Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

2024-04-30...ry.exe

windows10-2004-x64

Resubmissions

30/04/2024, 19:18

240430-x1bx5aga38 10

30/04/2024, 18:59

240430-xm42rafe58 10

Analysis

  • max time kernel
    641s
  • max time network
    734s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/04/2024, 19:18

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    2024-04-30_c9f6fc22d04c4d56622e9322d1a34d70_wannacry.exe

  • Size

    1.1MB

  • MD5

    c9f6fc22d04c4d56622e9322d1a34d70

  • SHA1

    d45ed6385e183456f1d0f68aba47727df1d38256

  • SHA256

    b7b3f9f8e59c42d40505a0e53039b69ba969b84b14d31a71557f5a09855b678a

  • SHA512

    f73342e15b3f1fb180f845950ed90f0fdc9c54f1040d457d78f2a13be445d65650dca455b254254db566e81b4c089539370edda3ef76a4c5bbc32ea7aaaa40e2

  • SSDEEP

    12288:o7YHBR9ideJWmXm+if5BYstvfCjqf2KqY5UBx2qIYvnv+pkiccfIzdLzsb4D7ZfL:ogBNq5u0v6AUjBfLyZEi

Score
10/10
chaosevasionpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\Users\Default\read_it.txt

Ransom Note
(Explanation) Shit well unfornatley you have fallen for my ransomware. Meaning that all of your personal files like your images, videos, applications etc are locked. In order to get your files back you will need to pay a small fee of 0.0008 bitcoin. You may be asking yourself well how the fuck do I get bitcoin and or what is bitcoin. Well bitcoin is a digital currency that can be converted into USD anonymously. Buying bitcoin is super easy you can buy it at bitcoin atms near you or applications on your phone which I will If you do not care about your files they will automatically be deleted in 2 days or you can reset your computer. If you do care about your files then please follow the instructions to successfully recover your files. Step 1: Create a bitcoin wallet on your phone or whatever mobile device you are using. DO NOT create a bitcoin wallet on your computer or you could possibly lose all of your funds (I'm saving you the trouble of losing out on even more of your money). I would recommend downloading the wallet 'Cake Wallet'. It is very simple to use for begginners and works great it is available on the apple app store and google play store aswell. Step 2: You Will need to buy bitcoin to pay the ransom in recovering your files. Some places to buy bitcoin could be for example https://coinflip.tech (This is a website that tells you where the nearest bitcoin atm is from you the fee is 15.99% so you may need to bring more cash with you.) You can fill your wallet up until you have enough to send the ransom and cover the fee you need to pay me the fees on sending bitcoin usually sits between $4-$6. If you have cashapp you can try sending bitcoin that way aswell there is a place where you can invest into bitcoin I would recommend watching videos on buying and sending it. Step 3: Once you have boughten bitcoin you will need to send it. Please scan the QR code that is shown in my wallpaper. The wallpaper is on your computer if you have not already seen it. If you are unsure on how to scan it with a bitcoin wallet you made on your mobile device then please scan the qr code by going into your camera app and hovering over it. It should pop up with a bitcoin address once you get the bitcoin address then send the required bitcoin. You can also use snapchat's camera to scan bitcoin QR codes. If you are using cake wallet select that 'fast' option for a fast confirmation the faster I can confirm that the bitcoin has been sent to my bitcoin address the faster you will get your files back. If you are using cash app to send the bitcoin select the fastest option for a quick payment. Step 4: Contact my email once the bitcoin is sent again the bitcoin needs to be sent from a different device other then the infected computer in order to make a smoothe and quick transaction. My Email: [email protected] Step 5: A decrypter will be provided to you once the payment is sent make sure that you disable virus protection temporaily again to decrypt your files. To decrypt please drag the private key into the decrypter application it should say 'Open With' and just hit 'more info' and select yes if needed to run it. After it is ran your files will then successfully be unlocked and in your possession. If a payment has not been made within 2 days all of your personal files on your computer such as your pictures, passwords, any data, private logs, etc will be sent out on to the darkweb or (The Tor Browser). As well as any connected USB's or backup drives will also have been infected and they will be sent out on the dark web as well. It is important to have good communication with me or if my one of my workers (who spread the malware on your computer) is helping you out for example make such that they can verify that the payment has gone through. No further warnings will go out. Once again please make a crypto wallet on a different device other then your computer because there is a high chance that you will lose your funds using your computer. So Again I recommend using a Phone or any other mobile device that you have. If you forgot how much to send in bitcoin to the qr code it was 0.0008 Bitcoin Again my email to contact me at is: [email protected]
URLs

https://coinflip.tech

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 2 IoCs
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Renames multiple (223) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Modifies Installed Components in the registry 2 TTPs 64 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 29 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks system information in the registry 2 TTPs 2 IoCs

    System information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 3 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 19 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 31 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-30_c9f6fc22d04c4d56622e9322d1a34d70_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-30_c9f6fc22d04c4d56622e9322d1a34d70_wannacry.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1056
    • C:\Users\Admin\AppData\Roaming\Installer.exe
      "C:\Users\Admin\AppData\Roaming\Installer.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Sets desktop wallpaper using registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:116
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4960
        • C:\Windows\system32\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:4628
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3520
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5116
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} bootstatuspolicy ignoreallfailures
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1392
        • C:\Windows\system32\bcdedit.exe
          bcdedit /set {default} recoveryenabled no
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:1148
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3624
        • C:\Windows\system32\wbadmin.exe
          wbadmin delete catalog -quiet
          4⤵
          • Deletes backup catalog
          PID:3876
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:4568
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2088
  • C:\Windows\system32\wbengine.exe
    "C:\Windows\system32\wbengine.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2328
  • C:\Windows\System32\vdsldr.exe
    C:\Windows\System32\vdsldr.exe -Embedding
    1⤵
      PID:2748
    • C:\Windows\System32\vds.exe
      C:\Windows\System32\vds.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:3364
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
        PID:4456
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe"
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4860
        • C:\Windows\system32\tasklist.exe
          tasklist
          2⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1680
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im OfficeClickToRun.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3732
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im
          2⤵
          • Kills process with taskkill
          PID:1640
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im Installer.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:840
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im WmiPrvSE.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:464
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2656
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4260
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:5048
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:2756
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:3672
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:2656
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:1784
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:3728
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:4624
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:4296
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:1400
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:1248
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:4064
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:2604
        • C:\Windows\system32\taskkill.exe
          taskkill /f /im sihost.exe
          2⤵
          • Kills process with taskkill
          PID:2736
        • C:\Windows\system32\tasklist.exe
          tasklist
          2⤵
          • Enumerates processes with tasklist
          PID:4112
        • C:\Windows\explorer.exe
          "C:\Windows\Explorer.exe"
          2⤵
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:3548
        • C:\Windows\explorer.exe
          "C:\Windows\Explorer.exe"
          2⤵
            PID:2608
          • C:\Windows\explorer.exe
            "C:\Windows\Explorer.exe"
            2⤵
              PID:412
            • C:\Windows\explorer.exe
              "C:\Windows\Explorer.exe"
              2⤵
                PID:2552
              • C:\Windows\explorer.exe
                "C:\Windows\Explorer.exe"
                2⤵
                • Modifies registry class
                PID:4252
              • C:\Windows\explorer.exe
                "C:\Windows\Explorer.exe"
                2⤵
                  PID:4748
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                1⤵
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1416
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe5ce146f8,0x7ffe5ce14708,0x7ffe5ce14718
                  2⤵
                    PID:4720
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
                    2⤵
                      PID:4508
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4956
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
                      2⤵
                        PID:4984
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
                        2⤵
                          PID:5116
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
                          2⤵
                            PID:1044
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
                            2⤵
                              PID:3232
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
                              2⤵
                                PID:4524
                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
                                2⤵
                                  PID:2456
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4976
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
                                  2⤵
                                    PID:3548
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
                                    2⤵
                                      PID:3756
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
                                      2⤵
                                        PID:976
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
                                        2⤵
                                          PID:3424
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:1
                                          2⤵
                                            PID:1048
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
                                            2⤵
                                              PID:3940
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
                                              2⤵
                                                PID:1404
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
                                                2⤵
                                                  PID:4536
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1707407436609148517,16566416781289852484,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3180 /prefetch:2
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1136
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:1424
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:680
                                                  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                    1⤵
                                                    • Drops file in System32 directory
                                                    • Checks processor information in registry
                                                    • Enumerates system info in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3756
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:4676
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe /LOADSAVEDWINDOWS
                                                      2⤵
                                                      • Modifies Installed Components in the registry
                                                      • Enumerates connected drives
                                                      • Checks SCSI registry key(s)
                                                      • Modifies registry class
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      PID:404
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:2872
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:1620
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:3428
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:5100
                                                  • C:\Windows\system32\sihost.exe
                                                    sihost.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    PID:1992
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:2584
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:2868
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                    • Modifies Installed Components in the registry
                                                    PID:4152
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                    • Modifies Installed Components in the registry
                                                    • Modifies registry class
                                                    PID:5044
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:3608
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Modifies Installed Components in the registry
                                                      PID:1732
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Modifies Installed Components in the registry
                                                      PID:4200
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                      • Modifies Installed Components in the registry
                                                      PID:624
                                                    • C:\Windows\explorer.exe
                                                      C:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding
                                                      1⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • Enumerates connected drives
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious behavior: AddClipboardFormatListener
                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4596
                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Modifies system executable filetype association
                                                        • Registers COM server for autorun
                                                        • Checks system information in the registry
                                                        • Checks processor information in registry
                                                        • Modifies Internet Explorer settings
                                                        • Modifies registry class
                                                        • Suspicious behavior: AddClipboardFormatListener
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2720
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                      1⤵
                                                        PID:1616
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                        • Modifies registry class
                                                        PID:2872
                                                      • C:\Windows\System32\rundll32.exe
                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                                                        1⤵
                                                          PID:1252
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1020
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Modifies Installed Components in the registry
                                                            PID:2472
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                            • Modifies Installed Components in the registry
                                                            PID:2296
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:4928
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                              • Modifies Installed Components in the registry
                                                              PID:116
                                                            • C:\Windows\helppane.exe
                                                              C:\Windows\helppane.exe -Embedding
                                                              1⤵
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:4876
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:4092
                                                              • C:\Windows\system32\OpenWith.exe
                                                                C:\Windows\system32\OpenWith.exe -Embedding
                                                                1⤵
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2768
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:3076
                                                                • C:\Windows\explorer.exe
                                                                  explorer.exe
                                                                  1⤵
                                                                    PID:1160
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                    • Modifies Installed Components in the registry
                                                                    PID:3856
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:4732
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                      • Modifies Installed Components in the registry
                                                                      PID:1804
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                      • Modifies registry class
                                                                      PID:2744
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                      • Modifies registry class
                                                                      PID:1028
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                      • Modifies registry class
                                                                      PID:1784
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                      • Modifies Installed Components in the registry
                                                                      PID:3588
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:3084
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Modifies registry class
                                                                        PID:4828
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Modifies Installed Components in the registry
                                                                        PID:2512
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Modifies Installed Components in the registry
                                                                        PID:3300
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Modifies Installed Components in the registry
                                                                        PID:5096
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Modifies Installed Components in the registry
                                                                        PID:4076
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Modifies Installed Components in the registry
                                                                        • Modifies registry class
                                                                        PID:676
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                        • Modifies Installed Components in the registry
                                                                        PID:4660
                                                                      • C:\Windows\System32\rundll32.exe
                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                        1⤵
                                                                          PID:3164
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                          • Modifies Installed Components in the registry
                                                                          PID:1424
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe
                                                                          1⤵
                                                                            PID:620
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                            • Modifies Installed Components in the registry
                                                                            PID:2608
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:2500
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                              • Modifies registry class
                                                                              PID:4392
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                              • Modifies Installed Components in the registry
                                                                              PID:3728
                                                                            • C:\Windows\explorer.exe
                                                                              explorer.exe
                                                                              1⤵
                                                                                PID:4196
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                • Modifies registry class
                                                                                PID:1040
                                                                              • C:\Windows\explorer.exe
                                                                                explorer.exe
                                                                                1⤵
                                                                                  PID:4032
                                                                                • C:\Windows\explorer.exe
                                                                                  explorer.exe
                                                                                  1⤵
                                                                                    PID:3640
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe
                                                                                    1⤵
                                                                                      PID:4016
                                                                                    • C:\Windows\explorer.exe
                                                                                      explorer.exe
                                                                                      1⤵
                                                                                        PID:4048
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                        • Modifies Installed Components in the registry
                                                                                        PID:4684
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                        • Modifies Installed Components in the registry
                                                                                        PID:3632
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                        • Modifies Installed Components in the registry
                                                                                        PID:180
                                                                                      • C:\Windows\explorer.exe
                                                                                        explorer.exe
                                                                                        1⤵
                                                                                          PID:2024
                                                                                        • C:\Windows\explorer.exe
                                                                                          explorer.exe
                                                                                          1⤵
                                                                                            PID:1872
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                            • Modifies Installed Components in the registry
                                                                                            PID:4744
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                            • Modifies registry class
                                                                                            PID:2484
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                            • Modifies Installed Components in the registry
                                                                                            PID:4416
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                            • Modifies Installed Components in the registry
                                                                                            PID:2468
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                            • Modifies Installed Components in the registry
                                                                                            PID:4168
                                                                                          • C:\Windows\explorer.exe
                                                                                            explorer.exe
                                                                                            1⤵
                                                                                              PID:1060
                                                                                            • C:\Windows\explorer.exe
                                                                                              explorer.exe
                                                                                              1⤵
                                                                                                PID:3372
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                • Modifies Installed Components in the registry
                                                                                                PID:1960
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                1⤵
                                                                                                • Modifies registry class
                                                                                                PID:2436
                                                                                              • C:\Windows\System32\rundll32.exe
                                                                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {515980c3-57fe-4c1e-a561-730dd256ab98} -Embedding
                                                                                                1⤵
                                                                                                  PID:840
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                  • Modifies Installed Components in the registry
                                                                                                  PID:4544
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                  • Modifies Installed Components in the registry
                                                                                                  PID:4892
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                  • Modifies Installed Components in the registry
                                                                                                  PID:1228
                                                                                                • C:\Windows\explorer.exe
                                                                                                  explorer.exe
                                                                                                  1⤵
                                                                                                    PID:3976
                                                                                                  • C:\Windows\explorer.exe
                                                                                                    explorer.exe
                                                                                                    1⤵
                                                                                                      PID:2924
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                      • Modifies Installed Components in the registry
                                                                                                      PID:2660
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      explorer.exe
                                                                                                      1⤵
                                                                                                        PID:3516
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Modifies Installed Components in the registry
                                                                                                        PID:3092
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                        • Modifies Installed Components in the registry
                                                                                                        • Modifies registry class
                                                                                                        PID:1396
                                                                                                      • C:\Windows\explorer.exe
                                                                                                        explorer.exe
                                                                                                        1⤵
                                                                                                          PID:3972
                                                                                                        • C:\Windows\explorer.exe
                                                                                                          explorer.exe
                                                                                                          1⤵
                                                                                                            PID:3760
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                            • Modifies Installed Components in the registry
                                                                                                            PID:3684
                                                                                                          • C:\Windows\explorer.exe
                                                                                                            explorer.exe
                                                                                                            1⤵
                                                                                                              PID:1816
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                              • Modifies registry class
                                                                                                              PID:3600
                                                                                                            • C:\Windows\explorer.exe
                                                                                                              explorer.exe
                                                                                                              1⤵
                                                                                                                PID:1448
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                • Modifies Installed Components in the registry
                                                                                                                PID:3940
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                • Modifies Installed Components in the registry
                                                                                                                PID:2548
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                1⤵
                                                                                                                  PID:1356
                                                                                                                • C:\Windows\explorer.exe
                                                                                                                  explorer.exe
                                                                                                                  1⤵
                                                                                                                    PID:1788
                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                    explorer.exe
                                                                                                                    1⤵
                                                                                                                      PID:1460
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                      • Modifies Installed Components in the registry
                                                                                                                      PID:4356
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                      • Modifies Installed Components in the registry
                                                                                                                      • Modifies registry class
                                                                                                                      PID:3916
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                      • Modifies Installed Components in the registry
                                                                                                                      • Modifies registry class
                                                                                                                      PID:2200
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                      • Modifies Installed Components in the registry
                                                                                                                      PID:3912
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                      • Modifies Installed Components in the registry
                                                                                                                      PID:540
                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                      explorer.exe
                                                                                                                      1⤵
                                                                                                                        PID:4748
                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                        explorer.exe
                                                                                                                        1⤵
                                                                                                                          PID:960
                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                          explorer.exe
                                                                                                                          1⤵
                                                                                                                            PID:3944
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                            • Modifies Installed Components in the registry
                                                                                                                            PID:4844
                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                            explorer.exe
                                                                                                                            1⤵
                                                                                                                              PID:2068
                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                              explorer.exe
                                                                                                                              1⤵
                                                                                                                                PID:4228
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe
                                                                                                                                1⤵
                                                                                                                                  PID:976
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe
                                                                                                                                  1⤵
                                                                                                                                    PID:1420
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                    • Modifies Installed Components in the registry
                                                                                                                                    PID:3840
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                    • Modifies Installed Components in the registry
                                                                                                                                    PID:4640
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                    • Modifies Installed Components in the registry
                                                                                                                                    PID:3592
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                    • Modifies Installed Components in the registry
                                                                                                                                    PID:4580
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                    • Modifies Installed Components in the registry
                                                                                                                                    PID:536
                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                    explorer.exe
                                                                                                                                    1⤵
                                                                                                                                      PID:5000
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                      • Modifies Installed Components in the registry
                                                                                                                                      PID:1728
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      explorer.exe
                                                                                                                                      1⤵
                                                                                                                                        PID:4976
                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                        explorer.exe
                                                                                                                                        1⤵
                                                                                                                                          PID:2456
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                          • Modifies Installed Components in the registry
                                                                                                                                          PID:3864
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          explorer.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:4040
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Modifies Installed Components in the registry
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:2764
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Modifies Installed Components in the registry
                                                                                                                                            • Modifies registry class
                                                                                                                                            PID:3388
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Modifies Installed Components in the registry
                                                                                                                                            PID:3172
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Modifies Installed Components in the registry
                                                                                                                                            PID:268
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:2948
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                              • Modifies Installed Components in the registry
                                                                                                                                              PID:5088
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                              • Modifies Installed Components in the registry
                                                                                                                                              PID:2064
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                              • Modifies Installed Components in the registry
                                                                                                                                              PID:2416
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                              • Modifies Installed Components in the registry
                                                                                                                                              PID:1868
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                              • Modifies Installed Components in the registry
                                                                                                                                              PID:2408
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                              • Modifies Installed Components in the registry
                                                                                                                                              PID:2668
                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                              explorer.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:4476
                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                  PID:436
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies Installed Components in the registry
                                                                                                                                                  PID:4620
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies Installed Components in the registry
                                                                                                                                                  PID:3252
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                  • Modifies Installed Components in the registry
                                                                                                                                                  PID:1336
                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                  explorer.exe
                                                                                                                                                  1⤵
                                                                                                                                                    PID:2124
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    explorer.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:2260
                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                      explorer.exe
                                                                                                                                                      1⤵
                                                                                                                                                        PID:1064
                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                        explorer.exe
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2432
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:3860
                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                            explorer.exe
                                                                                                                                                            1⤵
                                                                                                                                                              PID:888
                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                              explorer.exe
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4604
                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                explorer.exe
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4104
                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                  explorer.exe
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3628
                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                    explorer.exe
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:3524
                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                      explorer.exe
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1984
                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                        explorer.exe
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:4280
                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                          explorer.exe
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:4556
                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                            explorer.exe
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4852
                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                              explorer.exe
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:3668
                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                explorer.exe
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4144
                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:4912
                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:4060
                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:1648
                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:4408
                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2336
                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:2160
                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:1680
                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2508
                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:380
                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:2832
                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:2184
                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:4996
                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:4832
                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:32
                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:3924
                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:288
                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:3744
                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:3792
                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5132
                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:5292
                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:5444
                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:5748
                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:5900
                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:6068
                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:2080
                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:5372
                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:6024
                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:4180
                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:4612
                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:5632
                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:5808
                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                explorer.exe
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:5976
                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                  explorer.exe
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:2400
                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:5216
                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                      explorer.exe
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:5348
                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                        explorer.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                          explorer.exe
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:5628
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            explorer.exe
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:5816
                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                              explorer.exe
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:2564

                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                              Command and Scripting Interpreter

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1059

                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1546

                                                                                                                                                                                                                                                                              Change Default File Association

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1546.001

                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                              Event Triggered Execution

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1546

                                                                                                                                                                                                                                                                              Change Default File Association

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1546.001

                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                              Hide Artifacts

                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                              T1564

                                                                                                                                                                                                                                                                              Hidden Files and Directories

                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                              T1564.001

                                                                                                                                                                                                                                                                              Indicator Removal

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1070

                                                                                                                                                                                                                                                                              File Deletion

                                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                                              T1070.004

                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                              7
                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                              Process Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1057

                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                              7
                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                              7
                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                              Defacement

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1491

                                                                                                                                                                                                                                                                              Inhibit System Recovery

                                                                                                                                                                                                                                                                              4
                                                                                                                                                                                                                                                                              T1490

                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\COMPARERECEIVE.PPTM.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                133KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                aa36379f90dd7cb1df02848ee4388a0c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                80b70f3b077e2247af31bc6c5ee41bb534d57943

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                5cb34cc00a99157c3b66b4f5afd8098e350b5d0030a8cc91b6f7941ab9e3f412

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                a31ec95592a8423bd4d4887935e60a974d0e0a9b5a085a83606b956466b94efebe8236e692f3c6cf93a24371358317d443e305ba738d441b623d58d99f3c3f01

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\CONVERTRESTORE.CMD.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                319KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                6bcefee257395fe6abb3482f698b7179

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                49e650ec3e9cf9488477734b6cdeaaa631d0589d

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                c2a061e38e4ab355ba15d1b9d1cfbf14f0f6fe6322776d98ca039cd90f385d98

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                a72e87e1fc62411a76b05001127e4fcbf81e1dc0b00885ca37198fd17e4a49daf696ec1ccece97d8f9c239b76f14fda4e2102027e58e0f8705604e1dcc5da4bb

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\COPYCHECKPOINT.M2TS.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                261KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                4e46fd29f84a1e269bb438ae2b0622a4

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                583a713300e61270809f8a507be4bc23630ae405

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                78b7bb99b3bd27434d8a695df1be3d3d9a5d44ca6266d797b91ea0255628ef5c

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                a796c4aaed7711f40cfd987bedbdf68776e54efbeab389c44dbf1d55e9067a4aea71f9e6ec7a2163a90ba0c0a359c470b887e4850365639f68689b1cbf4feec2

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\DENYREDO.AVI.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                215KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                39634e9334f7d242b594736f2dd4b06e

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                cfc45791d822d1062439024577f41db500d30182

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                9553c2c372f3c72f8005dfd42b7fa108f906fd5fb55b3fdea2685fc65d9ff5ea

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                d6041eacb97427edc7e7c23c993616b872844b700ab1f2f1c557466f0158ae4dfa309c1c9ef13932e1d627cbe8558d50fa2197a1e4c386e52273197a7a71ed0d

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\DISCONNECTRECEIVE.LNK.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                191KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                be025882a0e13752a71db7d209dcfdb2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                d5e2a90bf02ce8912fbdc8bf2b98495f0093c930

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                c44752e39f032e5644f412d2deccc4ddb6eb3f19b96ab0ccfad7b7aea180bfe5

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                5f4153382bc7c3a0647d01de2f79bfddeaae6be622fc11d106b751b7cbb325e8a20afb545a6e29518f8460598cffc20c45866f8855486cb3e427b620e0747e72

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\EXITSWITCH.MPEG.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                157KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                9e05bf38fb47513a90449d1e06f83060

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                96cd37c63d2b26d943ede17c5baa7cbe90292ee0

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                fe7d68d4e1eb34e15d7316f4ad76d1de3442cf661c3b539860a03323c2767be8

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                7d624514a37eabba91a0ae982dd1163bf5b59d7166dda6e4bde33c3ec0445d6e4ac7e78fcc0be2bc77351965eaa7680db25607dcf5ecd9e28b5db59db20b4ec9

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\GRANTCONVERTTO.ICO.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                308KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                418c0fbcce56c5097ca631a5fd710766

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                ae27dc2f80aa99bc160928a53d58df6f60e43914

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f309378ecbf3a53afb9f388411430c741a2eda79786939a06f4a653530cc0d73

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                6ee85c50f44d101480ab3e3dd41efc4778b7748c8485fe37011e2801c1b78b1aac9cc0136841bf3a96bcb40abbbe4e4ad52b88179a384573c6031eb53aa31de1

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\INITIALIZEENABLE.MP4V.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                476KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d6736c20476c2966b44ad57540016966

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4a0669bbbe9e1ef6072cb7ac9bda4f2aa5bdaebb

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                94b210f8ae2a4ae8a22cc79533e4fcc0b4af3c50016dc305d28d4891e901100c

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                9f0220d73200914702db5d2a503483cf708eff0b6c1b1130bfabb0b87ad861f5e67204235470d290a8791b6af095fcfc7e3ca272e755afbff96503f1f7c6364c

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\MICROSOFT EDGE.LNK.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d8293fa271ef7ab67b9dfb7e58023041

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                4e0554f8a830eb230fb1f988a437ffc4c410b5f3

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                ae15f74bbee633f49aff165a2c38a7e4a57d8855e4c57d454f909f48e6092227

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                4fe416db14ad1aa77b2925a6033ab4f2381cf2388a4f73a615972fb93b0bd9b87e40be9ce510179801f3eb15af53bd9b6c68068d7bbc76d26178463008a9ea34

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\PROTECTMOVE.AIFC.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                122KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d6991582547a6e825944816310417f6a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                6c035329654944e279030d6bf5b2dc32183c5968

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                cd3011a704e81537440224405c9b25c8464d3067e45bbd12c735a5af01dd78c7

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                61fa1edbf42a56a6fd1b281eccdfcb0a62b35034d8d95fba590df1e53d367f1bb9b4800e2ff9c12307405185a75ce1227e87a261190b721d4b8b95d3fee727f4

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\READRESTORE.DOC.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                331KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                4f83e0e3f0a379b8f738bbd72620ffd3

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                cc11efc1519e9a7afe41c5f794f98dbaebbb8af4

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                891fd081613da461216dea5da6bd4a09da4fd0db60483346d522233d379b3423

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f32934fc21b424d7fe975a0bd0260315b1e809658c2b44cf742ad682293d597bfdda8abfcf3888888db4bd5137bedd2ccd3a8c1b193bb35588128a9392ec387b

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\RECEIVESTART.JPEG.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                8e0ad3610557bf42000cbedbd822e5c1

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                c1040245aba65d117bd6c176742069be2ed12399

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f35816d60787ea18ad59bb0e6f3d032ff84b62a3a2bc10345a37b2536cfc9498

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                a7fcf68aa1d1b325095d7e7e5f15a4136a89ef7ce3f21c4e874ee803504ec21ab9911dd4a2e3cdb5a5b39aa9cfbabe0b6adb061020ba86a9411ec56adc6242a1

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\REMOVETEST.DWG.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                180KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                8e48b9c7630b0c9e4795816fecfe0920

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                fd20870dc1884157562507e0cf857a3d7e5451a4

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                498cab08fbb619b2bccb36ada54d3585381b1bea7570849bbd642df09d9dd8d1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                836a21fef53fda32bf52747d2f5049bfcb29dfff1caddc949900947951abcee37189612edc1233da26d2eef3ae929d17162cbdacc7b80654b7bdf1b73075eae6

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\SENDSWITCH.TIF.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                203KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                8640ef43f5b3df2931b36f569603c144

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                ce211e599b5f3990382ffe26315bbec7078fa994

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                7baf15d83e9fa401f85f6d61337fbd29e7a4f3ed2cb85375de4bcea896e8f2fa

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                0b75c5d1af027b7ea416a10273520de04d0dccccb030ff0628852040cf81d6f97b6f4383b82f0c2667c1bfe73028e3e25665be5c337f6e9e1247096cac369d34

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\SKIPCONVERT.JPEG.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                249KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                e2a95f74d58d039cd79338bf82a4a208

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                1e085245637027c5d7b723a31ccb07bdf62e87cc

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                bc5aeb014076c8fa4ad414239f82fcb12efb6f55bf2a040eed6da2030dffe124

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                1524ee3162467c89dfc8c96be5d97e706fc91172dcd52f613c0f36f94c45245a050ca4d618df90d5a99a550c887de5578ea6cd1cb18a7d75ba7ac5731ae5981a

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\SPLITRESIZE.XLSM.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                284KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1562362f5a1740fb3907d2be3842445d

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                f2a405d527cce9ddd791acc8e7c70ff20c91b173

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a24a28823eeb8372da79a153e05fa456d65b4c8a4b556e58860505efde2e7fd2

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                81f4d527a024d0bbef7116d26067ab56a8021a0b35e086dfb074348ac3e95659e3e3c6ef5784d680ed3f693415373348520a3fc68620bb7d9fb6432627381d95

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\SUBMITREMOVE.CSS.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                273KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                953b5019ad3f0d079c1d3809d942f606

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                d855764b331ec6e6e567c8f57bb0cf7cd767af97

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                360df6d4e371143ae6932251f36e51821d8053f0c96043210591bf1f332c7145

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                19c49e8bfe7e25f912a960c0982e6989baf317ad44a8edf23371053ad4f0296a3acff5e8a557382bb03d69bc32b861bff152f1acc0774200d7affb4f8b56dff4

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\UNLOCKRESET.AIFC.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                238KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                806240c08c87af187c2cee3c79e4a4c9

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                9e786268720951814f336020ba8b0718c365a5e7

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                97762f2d582213c23e22bd62b9e8f7a6a22a26964d20806c41ce3c03a7e5f3df

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                d201137b232c95388c7aea20093bc71e9a658432b5f70d0b6a6ea8140d2acb494b98d111a691446d281b8ea662660f7bac79bda668bc7bad5a2a8d66123b526a

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\UNREGISTERMOVE.WMV.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                145KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                b0d2c4ce1ca9ba60fa13eb57b7f913ad

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                bdb7cd9c8575fe9a459f6395c8a3cc551ee046b5

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                6803c96547ead9aa63f280ab4d96350b79ea9efc5e780397dff6a7040fe7ade3

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                bdb75df96c3766d6283618ed6b03a2771b693ef5c1292b0da0367aa19028dcd29a56be81ca0f7eacfa0283e2c3166980943c252f276365383e2452d1758e67dc

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\ADMIN\DESKTOP\UPDATERESET.VBS.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                226KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                0bd7f4f6e4d2310175143813c9ba59f1

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                9b4a90bb0bc330fd6880b2e6ee91bad754e58985

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                f5e6f094c4002af7ed36ccab89441d9e82a79321ff9cbfdda14bf833dff5749f

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                a9823a975b684bca664861a91d8f31e33ab7be82f8544696215abaf28b6b783a5a123ed6d10a6bf4b00f153ed5bbfc16af9c0548039e933005a1579677ad82ef

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\PUBLIC\DESKTOP\ACROBAT READER DC.LNK.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                2c1c199e56b0bf55ca8de76d93d7da6a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                66802f25f4f040408f775b5200cb31b038457d98

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                1dd9d979c6729f3071f229672fa84100f14c5f4174b42af550ad74478746e5c5

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                c685fe837be41ee9b653e6cd375a4d26f9b0fecf00fab2d0afa954a8f2ab2a0fa38e2fe77ebcccab82e6f451a29a5b2a03b27f419b434980eb9f3ef85bcbd2f7

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\PUBLIC\DESKTOP\FIREFOX.LNK.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                c5107412feb47d07a375b3950c729599

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                a398ba99b484a272dbfb064a12f9e07feac4ecaa

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                247a4060b33ab4ebddf136c3cf64ee8c67f02b78feb71bfe88ec4dc56202bdd3

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                b9c658cda38a1523fe77bf8fbe47dc5c1d166145527a5efb91aac03483f21f2560dc4e891d799788f60d5ac687bedaf76698309c4fc264a613f25b85f173c94b

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\PUBLIC\DESKTOP\GOOGLE CHROME.LNK.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                94ddf9ffd105c27481bebe3b09619ad0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                1fc7fda1c4ffb2144130a3b276454ec693c0d046

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                9915c8d052cc6e8990e651dd75e25dd43e8fcc122c472199d848007f3192289b

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                5d48ca9dc7e72441b94a0d6b2219ef145aaadeac5e8697d3f7748310a1c5973e52ea91daea7daaedb3f61311c2c2a30fd31321809699ff34d944d41ac85ec29f

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\USERS\PUBLIC\DESKTOP\VLC MEDIA PLAYER.LNK.DUMBSTACKZ
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                39202520c2b14ea37d6778ac77a16759

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                8af50aea693bf8fb2fbd1e915fc9e3fca38a66e6

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                d8e71e052cd5a8eb7052de212b4c7138d9c6b757ca20c7b12a6d0d95f7c86632

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                79fb4dca1af3acf3ad7a5f2f2ddc68ebe44b4d16f2458112ddb01d92f5ade670e680f885a0c87faceb5d52f8565d2942ac166e808061b354a83b7365ac891021

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2024-04-30_c9f6fc22d04c4d56622e9322d1a34d70_wannacry.exe.log
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                baf55b95da4a601229647f25dad12878

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                abc16954ebfd213733c4493fc1910164d825cac8

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1cbd0e9a14155b7f5d4f542d09a83153

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                27a442a921921d69743a8e4b76ff0b66016c4b76

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                7d12bd77fa1e7029871bb708ede4a732

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                97a1231f34f147bd53061bba8451ba4612822f82

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                119b04ed9aea3cd3527374362a0920b4c34848448ad683d44e69d98c15d1c739

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                5d38047d19e4a6ff3d3c3fe7243a489ac9df0136ee9723d0e6f6cb51a8ff5f1bbd4316b3619ede576d22ed8e68d3fbc36c6f22642f7c5cc658c9707250e14802

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                ac5a97dc82bbd7eec9a47fe7cbdb435b

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                da86dbc5e97936f1b7a80fa93f671a673c5481c0

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                b1d6d1e6a2e2426b71da668ebb3800da6c653b196237c08f1f8211f6ed3612bd

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                b73692de9f2c67cd635fa1574b4266eb5bb29104543e3f30d3db56eaeb72bd96b15d1b1a486b8deb8cdc48946be137dc02862d22f5bdf6fa8b11dc79e6cee140

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                9c835be1c42d41867f94b16187a93281

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                95452195892148a465d5d9296ccabde2e15b420f

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a594d8eba6ca8ceb789a7bec03c2e709deb7eb7ee32056391c1509fa1543197a

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                d32c47c3f4c643f3c6149f9fe23b217f7435a3d010294adcb2f00f67f6196c59e50c4b12db5f8108ff4f3c97c375946b4439e2e026fa0accc9d1b564c5aaa8b6

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                70e25538022f03e65b1e2c0ff4a2cd48

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                eeff8455c123bd165a5353e88afd4f54fc48c564

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                95a9a5d8c35c048105426d80d68291b6c619f1f7d41d76b82fa2c5222bda2b5d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                9903ca3079d2c22a601aaadb2ad5a551bfa55b217a4b88d369fed92a47c834dc68a8c6d1e336c872330a2eeecd04410a4363a0f4a77ff2756b4147157055d37c

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5c51ae6b855586db473509890b8bf9b2

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                c4cbc62cd631cfdf7bfdaac46f7256e9158b475d

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                e22bfac07cf5081320d6f73eb468c686805c686d9c7bb59d1bc53b346bb49230

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                0f4095bf8b035444172bfd5e359292b8660545cfcd4b0686410063731899ecc2318c422475e236e3d52405f7b16b1716938512d9712079557d48156dad2b01e7

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ETWlog.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                30KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                11e290412c001670b392a5d39ee148ea

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                346b685f4acd1885bc5570dd7d3a29e9d9f6c277

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                d0318ad958ec207a8741fcb13d0c847bb3e6554803998ecbaf7a37b4a88043d1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                eab65be7819c10afe98fcc49a1104536f97b168f346ba041efb841b390b2366708259e7b07d2aad93b8b427f5051455c27c9070dbc9e0521667718166a356520

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncClient.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                3.5MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                ae2f27393ed5aa983f03c6baa6888369

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e0ffb9deb5e21ba2890921bd6f482c23ddf5c7a0

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                ba8e89fed59ef8b2a4c3791fe25df6fa421ce9c14cbe45411840d2ea09604d70

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                18cad631ffa5ae7ec38c2021120bd81bdba06fb2a91e0fe280f8abab96a74558645f502a08c9cf094cc82a41b01bb38864044e385dda230270c6c8714f4a5866

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncSessions.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.7MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                a9ed685034ba08649451ffada108a10c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                79ce0cede59efd06b5c3dd4347002f9566607c58

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                0d12203cc6d02f310a5be6ecd46a69c9b50d813a29813df32a3516a0da967ed2

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                81b903b8838fe4965c6413f0e6ee3bef45bb06ec1e251e45f5278b893275e1c8acbcb15a9d7327b0d290a8abc18e5d580cda27b7ae934ca528fb1204075799fd

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileSyncViews.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.2MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                16620776c7869bd2adbac26bd1d581c9

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                323b77dba687767d5885553897c8a3994058a769

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a4ae2e167d9792442d3dcbfb5ecb74a9c59ce9fb7f085570e3b31dfd496e6977

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f09215444f951bcf74c8ad92d89088aec1a2fd16c8a493bf87b2ba018b53acf97b3ebb92b9603393ea0c9ae5375f60fede097490c17d6ccd5e03bc02c2f452df

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LogUploader.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                507KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5b311f55da4fa1a0eb9d5759e14fb477

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                e35f94134b3667d323fb90aee54792103d7ec251

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                b7c89de93b13340f4a7282df893da7b80b1782a56b5217b6969b884ef33e6fe1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                9e1859f9a44a611bc8cd3a43254ed09f482739f33cea11cb82985db71f822935f113b0317d7583034ae2dcfcdd12cfbab72b85f1f34ce2c88c974cdd88facbd1

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\LoggingPlatform.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                55498385700946a34fb8565a4d819a92

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                aab7485aca8f660f6dcab93150a9b0330ac7fec0

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                766e08f05a34fbe179f9d92fa805fbe04a181dbc6b3044eb9fb1ddb2b8f745c5

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                827884869039201c8306a6bf4bec88cd35a3c999facca169f433bb79c0b6d2be2e7f76444ad8c339b65c71dfcaeeb0847de432be2eea288a3744c2f0289807cb

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Qt5Core.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4.6MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                0116ef02bf9bc58335a3c37087fec02a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                f8d9028325511ddf1db43314bcb0d3a3ff063cd0

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                eb340e791c5b5952774a554d5d948db083b9c6dc09c3023051ee595fd2ddbfb8

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                939eafc51d1bdb4334d9c9615c3d45e0b3680598728756b30f4942e2c0f9a00124d091e4cdcad1a1460e39fa67d2f5b6b95bba60c084a92347f75a31a7598763

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\RemoteAccess.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                655KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                1989a267d129dd79d9291960095f22a6

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                fd5b74ff3b6f9d39c3cc8395b514d2c53082758b

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                55a6b28b228ca553b7b270ca9ef9693842931dca2a927319ec4964a0fcce208a

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                a944f29c58fe0ab752e2a153c41081761f5124a34fc4fa57800c0c590e93a306eb7bebadfe92969b3b7da048e1bd18e79aa387c22385864e833f4e2dcae80286

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\SyncEngine.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                5.8MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                70616c21e789c131dc3f6192ce5ce8e8

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                19b1e54345e4656b9d8fe0a179a5698f5de526bb

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                650318dda7b79c721ca3cd0065267f78dce3c1d299ef1814db2b51ca23b40815

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                4d110f7b3fe487a1b397254c8646cdeda82b57ec371ddc3bc084e65e1bb27d35ea71630c6c611fda9228b2de1f5975fd40ad282c6ca6046a5368e076ad5d17da

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\Telemetry.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                177KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                18224c5e31fe5ce26f7dcc54222d886a

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                a393a86c93b7d7d9fe839c06a83ca49ab5a1c35a

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                ecd446003ef368c0f2cac2a49da3f6332f3d09a349c3d38c3c761ebfef338dc1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f049e99436336cf23d15ad92079f62451049159a5e6200a8408d46d71abe1dc2e2023e7e4faf23381f348373ece4d14bdca71dca10c28f67a7055a7b7c9120bf

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\UpdateRingSettings.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                158KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                eef017d598e7026451eab2a0412036af

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                cfe250caa591a0a8cd6be38abfce4873dfee299d

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                aaf2775eafdc675685570e36632af302ec9d6685d4e83e0adefec61b6e1a90b0

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f66bfc2a761f755ca4d8162e103210f8b6e432dbf209b99643b7864dad390f9b6b08197bdf654725f12821545d4da6769433a9eb970d50962221d3d9ad32862d

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\WnsClientApi.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                404KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3f091537b82a8529025833db4c509203

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                d7eecba4fc0f760ad13366e53bbce7ee47d22e83

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                b0f80ae90b7235f1fe7d7d0dc6ed4221a798dfa9da0d00147fde4b2e94f5fc2d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ee05fea955aa1ad5ad635b64ba06d08b94cb29f1357f0d07a0c497a58b1c6f12ba0437df38b48e52284abbc75b2dcc1fcca5046d8b1537378913a3ea1f34a975

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\adal.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                855KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                5bf7fa426df30f69bfbf14144d08fed1

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                05b89fab44568c6a210e1cad96c0d9fef7742806

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a4f64f53d2a48f67625ac9f943ee9bdf35d8370eb5502638a13eaedc23dc06ae

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                1cd16cc09f5749ff0d965f169b34a6b2c477422689c93c30a7368fa7825172e9bac16e3d2a924e57055627824ea7565eea34d36dd8d21c0ca565e11b2bc85ac0

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\msvcp140.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                446KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                f63d3da456b228c5433bd050b8080e36

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                c72af4bd1c83db62d3a20d3ce807cb2b44667142

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                93f8a84993611f18f911d7949af6ee0c64ac2a51b10f51e47b2fface7e4efc29

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                c50666fe8146a671357bce461448a425985168d1a0766a25557dc090bbb2e7e23fa2ffdc515870b413bb3efb7055e60da20df366a984de1efe0fd0438b999d20

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\ucrtbase.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                827fcc581bba58abdbe8f66f97117cc0

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                589ff1e95d848abdb9b582ce79255ed6a9a8d038

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                65bd83c5d19c666246b89054d4e4496af672e6c37c82329ec0cd2a10288cf07f

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                842311fe7721eff86578a135c7d4053c90f2a618b9324c60349b02bdd36a069d8532726b7728fbbd3c9e59dbef65ffb1ee3717230cbccfaf925b68307c284571

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\vcruntime140.dll
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                db00c70cf7bb40b1f73f65f32917c3d6

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b6426cc89a262661aebb561051e263a3cbe7c11f

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                af9c668db23c34f070d567e801efbe63680cb968a0fd81c60c782428d897139d

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                e44571f75ad461518c24a19c86e03665bb533a59b50b5bfe04f7c0f6e07ecfb49a8530dee3a3cc1338bc8051b022df602ab5dba13682ce823b8038eb063fe114

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                e22475a3a3fd996e6aed8fb344fc1277

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                0702e726df0a403d2a2175ef7d238cb87a32a05f

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                a1fbd37a3f712e6c90a94c35db03190d221cb6bdcb33d71dce3a68db4e88354b

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                726b3615758b47403558ac11419b931cda72c740eabe2b721c4489cfded7cb2982d91be04039244bbc3be610c9cfc12517eb98fcf133f7c96fcb1ff61d413720

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Installer.exe
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                c9f6fc22d04c4d56622e9322d1a34d70

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                d45ed6385e183456f1d0f68aba47727df1d38256

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                b7b3f9f8e59c42d40505a0e53039b69ba969b84b14d31a71557f5a09855b678a

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                f73342e15b3f1fb180f845950ed90f0fdc9c54f1040d457d78f2a13be445d65650dca455b254254db566e81b4c089539370edda3ef76a4c5bbc32ea7aaaa40e2

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\k6zex9vv.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.DumbStackz
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                48KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                eec10ac3dd0bd8f026f786efd16a3b7c

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                aa9393b1ab259822281f17c1c41dd914b55d420e

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                abe6d4190ffb43c8e5ebcad8499751697bbb823f3f021edcd65d4acf6d9420b1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                6c350d911d84b67e1b0d24c4184469f4e7f9cbde36985144c49896e966b54fff0cbf0b9224aecead7257b2a9462c231c54faa4fd979a3b150d4466552faf31c9

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Fax Recipient.lnk
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1B

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                d1457b72c3fb323a2671125aef3eab5d

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                5bab61eb53176449e25c2c82f172b82cb13ffb9d

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                8a8de823d5ed3e12746a62ef169bcf372be0ca44f0a1236abc35df05d96928e1

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                ca63c07ad35d8c9fb0c92d6146759b122d4ec5d3f67ebe2f30ddb69f9e6c9fd3bf31a5e408b08f1d4d9cd68120cced9e57f010bef3cde97653fed5470da7d1a0

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • C:\Users\Default\read_it.txt
                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                3487c41ad8ea8f2659c603539beaf06e

                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                b1d658eba8f7be795a5bbd6657036d6cb08fa6b9

                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                31e3c22beda1445bba2c1e275fc4bc3f3cfa5d835db1ecf15ffa65d340436d89

                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                d936da83f894bf5de5d4d761bf4298f16a867ebb3a7873bb53f2915d5be440234310c4e07048b2a5beab5a19c706055d4bc212fdfc5101d23025b03d3bfdaad4

                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                              • memory/116-1553-0x00007FFE62B50000-0x00007FFE63611000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                              • memory/116-15-0x00007FFE62B50000-0x00007FFE63611000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                              • memory/116-1408-0x00007FFE62B50000-0x00007FFE63611000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                              • memory/116-16-0x000000001BC70000-0x000000001BC80000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                              • memory/404-1584-0x0000000004360000-0x0000000004361000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                              • memory/1056-2-0x0000000000F50000-0x0000000000F60000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                              • memory/1056-17-0x00007FFE62B50000-0x00007FFE63611000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                              • memory/1056-1-0x00007FFE62B50000-0x00007FFE63611000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                10.8MB

                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                              • memory/1056-0-0x00000000003F0000-0x000000000050C000-memory.dmp

                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                Download