd7d0cd934d01344ee564983215d14ff47a7cd14021f8b4ccd51ec6

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          39bb8e3c536894aed79b3f694a5e8339abdd2ef74e64032a6e7bc98156a907a21359afcddc231c699ae768a7c6f45f29d5bed1fb632580937f8daa73657866ad

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          3aa91937839aa2b2d756200599961497

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          a2fb70d5460efba0081831703507cb52f4752776

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          4034b6cfc474c602bf8bf8c9581cf73a3bd80c3aebfad7401c0919f8534c4c7f

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          5653c1b2eeaef3d9e5056dab4f29bb522ca866ee81965afaeaee08d1d9571b3f7e276b603c1e195d6da5bc4679ee7073ca8ae726d9b9da1c3db03b9eb404b967

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          0d6e3853dedf4ed2df5786a0887b1772

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          4426bb1f9ef28f3ddb8e6f007fcd1b0ce4407cbd

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          7dde0b88e88d665c6df6e398b265037f8d8ab7e76dd977893b3c04bfcc5acc4a

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          1a761194fba2a9f64e7022b66de72db1b782b25084b0f588f736834b89e12c826306aabca340252576ebeccb7ad3b33b8c22783a8b69c2c25cddbefe12aae8fe

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          f28fe9dd559e0ef3ed16e4003379cd68

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          7c6de9e095b9e2fbca8f34d8549a2758a6642274

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          0b11136622925ce96d7e0383361f4b2cd2f5d8e0787645ac6715aa0628e85947

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a628416a8a17342c5e556537b4ecd07585502e155c4baceb5832521056f0201de21042f39305f214f4a7fb162acecfc8a104debef358912f7ba0addec77898c5

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          5894c442c3700ec051bfab41a40ad2bd

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          c8391f8bd880d664bb1bae6a5e7e64d786db6050

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          44f420695acaf0d0e712480ac709ad038c0b069e8d5cdf5bf9d4e27f328eb756

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          01243022d13a055e4ce27e0d0233981282448701245672da6d8bc037a77004fa30627adfef8c7127d6352a7ec62753c790e9027e015a6cbb16f15181a3bc6d68

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          020120adce3db7641cfd440ec2eb7db5

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          dda26f5c0182847669ff580624284a7d262bf4da

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          0eaefe677832d9761279d01d1e2a5c14185347da94db6db367e005b4a4996879

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d70e77f4ad11cca8c8c186f7a5d77c5db11fc8357c3d5f69539bbf6604c8322716904bb25473f32f7256c1e7d00c08b229c645e02df4fc89671312619b5e7227

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          7eba6de311336d71c0a7df90ca80210b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          aa5c202554d88ff5a0a84a837bf25a9f478018b1

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          c3730b387c6af21d17b6f9fdceb358343306d83c819e30dba47bd82bc2e62e97

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          0510a857501b2688fee4dc0d8c54ccd25b9493d5e226c4705883813a841b3d25bd4aab054760358f2805a42d3ec72d62b7a06dbe472b0d0e2d7bd53f71fc00ba

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          405603a24709bfc8a0c3a0d885eade1b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e71545224d6c6a92485af02caa1324333e0ea0b7

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          6f653f4acb20a1c9117be002dec72ab5e16a0186ebd20cc209c518736ca92623

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          e53fb8e374baa7b4db929c2eb238f0a4050e6e65e0e5f3afcd29175922a7c1b360e87ea37acb1013b7ea466cefcf4fd3721f417208e0c8cc68c88145facd13cc

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          ad9f38efac7494511d67e37aaadaa7b8

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f6521294341a52316b9ce7077e0ba0c701747f5f

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          1ef3096f5f88ee76614a6804b0f1cacc529fd4343e625d1831fa96db7f0a369e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          1950d51f9fba8169a6a4849517a153db511de80db02188d53fb895cfbbe8cd2ee0187a887f3f1bafc99ff7d32f7e3f3d3d51a0f7fef510d5edf5d3a54865678a

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          86e022360e9c59e40b23a1d231af2210

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          683288ce5cc509b610c76d44917e78666804adcb

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          ec742a4d051f885fdd7e03c5e0d1075101d0e3d35688afb1f6903fd5e8355d4e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          12f117ae7d4ea9c13f08a2ae525ea2c8eb849e051a73150e83c3ec96e1929e3679f1caaa3460ba25ffa6b64d8fd6dde8f5b72e29ddb83472d4cc071a9bc34675

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          704f09abab43b387d8eea0e82ab77f0f

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e356cb5ad1c82032f1078ff97feadfc5ee9fa056

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          733e049eb55a4af88c6a31a204d603373512e9ae8961f8b259a4a5aec7664292

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          acce40d6006746ff82f5267b4f4fc306faa115d6c3ffeb6a11cdae342e461dc1da5e7f8ead7393261fd70ca463805c28483fc97f09cc3b156625f39d812ba5f0

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          e0b379956196a7d134b04d4f41a5adbf

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          2003d7e68879c4619106d73b3881319bdb7d6bcc

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          17848cb137b3e163dec210a6fcfb06fa151bf10fec030233559b18d7a2878af1

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          0710cc01b3e13e61178eb1529615e7c1fbb3cac1d3059d21229737718277e5675986c691bdf26477a67589df9dd7135838c6aaac707d2dc2150dc323302fd132

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          ea4020f4938bac343b0f2e1aa1c380b1

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          6852105ce4cd688861be3d4b20e7ecd1a013c048

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          d3b124036f512c601729b5c54bd38144add5fc709a83460f4bac79cb2e2ecbf6

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d1972d6487efbb3960836bfc5fb43708a50e19ce929a2b87cc81ab8e561d21b2bea91209951297be16fd91f709c484d5afa98b86108487a1bd08e577036a4085

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          86e8f9a36f0c58ad06ec856904e741a6

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          407bdfa1617fb5638e01f65051172123b85aafbe

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          3a09e606520d1aa30e158b3e47b9ec14e783a40b6415a82f573137dfc9654c64

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          fd6471faebd9db09d8a89cd985240c00f4d27eed2a26dd43cc25c57157f4f1faf2c1365b09fcc065e3db7a8dca2093552809e2bee7ca8abe8493b823ae13df0b

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          58d583d835e5587ab9dd772eeb4bbc47

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          debdfc918469febe474a70d3fce8a1d462164424

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          0c1dfa9e48c22660ee2303e3f91c3f5c2523dc76019d74c79d55fce013c3f76d

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          16f7f3a66d2fc979d9610d78d6b4b4c538cfb4fce0e93eb21b4c2380ac853a09f7a8fd91c6a8173d85bdb6f5fc4f45f0e1513acbbabca02add6e849a4852d4a0

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d5ed.TMP
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          538B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          4ee7182557652171e0c25937c99aae93

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          9b2905679d03db887c1e6524fdfc0db14df4d29c

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          d6c2b189d5c32c70e8fc7d9b6eb665f3f04db0b573ee8b3d660bcbfc98cad8af

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          e491fc750b66e5d320cc0f64d9ac8d8fbfa9ea5d797f16e99d67f008d33cf0f14f8cb00c22b62c1a686c3ca1b724d5bc8088616697205cf7b12d2ed42acf7e54

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          12KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          7e270121427b98b75c25577348e14b18

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          fe4a87c9b3fe2b6854d5d104f99041e7f3e55744

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          66bb10aeca072ac18fd4c2aebc15cbd2871b7b32841f21e93dcf796f1df3009b

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          3963971a652b944d7bb4ae4537ecb2ad09f2e0279355ac221ae35eb07126f776c98d6fd900e2c11f57e475765690d25302003bfc50dcb578e6cbb0a59b6a4316

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          12KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          931ce22c0cc91c531651ebc8ca9f98a1

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          880593a910fe66e375c5d4a9137033215152c924

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          5664efd594703d170524a600071bf0210d83ab601121f267d7db76a9b5828aca

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d98db4ba66a82d8e9936cf674a15d563d962917f03a5d7c7554b4d795b989556d308402770769e2702b2e96a0c5676d6ced605f1b858e9321777bd3d64b17744

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          640KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          ce30dc550b8088e8702ddc123ddeb5a5

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e98df0ffddfcbf8420d983d45f7bdafde82307d4

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          f9f7d3e7e3059b5b9704886fd9ac6515c851c571a99232c6f234f1573a25a397

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          f48bc801b0e5ec4ab3761af7f221d11f219aa567fa8124db60f6f1edf5e6e2808c788fa0406c53d4308bc8227fb4d089bcc8ebae0296414e5ae4367a7ccd741e

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1024KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          cdf6b5c99e1ff6c560b4f38bfbcf0a8a

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f986f330dfe9559e384a814acc9283410a968a8f

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          32156e353462ba7d7350fd86dab842e38b1b7db24fcac00063f7ae62474b4635

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          071438bea4cb6ce6f7cba0558d9b4b2d8a4f45bf4f403da97b7ef23aadb1ac4aef6dd548997fdfcdbfa515f12664e704a0ff6eb5902078baf56c18097d8ab188

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\OneNote\16.0\cache\_R_E_A_D___T_H_I_S___UQWVK_.hta
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          75KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          aaf8e489ad03d3752c09f1e19883324f

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          683956d31fbe0a89337a3763912a626996cf1f34

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          9a49b90fa8ee6b93f3ad2d607d8d0c133efb1639304c2ab8ae7974a61bb2106a

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a4e6b06e8cfbd34016994f8d9be0153cfbf71de3fa1de92b4d94bc74b826dbfe2b25e7e2496b24e3f2379b5cb4b6d676544005327b938dfcda83766fc929319b

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          9KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          7050d5ae8acfbe560fa11073fef8185d

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\4bnxbpxt\4bnxbpxt.0.cs
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          29KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          be0c48fc5057a467514eec58f1b1264b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          6d656174c6c9ab1e4c3d75cc9270a2aa4079183b

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          8685fc1ef0ff239f59289b26d9aa7134998f4cc4a15b22c9a8922c071bb32639

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          157df2d4ef94906418ea32be5feedc28aac61787033e7473f0eab8e22d32a2a83ddbb5c43c16b0d5f83c8c27f167e1fcf2967df35bdbafca75327dc35ed443f1

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\@[email protected]
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          583B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          111f8de2aee2b54f8d122124888e6b39

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          eab7314b7ece9315a4d8193be1e3602cc8a395cc

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          9db9deecd952ce1005b34e33e38f948bfbd330dc9a923ff70637e20eaba4798c

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          24764256024fb3a34270ec2b8449cb1bb8aead270eb533cc624ea6ec18efa4a275593ee8ebc51e9a86612de2380f88960980483f9e62e8a5193fd0e49a8464e6

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\OneNote\16.0\_R_E_A_D___T_H_I_S___C20DWOIS_.txt
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          3e8696240970031dc24af8f7706ef4b2

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          a683e85eca8c1445f0bd4eb39c26b9a6fa035609

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          3552f0b89c8851c2387f5a879394ec74b376a89457e369152eb4a918b3551ddd

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          2a3cb1ad7c9713c7889205f3a483687b1deceefc609ca505c4142a524b16aa6c7775c4745f82ebdc5ee843f1b01e6bde241b29f8494adced42e122f15d3521e5

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          73B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          9603b6e118964288bcb3dfe2c5609dde

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          204f614dc5fbd692b55ec8056cd4d063d96f38ae

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          11bbb92e7c2aff55aa4d1a6cff600fd1fd3d8ee4219b689a4f7c24de75a70f01

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          fd1b6d4995c99831d7a90954c0593788c073fd5490adf86d0f13edb4fa9cfb6bc4aa425f37aa7d59e93c2b3de655887af098fc70d7b4387f7548e77d5467ee2b

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          896KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          9a3a0157e4687212b533cc7e456209fc

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          115722581d2bc23fe5476aab32e7489d480484d9

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          d09060e33eba81994db5d3d0f7b151a4e8ac781ea68a0c2bf8d8e5d9eb3662bc

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a85edaf36b9cf6c7a10425a7190dbb3a7be99db4643eaaa8b352ce039771250202713664cdfd2812df2c53174a98db7d0766617cfedc4310dfb06123de24d35e

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          933B

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          7e6b6da7c61fcb66f3f30166871def5b

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          00f699cf9bbc0308f6e101283eca15a7c566d4f9

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\Ransomware-Samples-main\Cerber\cerber.exe
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          604KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          8b6bc16fd137c09a08b02bbe1bb7d670

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          c69a0f6c6f809c01db92ca658fcf1b643391a2b7

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          e67834d1e8b38ec5864cfa101b140aeaba8f1900a6e269e6a94c90fcbfe56678

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          b53d2cc0fe5fa52262ace9f6e6ea3f5ce84935009822a3394bfe49c4d15dfeaa96bfe10ce77ffa93dbf81e5428122aa739a94bc709f203bc346597004fd75a24

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\Ransomware-Samples-main\Rex\Ransomware.Rex.zip
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          2.7MB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          50188823168525455c273c07d8457b87

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          0d549631690ea297c25b2a4e133cacb8a87b97c6

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          32856e998ff1a8b89e30c9658721595d403ff0eece70dc803a36d1939e429f8d

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          b1a58ebcc48142fa4f79c600ea70921f883f2f23185a3a60059cb2238ed1a06049e701ccdab6e4ea0662d2d98a73f477f791aa1eec1e046b74dc1ce0a9680f70

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\TaskData\Tor\tor.exe
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          3.0MB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          fe7eb54691ad6e6af77f8a9a0b6de26d

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          53912d33bec3375153b7e4e68b78d66dab62671a

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\msg\m_filipino.wnry
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          36KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          08b9e69b57e4c9b966664f8e1c27ab09

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\msg\m_finnish.wnry
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          37KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          35c2f97eea8819b1caebd23fee732d8f

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\Scanned Documents\Welcome Scan.jpg
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          504KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          73d4281e46a68222934403627e5b4e19

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          0f1c29cea7ea24ebb75c95114e0b0d26438e1d39

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          aac4ac970ec47cd95dc7c65d7d38d29c1f948be24d5dad1d5aa21053125367c7

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          bb7aad10e5accd3f5c0f6b2968973034a2f7c2523401eb234b2de0cdad2dc13f4fd58d08ece94ec06420a52b3d371ba832f8fb4741f48799703bdf32a4daf555

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Admin\Downloads\chilledwindows.mp4
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          3.6MB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          698ddcaec1edcf1245807627884edf9c

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          c7fcbeaa2aadffaf807c096c51fb14c47003ac20

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • C:\Users\Default\Desktop\@[email protected]
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          1.4MB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          c17170262312f3be7027bc2ca825bf0c

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • \??\c:\users\admin\documents\scanned documents\welcome scan.jpg
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          504KB

                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          07b11cb395db18958049e7bf14140b06

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          b79d3c68918609ddfb17987c986e964481873f56

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          8135851e534d45c99be1a771ad5845eea5b83a0f920d34eca5cd4878d7bed454

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          d8e33ef0b58a9ca0b6e263f2a2f615a1a44f5e3a3f4b07927255ffee4213d3b60d5ef8dd6ee20f609e59e1957bf50db1df77161a997509694f2516f80e0c196a

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • \??\pipe\LOCAL\crashpad_5356_WOWMGRGEWQHQVWHR
                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                          d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                          Download Submit
                                                                                                                                                                                                                                        • memory/440-309-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/440-303-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/440-301-0x00000000020A0000-0x00000000020D1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          196KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/440-694-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/440-302-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/440-711-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/440-727-0x0000000000440000-0x0000000000451000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          68KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/440-318-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/440-326-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1116-929-0x0000000000560000-0x0000000000561000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1116-932-0x0000000000400000-0x00000000004A6000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          664KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1116-1385-0x00000000008C0000-0x0000000000989000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          804KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1376-1340-0x00000238A56D0000-0x00000238A5FE4000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          9.1MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1376-1339-0x00007FF9814C0000-0x00007FF981F81000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1376-1342-0x00000238C05D0000-0x00000238C05E0000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1376-1379-0x00000238C05D0000-0x00000238C05E0000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1376-1358-0x00007FF9814C0000-0x00007FF981F81000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1572-1400-0x0000000000400000-0x00000000004C9000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          804KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/1572-1382-0x0000000000400000-0x00000000004C9000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          804KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/2208-930-0x0000000002100000-0x0000000002101000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/2208-935-0x0000000000400000-0x00000000004A6000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          664KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/2208-952-0x0000000002100000-0x0000000002101000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1377-0x0000000073A40000-0x00000000741F0000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1365-0x0000000002CF0000-0x0000000002CFA000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1367-0x0000000005260000-0x00000000052F2000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          584KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1359-0x0000000002D00000-0x0000000002D10000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1373-0x0000000005670000-0x000000000570C000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          624KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1354-0x0000000073A40000-0x00000000741F0000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1368-0x00000000058A0000-0x0000000005976000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          856KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1369-0x0000000005240000-0x000000000524C000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          48KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1353-0x00000000007C0000-0x00000000008A8000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          928KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3164-1372-0x0000000005530000-0x00000000055F9000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          804KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3240-1307-0x00007FF9814C0000-0x00007FF981F81000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3240-1341-0x00007FF9814C0000-0x00007FF981F81000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3240-1308-0x0000015F3E790000-0x0000015F3E7A0000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3240-1306-0x0000015F3CB70000-0x0000015F3CB8E000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          120KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3272-658-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3272-705-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          212KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1078-0x000000001C3A0000-0x000000001C3D8000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          224KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1061-0x00007FF9816D0000-0x00007FF982191000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1121-0x000000001BA60000-0x000000001BA70000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1114-0x00007FF9816D0000-0x00007FF982191000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1060-0x0000000000AC0000-0x0000000000F24000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4.4MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1079-0x000000001C370000-0x000000001C37E000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          56KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1077-0x000000001BA60000-0x000000001BA70000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1130-0x00007FF9816D0000-0x00007FF982191000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1063-0x000000001BA60000-0x000000001BA70000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1064-0x000000001BA60000-0x000000001BA70000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3836-1076-0x000000001C2F0000-0x000000001C2F8000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          32KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3932-1256-0x0000000000020000-0x0000000000022000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3932-1257-0x0000000002900000-0x0000000002936000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          216KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3932-1271-0x0000000002900000-0x0000000002936000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          216KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/3932-1270-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          340KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/4136-931-0x0000000002210000-0x0000000002211000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/4136-964-0x0000000002210000-0x0000000002211000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/4136-936-0x0000000000400000-0x00000000004A6000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          664KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-729-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-730-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-731-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-735-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-736-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-737-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-738-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-739-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-740-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5100-741-0x000001FFF78C0000-0x000001FFF78C1000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5524-1411-0x0000000002E20000-0x0000000002E2A000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5524-1405-0x0000000005560000-0x0000000005570000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5524-1416-0x0000000073A40000-0x00000000741F0000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/5524-1401-0x0000000073A40000-0x00000000741F0000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          7.7MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6048-1250-0x0000000002170000-0x00000000021A6000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          216KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6048-1260-0x00000000001C0000-0x00000000001C2000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6048-1248-0x0000000000400000-0x0000000000455000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          340KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6048-1249-0x00000000001C0000-0x00000000001C2000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          8KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6048-1268-0x0000000002170000-0x00000000021A6000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          216KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6096-1388-0x0000000000400000-0x00000000004ED000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          948KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6096-1421-0x0000000000400000-0x00000000004ED000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          948KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6096-1167-0x00007FF9816D0000-0x00007FF982191000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6096-1143-0x00007FF9816D0000-0x00007FF982191000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6096-1144-0x000000001BE10000-0x000000001BE20000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6096-1145-0x000000001BE10000-0x000000001BE20000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6096-1148-0x000000001BE10000-0x000000001BE20000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                          Download
                                                                                                                                                                                                                                        • memory/6096-1163-0x00007FF9816D0000-0x00007FF982191000-memory.dmp
                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                          10.8MB

                                                                                                                                                                                                                                          Download