Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/05/2024, 17:53
Static task
static1
Behavioral task
behavioral1
Sample
crypter.exe
Resource
win11-20240508-en
General
-
Target
crypter.exe
-
Size
1.6MB
-
MD5
1e4b14fb751ca173eec977d88ba4ff63
-
SHA1
549a6a85ed3474b67b6655b7b7e02e179f0018c5
-
SHA256
e41934d69fca3aba3323a878bb35cf4fcff47429508cfed6e7b1c2088924d1f1
-
SHA512
9b2c060ad66467a5981b321daa3c6ae8cdeea89ee856814eac912a684a80061ad715ea156a7ed47a9dd09069abc1019de2c8d3838240edf92d420e6bf8071cba
-
SSDEEP
24576:nfKOI97zjEs7Buhxky9A5jpXPIa3AuNSZh:iOafgsN0J6r
Malware Config
Signatures
-
Renames multiple (1047) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3176 WINWORD.EXE 3176 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 72 MiniSearchHost.exe 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE 3176 WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\crypter.exe"C:\Users\Admin\AppData\Local\Temp\crypter.exe"1⤵PID:1280
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:72
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3872
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Recently.docx" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3176
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD57c0cb3143b37e6dc66217bd49e16e5d9
SHA11b28e872e9d0d217148e6b189fd8a622e65c2560
SHA25631d949c5a3e973d02099339de5cb42ec49f0f29ff4464402578d772c01b56fe4
SHA512cd6b8d85a2588c5f47655972a7ed5878ef07ee272b9f0017e97a65898902add530c8b60c00f395d219ff3085a6034ce24da21dc839ae0365e35931a57e9472d5
-
Filesize
41B
MD5609641c21dedc2017449afb335709266
SHA1060e38e1f40a77c94194a92b9dd8a0b39de0e97c
SHA25666dd6352d45dd2248d867456271e0b0e403ab76ddcd18edfe2c869a887e653b8
SHA512ad3359696fe370bef18a40e7f0bbe2f421c1f08576b8b10959a9bede52f59effe5f77620966f82a3e1bd8c869492ca959f3da851c5cb2a645f9bab20ce55ea2f
-
Filesize
16B
MD569ccf0cf2052427f6620601cd6161b80
SHA1800da4808dfd7fe5c97130ab576c9a99b74e5ef8
SHA256b07f1c31aaaad73fb24709da6d383e947dbdd6586355308e297236ac0023798c
SHA512511247cecf09d669619de64b3c6b9322b5b7dac2ea4403e90d23d25239aa4cb72f2712eed1a6b7bf2c0fa6307e289b2b6e28ad085020d3c7ab698703df50dd05
-
Filesize
8KB
MD5af8e1117534f01309f3601d4ef664a30
SHA191e17e64ea999a496c289200b223e7964103e4d3
SHA256d8752840621eaf401b6bf268e5ad707a044e402e62bf561c7460ee7f41851985
SHA512bb31c01ad0919a465229ace7d1cf2d77f7b2ac9e54fc462c1c825fb37e9502d0472cdc903b63d965a10deb3e2b497fa9d86619b27a9a29a99d2e9517facf2c43
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Filesize24B
MD506dbce9049a910a3370f25982ade64a3
SHA111b559839ffb28df99a05cd49a2c42a9024569c0
SHA25680947fb86c989dc010b21d9ccdb6807dee83c1a3ba4909013d1cb9c333317c4d
SHA51237159116f58ca392c6e06dc31fd569a89197deb65a325d8ce7ed31f377ccffbb8ef7f41cf7e5ff9cd0a7550f236a15a1c22e8de6c1c4211ca15970beaf849852
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_0
Filesize8KB
MD5cc0f3b969c6d76100825892000b09ce4
SHA1a8da911eaacb18adf69c242df81f02f58f8338fb
SHA256f4755ed3ce5027b019c0fc4461e21a413461388ca76d540782f283a9898d0804
SHA512954979fb1f85a32cedbcd7671f9249bad377b6b360e4de30b07136b49930ca812b69ecd6f7d62b47786ac2d673e810c9faf6c4556e7ef09fc914ffebd236b96f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache\data_1
Filesize264KB
MD5b80156e43cd0300dff9f295339fa9ba1
SHA1feedbd1b725c00ce62a18ef3ea124c7bdb956593
SHA2566577fe438d3163fa4b1004d0d4b754c235db9841c6697dccfd0dcee17a072800
SHA5127dd337759590b11ca33fd3004984a691020b39789fe27bce296bcc60098689a80402d788c2a8b7968124bab06316e07ec178d7924656c4513e7be5b24cffea09
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Filesize8KB
MD5bb3a25babba0c877167fdeb8643d7274
SHA14a6f5005e7560dbafa88acf40ce37741cb4f1ace
SHA2569818fefbd6a8e79a200475d0139ceb7980c59dcd802ebc74a254bb71888a9faa
SHA51240990124b68876c2355b233055c4cdffb06d4cdd83373044952b15704377f610a6ca88048a63cf70b689ca359c41063024b89694fc4d7b13d13d3758315ad48f
-
C:\Users\Admin\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat
Filesize8KB
MD5e6bdc9039d35c64f0468dfa2cda3fa68
SHA1203ea12ba15a1424b982da069c29d5f033e19645
SHA2565a1d5813084dfd00a6518df79165cdf68cc74e451a27f7ddd4e416abc7885e8f
SHA5122fa28da0cb886d0327f29c28383ce37d4750949a31ddd03e2854dbb363bdeddf8fc1cf605bbd6ae0269edc04082d8119e2982becd8e9ec862f771f3092ad6209
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\CEFNQYR8\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js
Filesize456KB
MD5bbbde0ff7322c6943ca7192f59025d83
SHA1c55d422b542cd8316cc540a58342a05b3ca2f381
SHA256472a14febb5619acf3608aaae116b4dc48a52a1675f48e0300957f194c15be63
SHA5123f72bbfc57e7cf77aad7a94bcfa95945491d00d19b9391a8cc400b4b963a37fda1ab5125327d766d01fd0c09836692f712508f7667211772b5dada36dc4d06fd
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\K59IT426\9-qNBnrt3SwYozCOSX76uWrkk18.br[1].js
Filesize43KB
MD51f035980cfb5ded2c91d464b7b5a11ae
SHA16dbb1476b3f548b1171a5f3e1c6f81bf550f801b
SHA256309cdbbe20420f93bec47e851eb2806d35a24782c2b205c3ed4b8a08d389fa37
SHA512ef3f6d0834a2c7ab377f34d065e0b548a19819cc5199b4f52e9b4488c672c4adff9c3911e8a3fd2aed8844c32d006a85c2c872c70f7c858ae235ab16708af187
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\K59IT426\B24AoqFsQLx0yS5zJ7xH26intrA[1].css
Filesize15KB
MD5f7f1e8cc66985952a3cf792209d1fd50
SHA1ae669cb878ee2928d19bd7c8fcf445635ead84b6
SHA256f52662e3acea9ca86a0247669d74bd2b2221965b01c2ef1bb4f8ff7afbd7b395
SHA5123673fe7d380de13f99b6e6e10eecb926fec36f0d338066b2bc711ed72fe84a649bb88e586bdd8885c5c00c6170c2590928b16a7fc5204aa384d0074fd3128633
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\K59IT426\iLSYVMWvkjrGkn9XTH2k-Gy1S7g.br[1].js
Filesize270KB
MD50da354aa92e58488e5c6a1523d2481f4
SHA154cae56dd0af1ca80c6231035fdd48e23a51e993
SHA2567321842c44e045c26a6d390a1cc23c4ba06913578f15b23e8726062b9788ff37
SHA512394635834840b8ec0db88bb872ebc236d19a012b35b84784633eceb09598a3d369710047bb5fe61f3f8da1d4cc3930371458d96daed1154af919835e9313a81b
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\INetCache\K59IT426\taji7ldS4ejDYQEzKbbzWXxUR7k.br[1].js
Filesize2KB
MD5b8dd3564795ad2335c42a87f9903ae73
SHA197bd39a69f440910dcdc77dba8388dc637d95a67
SHA25613db5838125beacf26326970e2dc65019057dbe215ad125efbda347e7248fd8c
SHA5128f0981cd32069075635915535b213c885c81d12128593bfe2c853f3d523cd163986750a44275ba2f30aadbf456b9950afe0e427a5d2262439fd93d41aa8efd63
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\1JV6XGVWTB_9
Filesize123KB
MD559a69c75c42f5830f6324fc92859d952
SHA1884ab06b3f756b08dc39ca4fe68675db7273447b
SHA25677a35cb541323678c640cd148218f379a4e00b5902fbd9f5a171c8623ee58bb3
SHA5126edf6d41808b5496fd25f1ee369f209644337429b5fdbf86c9b29c53e653baf077ad8d5ff09af69924addcbb2e5a23e09fa3d4fa1285ac0171a8cd7d3d974561
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\2Q3XG1LF47_2
Filesize867B
MD508a79fb5eef4b25a39d144d1a15ac79e
SHA134bd14ee0daca593cf6e34efcb5d24024c299892
SHA2567471e34ee6e8dcb435dd2238f7e4de99de0ad1aab3598331fca70498a1a61080
SHA51224bbd4a33eff2dd5865a9728ae89b64dc78dc22d6d2c739dff9cd05d815cc7132d6368a0b93a2f21fe2a94eb5206d33f7543926e7c04e731a5d04f80aaf607ef
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\2YUJ7SH405_36.crypted
Filesize1KB
MD55a06fc109f30ab2bee8c0f13e2b2e70e
SHA1fef8dcd62c5afca7e64387f43d9d345c08f6f2c6
SHA256244b59a4a7daf69431c881b6eaf1f73b90d5e8a3156ce72ce8813a358fdc2608
SHA512675d1d38856e08423a3b6663e113695f6794300688aed54546e35a33efcc7a0597c1b0bc6e09cc415467e799f547de2b5276544e2fb87db6574eff2c6ee32da8
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\5MQVJNB25X_21
Filesize8KB
MD516cb9a9da8d6889d7f0e25233ab169be
SHA1c519c569d48be6d06a692bd1561ae8a084f49a69
SHA2568524c38c88fc312c83a17020993723fb6a33ab57ddfb784ba003d40b279b71cd
SHA51201858239b4755fa89e232064bd505bb5918b524c7fc127e78704d97d9c4ea3a6b40583d571d968db1d3c9ef9ff8802010b765252351a3abb42d39d3f87c8e861
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\5TFU8DM635_7
Filesize64KB
MD5c6120b43a0c88704d552f898baecb9ac
SHA19576ff52bba1aa744f7ff8fb2096602a34ef98fa
SHA256a9d4a5ba46213f2bb8cc17286a1390044d788a1dedbd9dc942c0ddc8cb94bc58
SHA512e2dd1250f9e931e4f7fb4de73228ccdf23d17b737d78d371ec6c3d7978038dd103befd99acf4c4fb9666f41b1cbefb61a135126e22b5aebac1024009f3d97ce5
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\73I7YB8JVQ_27
Filesize71KB
MD588a3e024b11bccae7cd59ac377aabcc9
SHA1cea4e8d334cab78078cdb5214ac9e6be03b29308
SHA2562b20471d9c98bf39fec4a86891cc6a47b3ce7a0fc601194a9ceda8b74700830a
SHA5129c48ad45564fd18e070b5bb9cd3fa806477d61a5db71a64681c423178e11091f526e8e67ee909708581e04039b4dc405ecc8c5c087f29c53389581aca4468554
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\B7OM96SX0N_45
Filesize65KB
MD516a292ef2e4c59ea12b5e71fc8c5aa81
SHA1dfb709098bbfff6387af1ce2fcdc220aba1b87a5
SHA256c94430d6af1f83e0eeb610b17f47be2fbc96dcd57e05c0c5163a562b1598a3b6
SHA512552f7464297d0028ac2d67c9fb148c9f863fd2c4699c4b979769b61a4191de5af72777741b37df3f074ac9b37d294b6280cd57cd8835a68475c455060cf6d112
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\BHOLJ4AP9M_25
Filesize491B
MD5dff419924f0ff60ced77a66b47d7370d
SHA1f0a650e38cdfdeda07bfb85da24757e5880e6c18
SHA256c155633fa7e4e2e5b0a159d3c13e6a896018ccea721d62ff222c45fb7ed2ab9d
SHA51294635f84fa6047e31b496bca3fc12459dd1e441e31a2db64683517266ba8441ca1d3a3ee05bf8cfe69692098e3fcf313af8d0460d9f71f88768616588a11adb8
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\CIHCAJS9L7_43
Filesize95KB
MD5e0ba9d08cf2112759ddc4859c7cacc46
SHA16cbf07301293f4d34b7fbf51e044a60b71ce22ae
SHA256f4489ad98e84e95d5aae64f3ebab40fc3f55543bac7938042c11112dab71810f
SHA51285bf0281db2d9adc958cb243f9f5faa73798513bcb7d5bbaf4098d7b260c90891d93cd07e4d72e6149a8fe8e38f6ba678917866d678d9cfd264656f24b45cb5f
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\EELBX1MZBB_22
Filesize1KB
MD5678d819552ecb15300c9ce080e377dd2
SHA13cb6365186ea01b4213ae579d19127a561ccb5fd
SHA256819117d32074245f7a382aa4039193717a6df39c5f28759f7d90b461765c9870
SHA512a555e93de1c3910ff50c0337e33e1fbf7751fc1c1cbc46a2089872312738d769fd6b07c3b4f4e963e6cc7175f3ff6d1aa2fd47456c437558ccf0e3c6ff8b4511
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\GMXJAUXO0Y_33
Filesize38KB
MD5f9ae704575f15650673376f885197566
SHA1b0b947c8ab1c197f4d040ed0db708e4210e1f63c
SHA2566e8c1bb86f8def429af9926320c0a7d4d73362e90b903db33ed984478d2de96e
SHA512ecda904bcf231b0ad716ffb2e8ff4f8be387884d3981dcc37fd769d64e928dbfb74dfa01c08729e6a453db99e98cbee6f72a717711edac0aac14c14f5572e3ce
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\HFM0YAYKTF_16
Filesize1B
MD569691c7bdcc3ce6d5d8a1361f22d04ac
SHA1c63ae6dd4fc9f9dda66970e827d13f7c73fe841c
SHA25608f271887ce94707da822d5263bae19d5519cb3614e0daedc4c7ce5dab7473f1
SHA512253405e03b91441a6dd354a9b72e040068b1bfe10e83eb1a64a086c05525d8ccae2bf09130c624af50d55c3522a4fbb7c18cfc8dd843e5f4801d9ad2b5164b12
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\K0G6CZ0NWT_46
Filesize118KB
MD5866ef80494e9be2c551033620557ca2c
SHA1cb9f7d77b15f649acaabf9ba5511f0a184c8818c
SHA256b96b4f603652ca6a18789ab47819076a2efbeb214d667e3181f449e691f57643
SHA512401dbfb6ca9738e8aee2d0df45e6142d3d3741036c439309da9aa1dc4274e0cb829fafc7932b20daa93cc59b2b2cd39adc5d0e467e9a8f02f80f1e12b3aa8bbc
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\KHY4JRFQ65_12
Filesize10KB
MD54eab77eafbcd8a740485bbcc62264fc2
SHA105c74404d5fc7633ffeea0c45b916ed6c5719e99
SHA2562cc9815ec57bfae0d3476eb5aa01f47a4155fb8e1fb544f92f2aa548e8235f0f
SHA51279398968b6a0034b0dda218a700cc125615ed0852a3db4b9dda41aaf73eb7c384d20fa372f61136f9a7eefb4b4b6db946fb45f5f6eec81ff227771de9d1f5cc2
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\L6GKCTA58V_15
Filesize20KB
MD5d4aa847cdbd942b10ddb475e9698a06e
SHA1d8b29ac3138c8c1c0fe12421bc2df1eceed9f920
SHA256ca6b3cef27b7f9d44a91dbf1f4e9b1b92378d24ebd2ad18523872f1e09b2ec1c
SHA512da1ec08721fcf088accaa2d5b86b26539231f325bfad3e6b36109151ed278079a7ba0b63208f14a53525b96a7ece6bd9cdeb6d8cfd9ac7e83870c61de213f285
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\LR5NK2ATM6_24
Filesize17KB
MD53cf6c2376c6ad13816fb6795914038c4
SHA11103d42badb5933ab5da3f6ccbb567b9255096a9
SHA256eeb2e781c239b2a455f8de1c192a8ec56d4904946c6736662d23fa6cdd75a67b
SHA51247a12753c3eab02268d284f51e2053c4b5e46b511347cd53c97f4ee944b663802b47813767c62d5d0e3e9fdb72900c4b065e773e7eff786b212174825210f222
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\M3UGQLKK1Y_38
Filesize1KB
MD5112d277f793cde52c2fec1efe51e09bc
SHA12a581f859c2816455ab8ed0744a0fe2fbb62fd5a
SHA256250496bef008fdac8575b63a47baed8375a782c07bbb41bbb7c008b7a336c46f
SHA5129e4a93237e6d0386104c785c13ced96f7ea21f348004f919108fff16a4348371e93d7dd8005824cc7be6c1ceed7558d67cd1be4641519eb9de78faf3f2cbc01f
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\MH6X6DOCA7_19
Filesize128KB
MD52b700ed1c186ad8470eb392d327178f4
SHA129dead5a2b4981560e58ba6716b2766a703248a2
SHA256db20efaf7ee7c75d0076df7d4f65734b4d4af3473ec3794d9fd83be9675492d5
SHA512731077ef36180580c76fcf455d78186d7890833c3998171ba0419a690f5c5c6801809ec9e69f1d44ca2e91df1511ab73da05085d5e8402f1822e6a81c5fcd896
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\MW52SDRP13_32
Filesize15KB
MD540d72734d8a85d6f14ff9d5a81f19433
SHA1535cf2263818cc40ef5c68e6da968b93e5e14234
SHA256a52200df8de79fe3531fbe9bfebcdb27583820b6c0353c94d2e7a13c61b8a2ca
SHA512a192c751677381d61715cc27f9c724a094221666f0e4e0eb75bfc994ee3fc588530f45bb5f32d0fbf1b8569f687b07842fac987e909133a540238b740b470366
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\N8Q1DXYV2A_35
Filesize2KB
MD5307043f47136be14abcc49c2e45ca6c0
SHA1aab4bb7b5a9df672b28e8438a1cf6aca7fd03489
SHA256d5ed8b3e0e945a52312202c6f2d9a93e40ead36627b967735c17b4edc9f2507c
SHA512a08e670b28e8be125145b432427123c3a7e9c5d099c05f44ca100fb8c6663bd5c6edbd61e77808a103c8c5d40107b3531a49e836799afd9d7a1e5a599eba672a
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\O3P9II55NP_41
Filesize61KB
MD55745663ed2c354f3d1a767a3c95f4f65
SHA18b63dbde66f9451ca6a56c69e39d4a906dab0719
SHA256dfe5b714e4f3f25cc3022ca546f45882021054049625bdca290ab11a72a1ddfa
SHA512ecb05a469c5c23f40c98e577a81ec76d8f0fc103e9e0d094e7c1e851a3e0b65e5366cf4901e0c24b51a8dd52867ecb329c648a911d333d39c330ad355c3f501a
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\OP2A0NFBRK_8
Filesize6B
MD542da0bdbce2528098622f42075f1612b
SHA10a4fc39d07e96831b7fb703dfda11b7a743a8e6c
SHA25657ddaba8a55bb5675321ad7d3c5c0923b01d9132e91161b484b17bd5388f7f58
SHA512c481346de5df3c8773e02f62f87172deb660173c67f1b59c578cf2e1b130db01cc91c5054651031e7c6b89eed9007fbadedf5f8c76c968dc1a79d98cc1dd1883
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\RMBTXH0OT1_17
Filesize11KB
MD5c632485552f2df4558b7add6e5b65c7e
SHA164bcf565c982b7a9508f2df0651a0599c9245fd9
SHA256eaadf70b6f4615b357915fc1da4e5a10cc9e36dece13e7a0bee19c49f064c7ed
SHA51253ce938b64e930351db97fe7c91a203df12954e86f9ab8b5673a7791721df0f674321ec847522a474563aa38e58b59eeac7d508f89b35c2ea132b23dc0958634
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\S2X043HLMO_1
Filesize57KB
MD5c8206d4a20ae44181563bfc0eea24a0d
SHA171510dfb227f430628dfb0d48535e456dd26cc58
SHA256cc017387dd11649fdeb47fd27d22485c876e53b61ec4b561b4921be55b18d94f
SHA5122ca58a340eca0b46688a3e0b57f2f2eb9b0ad7f9c295c711672adf4c8cd716b24b1dbf2cc1c7b9091aea3e44591477651583029b9179da90043699a9a42e44f4
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\TLBYMMDAHT_29
Filesize355KB
MD5bee3efba475b324bcb708f49beb73bf2
SHA1c53f6c2847fa8f48c7a93adbd6b623493d15368d
SHA256f1b1346c75765e89edd9dd0ea607f5cef2bea8dd7a8ed1b288728e73881e6cf2
SHA51244c9fd4b7eb24d923b210a7b512a680954493c74726833fa5a7f426a027f99f374762c2d6affcb12bea659f67465ee189c305b302657d3296f6e98589cbd4117
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\TN4HZSFU8W_3
Filesize21KB
MD54721f1dc43b0cf4e8a11a31de026ff01
SHA1826fc8b37ea2011b4c41493e66fb72583dd921b7
SHA256c87920a1056f27378d395c0392651189627557d02750837cd52ad02e1caba0ef
SHA512aed4e06d662041105fdfff0f42c4a15cafd270319f155bf52f7905c888a75d88f4b0ccca0198f0f78a3ac3e8ee32703750b97c1e26070870047c0ad5224b6808
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\TVOCZI7RRH_10
Filesize950B
MD5a1d31fda8da6a0a0e77ce96afcee0275
SHA15febef29ca591fa24a7c28d7941d3943f82e8283
SHA256cf874e01aaaadb7231fd68286f8f5779192a25b93c8f1ac882ddf2ec3d4751d6
SHA51207e41978886d663e2dfcf3cff55fe4843a82e6ef045f1b0f97bf4ea425966a016acce45e80c37e552fbb355d8b5a998a2ad061d4f49f5bbdaed6d577b0f7ed42
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\UQ2ZKP0BAX_42
Filesize124KB
MD5194f66fbfcd523e55870e20f82d00874
SHA1af8dd6a973697f383fce879977713a0358c3a5a8
SHA2566268943889d37dceb832b80c7b6f34bd23536ab3017c755d834c88535e4d7619
SHA512ce04b69f33c37b2bc1c3dc4ee9fdcfef34be954ebd93ff85c9b4f54e380c45a168f12caef6e19a40314fd380bb4a91d61af78729531b3cae1f91091db7af9134
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\VIGZ48NLZ1_11
Filesize44KB
MD5d3be1f2547f0f5c98a6edbd696d744d3
SHA1e4ba5104965f7d1cccfb73dd45552fcce499a215
SHA256dfbc0e85ebb665246c66b90f5fef5e379a9a64e6890f79bc5231447c9a288f40
SHA5129f662e3c98d304243972394dd10168be85a6ab01991e7eb1b10bbc40f341854673eb9e0c44cad9dfdcbc510abd4085608a9d0ec6d8f94b660699a19ea68e7a01
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\WEWLGNBCVC_26
Filesize1KB
MD5fc70e676085e31093ef591a9d9826c7e
SHA1bc0c4fc23a689a0f241657dc2c58043b9e954b12
SHA2563280badf5e26b854f04cb1ed8df0967b3cf0bc6e365d745be0c5e02f6fe6e0b1
SHA51232c4e3eedee908abc8a67a30dde0d1d8feaa3a60d0d8d4ed1710ad4c62a5727515aa8ae99e6361490bd6dc038861271c1cf339b815afcb387f6ad2b23cf0abc5
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\WJSFQVY9HJ_23
Filesize164KB
MD5fcaef6761a28d6c8a8307d0cad2f8eb8
SHA182403e277fff14878bd465d57dbab58a48e47b28
SHA2565eadd1c17246a4bf48e798c8737433fdd43475e25df6866688cff06e1595259a
SHA512f39ef18c51790c3a4df6f648537af951a2d348461fe435270e0f3b7379f5afef1ba55aaa00900a8e3c764d15db3d9fe0b3bc3b06beb6b7e643da9a49a38cf8a4
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\YZJ9GRSO1D_5
Filesize19KB
MD5a519727fbfa7f61753c2851fcaf58d1e
SHA1f3fbbec60f227f767a261b6d9913204eeef5aa39
SHA256572c84653cf9e1930e5e8d89b0410b5a0624ed56a04ad0c01798cc1db9ace553
SHA5128ed6020978b8d1c8879e95c678d4e8482a8221ddebabd318e4032472001c90ee214f4d19a4e7ea4b4c6a9c89c90e0217715cba1049d6acc4473ed38b48b4a3fb
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\ZEHHYLAKFU_4
Filesize5KB
MD54eca82104cc13c23224e7ffffeb32051
SHA10b26d9f3e8dee71d0f95125231774d25c6d32541
SHA256c43891820222c70b84e4886771c673d274c8b9f7817958b1c4440c2d781307ff
SHA512b6e27c3aad65f64f7ccd28bc0082878dc24226c16ed90faedd9de329345053046964e3bfd992fb479785fef5550e6690e0627e80703217a0a338d578aaa69026
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\ZEQ5ZDIMQW_18
Filesize99KB
MD58b1c1e698a1010952924b9746ab670f7
SHA1996644c0b8c80e8a871cfd9e3e63ab3d9500cee9
SHA25640278c9738614440814788a495f4277b555e2a9867e6722284bcfe58d64526ad
SHA512ffca66caa8bdb54a693513125ec2d73641f8ae9cab5d33282f345586d2a9f3c1c69a3541078107557f2732ef62bd586b5398772542b1c6e8345b536be1780082
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\M7D4GSQM_2\ZQ7Y951FB8_37
Filesize1KB
MD5d483669f8d00537225291e7443847c58
SHA1141470c0ffddecd0d114b2c8c399794785d2451e
SHA256ac2985137014a46b6acc35f8402b1b2cbb46477d71bc257dbde1788926e97049
SHA512a544413cdcbf4e51b4494bc144b73770826d9812d211eb2d693930c348e6b9103ba822d83e8f4fe31cbd46c0c5b2b64af3e8b4911a8f6b134a3da27b1b98c8ab
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\U6SZ0HAO_3\4CROQ95TZD_35
Filesize102KB
MD5f0d887e7bba28fe6d559dbc855ca69fc
SHA1207dbfbeef643ece545f86f5b09a9a5ee3654229
SHA256ed6f65e738c81587b383f7cfd15a5327e8c72f95fe7c9121dc727bc84d232051
SHA512fc83710e90da48ff470964e19ac2e5c81a1a693b66f168c0cd8af323e6f1b50247b725a67c3bc776abe507a603fc5cddb784bc0de4f4c5cbb345dc849b90cea0
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\U6SZ0HAO_3\5GYK0NC5H4_32
Filesize14KB
MD5153b4a44ce5485738afb6ee13dcb015a
SHA18c0e839db573e4133c0bbb2970d725e6a8196a57
SHA256760d7096d2523461163c38956deca7329599e03a4d81fca484bfc6875f3c1ebe
SHA5128b29906b1c7f0db542b16f257d8a88c20df0eb256098b725308c7b1d0d60a84b9d91c90c1c44ad66fb7394d3bd66344d1dbe1889e33bc8e5ddef483821953919
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\U6SZ0HAO_3\8AUS35CSLN_15
Filesize2KB
MD5a3de72e4becf0904d49f70fe7231420f
SHA1670e2cde145a915bb24e39ebecac90ff4e2e3a28
SHA256c24b0c5497aa6fc49790addbe935ef010d1706bd4035dfb1461b68588a9ec54c
SHA5120da58a7f550e16003c3790dcc2babebd79d3f3bc4f86c7abe472c21e118f0070911dd0417a4af92ec75ab3a448683a7db90a072d7f6d95ce20be2d41a6b536ec
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\U6SZ0HAO_3\91NY8S29NS_21
Filesize1.8MB
MD5040187b064d1628b22f09e84466f8891
SHA1627c87e11dacaa1a0f697e84df83f5b22b2af471
SHA25601974ad237bb605e9e0a7743eee8ee93240b22ad7911e33542a20300b1156b8b
SHA512feee64641540a68b1cccf1dc22fb8d55b784bfd3af0f374624859c5b58c6808d7270c511060aa0df83e1da69501128e4129a642a0d8336eba0094c449d5f00b7
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\U6SZ0HAO_3\AJBIFSF3GO_7
Filesize940KB
MD5ed32df3bfc9f326954db5c1f8ac53882
SHA180110807f3cea93a4783fcde8b275a39eb60e610
SHA256ccce79058ae54252d1ae79fad4007b70f917d7890cddb93f923b24222982670d
SHA512a9128cca7173198a55ddd5e0c99f28be19c21c55bec9d6011ca7fa55d270b873c4cfe7be5cca67d3768b3ac46f1fa3b8142cc6125ec2b828633126ae473868ee
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\U6SZ0HAO_3\W0S71UCE8U_40.crypted
Filesize113B
MD5e29d0f3e22869a3b6639a283e3e01287
SHA1e631114b3d90fd6b2f26596768a264b21a2ccf8b
SHA2563a3f707cc5629977e4c564cfd6d911ab3fcc4da0427c6ba91091cd7805767324
SHA5123f034409ec3df474c7b98b85e9ebe7234c5ff22a946cbc0e061f346be7206593fc816d63439ed69eae836df3fd0428c472a23961573a940dc8c61c619334679f
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\TG0Z2WK5_1\U6SZ0HAO_3\YIE552Z98O_48
Filesize15KB
MD5d9c928e547a8b1e6c9835407839be5c3
SHA18ad6fb3629247188bc1261cf7e038228663fb099
SHA2561eb2145a38cc3b633f48b16c2e0eb25acf2d5db13985e84038374a80ab38fbc8
SHA512a4dc21a6a35e545dd7ff4efc44424edc2b5e1ef9aa055b1d358e7ac02e52eb1e8d496c5af1bc6022afeaed42b592d2173bd6304328ed4b3e8e4da57af5ba82d6
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0088c2b2-3c17-4bb2-86e1-85e08e3f3e33}\0.1.filtertrie.intermediate.txt
Filesize5B
MD53cc465ad2a53091b1d0beee841b66ef5
SHA15f6f9d6df00645ba21db2849fd9164340c5c2921
SHA256cd8198666573cd379151c50bddac628b7f0ca3a4995e5252d2de16109e4b71e1
SHA51222fbb3ad29905b0b43c0c985c6b0b8e76a0103b206f93e3d8c19c6e4d293fb6fc1cce1b976d537c5b01a6098646335b40fa11f2fe7f5c2864882a602bc9c677b
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{0088c2b2-3c17-4bb2-86e1-85e08e3f3e33}\0.2.filtertrie.intermediate.txt
Filesize5B
MD5e0a478f8094c573bfc16f6dc88bbf3ba
SHA15989543d53ada046df9b4790aaf88f946d9e9446
SHA256db8af2c09a8b15f725a567f981082d436de0b68413b4a8c68182fae3826eae7b
SHA512218aa573f63e91b5011538f90647b9ba635c90c68bd3c2e1fdbdd5cf5ce5f7cf9a56a57ab48ac571c5c4ec0d834090f900fc8973cfa045d3f37386e63a987e58
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5e9aa12ff0be6d995ed86f8cf88678158
SHA1e5ee38fc2ebef0fcbc3059dee29b39f7daf21931
SHA256f35cd8ef03ac924a59943c5dfffc31ab67a8b5aff272e9f47ff776aabc7ee561
SHA51295a67acd2a4784b87d73910c1f1f590937c9d9b901e98448556a37eb8137ae5f458f1c673d65a46cf7d6b90bee5fe6b102ce3eeac9e819062cd9c5c2418bcbfc
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
Filesize846KB
MD5766f5efd9efca73b6dfd0fb3d648639f
SHA171928a29c3affb9715d92542ef4cf3472e7931fe
SHA2569111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc
SHA5121d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434
-
Filesize
63KB
MD59e509014a28b1ed8f0c859add7c66589
SHA1737cdd78cf9f5fe713593db9fd7924186a9fa474
SHA2561598435b4a7fda9a350ecab62d88bffbbb5689b8777023cba56eae432a3bc662
SHA51262b3187afa5cd2dc621f0c3b5bd41ef11ccaa760926c9680ac21bdc1851a27da8b1dc5441219e3522abec13a3229932c0d25ec2b8d940da43bf551fee5bb7202
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\mg2c1myw.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite
Filesize48KB
MD50e148f70f7f61de1719b6c4cce675352
SHA13c2558a558b715dffa6acd3c6b5761f88b46f05a
SHA25660e48acf4edfc1b57bcf9d43bc69796a05671c79520f4bdb178d67254f2293c0
SHA51282d4b8cc5eba1e7fd4a2e49b9a7a1d7a2991db7412a7e275b96e65222e91d404b2d316e1d0e22008a2fe6b80bdecce6ba5af7ab99b6990f2d4a72c073b28c89e
-
Filesize
11KB
MD590c2a928631adb35b82b70c5fea210b7
SHA1429bc2ff8ea4d40831da67cc6980670ce3028647
SHA2564f17dcc1c33ee1dcff1cdbbfb539baacd1a2d019ece0e0f46addd358e24eb542
SHA512671861330d913483e59411f758d87c2bb53d08ddde59e7aa4e519f83598ebed50bf9474bac729ace8e2d223723f2452ae6b667fb689762443e6344bd71e9e76f
-
Filesize
81KB
MD5d8bd270840a472772c700720058ee862
SHA1cf5911108294381ce10e84d2b1f9a2a9ef35bf57
SHA2568317aa181fd52763817fa3786f71c1809b9c5ba9aa3a9ef6b1b05a149494f583
SHA512d1a5018f5f115e066dd079a78aa46a777d19a340b550b90d652a70187f83e0356d045dfc311f4a0b0ee3cd1caf594b787e969675e0b9e8a70c1ff5d4cd844275