Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    446s
  • max time network
    454s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/09/2024, 19:56

Errors

Reason
Machine shutdown

General

  • Target

    SolaraFixer.exe

  • Size

    86KB

  • MD5

    28b71b14a91dc144298ac43e725d27fd

  • SHA1

    e6b8bd585e2dabc43d2dbbe6352eac60bdf93ac3

  • SHA256

    c3ea1603378e0bfbf7fcc64643144c0c5c699bcffc8505b68a251d00097a0c63

  • SHA512

    58446084d1e6365d017a0fac0ba10877b7e96a7dbacfb99dc375a65ce5716611cc341653006c043cd3968556c1d2e0559ebbf161c5c25db18ae23716654218f7

  • SSDEEP

    1536:0PJQdYi/z5s3d434+UHnaJCt53ZbHDSXtDq1MO6tXlMFjGkOWCK4vOnOS:2JQdhatn1HnaJCtRZbHDekadlMJDOWC

Malware Config

Extracted

Family

xworm

C2

accessories-retrieve.gl.at.ply.gg:13970

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    USB.exe

Signatures

  • Detect Xworm Payload 2 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 11 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 43 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2876
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\SolaraFixer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1468
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SolaraFixer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1716
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\SolaraFixer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2720
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SolaraFixer" /tr "C:\Users\Admin\AppData\Local\SolaraFixer.exe"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1896
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --new-window "data:text/html,<title>Welcome Chrome Browser</title>" --mute-audio --disable-audio
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc683ecc40,0x7ffc683ecc4c,0x7ffc683ecc58
        3⤵
          PID:1492
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2
          3⤵
            PID:1644
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --no-appcompat-clear --field-trial-handle=2156,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2164 /prefetch:3
            3⤵
              PID:1356
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --no-appcompat-clear --field-trial-handle=2228,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2540 /prefetch:8
              3⤵
                PID:3140
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3040,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3064 /prefetch:1
                3⤵
                  PID:3788
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4216,i,8652739147763629735,11070055491125312257,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4228 /prefetch:1
                  3⤵
                    PID:2780
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --new-window data:text/html,<title>Welcome_firefox_Browser</title>
                  2⤵
                    PID:864
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --new-window data:text/html,<title>Welcome_firefox_Browser</title>
                      3⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:1000
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1996 -parentBuildID 20240401114208 -prefsHandle 1924 -prefMapHandle 1916 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d285ae5-c2e7-43e9-bb04-73add706c6d4} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" gpu
                        4⤵
                          PID:3956
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2396 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {80461751-14b4-43d2-a8f8-71c99322f32d} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" socket
                          4⤵
                            PID:3840
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3160 -childID 1 -isForBrowser -prefsHandle 3136 -prefMapHandle 2988 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d965b0d-5c8b-4011-96ac-ba6799a0027b} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab
                            4⤵
                              PID:4892
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4004 -childID 2 -isForBrowser -prefsHandle 3108 -prefMapHandle 3032 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1de0953c-9455-45fe-acb8-49aa52b82e6e} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab
                              4⤵
                                PID:3760
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4968 -prefMapHandle 3916 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6df14975-9613-483e-947f-14dbbd72bec8} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" utility
                                4⤵
                                • Checks processor information in registry
                                PID:5360
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5368 -childID 3 -isForBrowser -prefsHandle 5340 -prefMapHandle 5356 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28d94ca8-6984-49de-b932-ab0cc46be4fb} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab
                                4⤵
                                  PID:5912
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5512 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4a25d77-b64c-41a4-a708-823c5992dd7d} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab
                                  4⤵
                                    PID:5924
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5724 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ea5fc71-f66c-4cfa-b07e-0c6e7099d4dd} 1000 "\\.\pipe\gecko-crash-server-pipe.1000" tab
                                    4⤵
                                      PID:5936
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --new-window "data:text/html,<title>Welcome Edge Browser</title>" --mute-audio --disable-audio
                                  2⤵
                                  • Enumerates system info in registry
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:2752
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc4a5346f8,0x7ffc4a534708,0x7ffc4a534718
                                    3⤵
                                      PID:3564
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
                                      3⤵
                                        PID:864
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --service-sandbox-type=none --mute-audio --mojo-platform-channel-handle=2164 /prefetch:3
                                        3⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:2624
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --service-sandbox-type=utility --mute-audio --mojo-platform-channel-handle=2736 /prefetch:8
                                        3⤵
                                          PID:3344
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                                          3⤵
                                            PID:5832
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
                                            3⤵
                                              PID:5688
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4024 /prefetch:2
                                              3⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5880
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --service-sandbox-type=none --mute-audio --mojo-platform-channel-handle=5152 /prefetch:8
                                              3⤵
                                                PID:5344
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --service-sandbox-type=none --mute-audio --mojo-platform-channel-handle=5152 /prefetch:8
                                                3⤵
                                                  PID:572
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
                                                  3⤵
                                                    PID:2684
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
                                                    3⤵
                                                      PID:2372
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
                                                      3⤵
                                                        PID:4456
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
                                                        3⤵
                                                          PID:448
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
                                                          3⤵
                                                            PID:5240
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,2078774095922174657,13161120745610717267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
                                                            3⤵
                                                              PID:5168
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
                                                            2⤵
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:3768
                                                            • C:\Windows\explorer.exe
                                                              "C:\Windows\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
                                                              3⤵
                                                                PID:436
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-3d-apis --disable-gpu --disable-d3d11 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data"
                                                              2⤵
                                                              • Enumerates system info in registry
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                              PID:4324
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc4a5346f8,0x7ffc4a534708,0x7ffc4a534718
                                                                3⤵
                                                                • Checks processor information in registry
                                                                • Enumerates system info in registry
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:4912
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2080 /prefetch:2
                                                                3⤵
                                                                  PID:4296
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2672 /prefetch:3
                                                                  3⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5560
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2916 /prefetch:8
                                                                  3⤵
                                                                    PID:1528
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
                                                                    3⤵
                                                                      PID:2364
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
                                                                      3⤵
                                                                        PID:3720
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
                                                                        3⤵
                                                                          PID:3592
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
                                                                          3⤵
                                                                            PID:1168
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=4928 /prefetch:8
                                                                            3⤵
                                                                              PID:5576
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=4928 /prefetch:8
                                                                              3⤵
                                                                                PID:2484
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
                                                                                3⤵
                                                                                  PID:5280
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
                                                                                  3⤵
                                                                                    PID:5536
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2100 /prefetch:2
                                                                                    3⤵
                                                                                      PID:2736
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2052 /prefetch:2
                                                                                      3⤵
                                                                                        PID:1696
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2448 /prefetch:2
                                                                                        3⤵
                                                                                          PID:1512
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2244 /prefetch:2
                                                                                          3⤵
                                                                                            PID:3520
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6001788925537394952,15570483638824361305,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5668 /prefetch:2
                                                                                            3⤵
                                                                                              PID:1860
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
                                                                                            2⤵
                                                                                              PID:3560
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc4a5346f8,0x7ffc4a534708,0x7ffc4a534718
                                                                                                3⤵
                                                                                                  PID:5428
                                                                                              • C:\Windows\SYSTEM32\shutdown.exe
                                                                                                shutdown.exe /f /r /t 0
                                                                                                2⤵
                                                                                                  PID:3596
                                                                                              • C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:4088
                                                                                              • C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                1⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:2292
                                                                                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                1⤵
                                                                                                  PID:4428
                                                                                                • C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                  C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                  1⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:516
                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:5572
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:3680
                                                                                                    • C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                      C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2392
                                                                                                    • C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                      C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                      1⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2544
                                                                                                    • C:\Windows\explorer.exe
                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                      1⤵
                                                                                                      • Modifies Internet Explorer settings
                                                                                                      • Modifies registry class
                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:2960
                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                                                                                                      1⤵
                                                                                                        PID:180
                                                                                                      • C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                        C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:32
                                                                                                      • C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                        C:\Users\Admin\AppData\Local\SolaraFixer.exe
                                                                                                        1⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:2984
                                                                                                      • C:\Windows\system32\LogonUI.exe
                                                                                                        "LogonUI.exe" /flags:0x4 /state0:0xa3977055 /state1:0x41c64e6d
                                                                                                        1⤵
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:2444

                                                                                                      Network

                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                      Replay Monitor

                                                                                                      Loading Replay Monitor...

                                                                                                      Downloads

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History

                                                                                                        Filesize

                                                                                                        160KB

                                                                                                        MD5

                                                                                                        3b1e79547d729708e2ec83bf16a9d1c9

                                                                                                        SHA1

                                                                                                        4a4d4084be819e04284e6a541072a89b50e5f518

                                                                                                        SHA256

                                                                                                        3465b92c0b481f0b7f3569c312de2881f43d92e77ef7c51222d4f6606135f67d

                                                                                                        SHA512

                                                                                                        f0a03f86500cb802b036a61a173991f9e2412d8a0746360f9cb1f07ad1e081e4ffa129121fa8445739200fda8c0dfb77ca0f3c1c9da3c69c7e68acb8cb2b9038

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                        Filesize

                                                                                                        962B

                                                                                                        MD5

                                                                                                        e759cb4c3bfae0594de4dc0df6ee06a1

                                                                                                        SHA1

                                                                                                        7e2e404b277190eb1c9a1751e7cb43d7ca36c227

                                                                                                        SHA256

                                                                                                        8fb30bea53ed89493791da18a808faadb093f46448b8fc88dbf20b9d6093833d

                                                                                                        SHA512

                                                                                                        2cf19d1ea2b741718d0f0ce788a061bb8c479b6687b6266effe7c2b7a9d7360b749b83d211f741b5528ca0a5221b50065a867dbbe0959a3a78691c6bb14a9cda

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                        Filesize

                                                                                                        2B

                                                                                                        MD5

                                                                                                        d751713988987e9331980363e24189ce

                                                                                                        SHA1

                                                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                        SHA256

                                                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                        SHA512

                                                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        9KB

                                                                                                        MD5

                                                                                                        c7227781b7f3e25e8109ce00cf410602

                                                                                                        SHA1

                                                                                                        88a30b6fd4d0a124436fcce1551f1ff92ef574a1

                                                                                                        SHA256

                                                                                                        a7c9466e3ee6e8754c5ea83561806eacc3036ca8cff7f25a4f9b18a39d0ec12e

                                                                                                        SHA512

                                                                                                        4eb5ff0a6fb3a3aa567eaca9240204777a9b611773910cf269143ea2b27d3c93adea2627a18b834f6829337436dba252d523fbdd2e5ad564474c9d4bf7e3172a

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        9KB

                                                                                                        MD5

                                                                                                        5713327779208b66c79814943f8ab14f

                                                                                                        SHA1

                                                                                                        2f13230851bc631a27106548a3a937c4732f1c78

                                                                                                        SHA256

                                                                                                        20aef0d76c5629e3f9ce0cf8684e0354cdc19bcd1dd8ebb6fdeafdf25f0ad07d

                                                                                                        SHA512

                                                                                                        1a3062dddaa9f0c8a35cdf208bd59dbe1c0d2abd89e6a9fd356f961e11fd728e8c392fd0911087e7f576f43aa3da12a7524ab37ffd9a8da93b930e6f9085136c

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        9KB

                                                                                                        MD5

                                                                                                        220a87da0728eada561133c7aafda19a

                                                                                                        SHA1

                                                                                                        46930e2e06c6749e964c9ce8a66ae21a78729f0e

                                                                                                        SHA256

                                                                                                        23b5c345136df59089cee81b8ce25f84d982b9f9a7ad4a194f2908d6fd0d74a6

                                                                                                        SHA512

                                                                                                        393c1c593f9e822311274596f3aa47b32a102cdf2be44fa423e56b2bf6b398ca7c5ddd7b1bbe8ffd6db49c650c73d87fbf5a2b0016c190d5d30388f9f4c9c81a

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        9KB

                                                                                                        MD5

                                                                                                        fbe408c0a1b6873c891173fe89237591

                                                                                                        SHA1

                                                                                                        d7c86ed813234c76d7386adf77f6054af17c49c7

                                                                                                        SHA256

                                                                                                        a8a9e79f02a10b17fa0f54ab93899f55ed6a5d14bb478d42919aa0a63e27a24b

                                                                                                        SHA512

                                                                                                        a7ac3ac3b6e64d85d8c6c42862ee9d78ca1c7de9f25a4eb306a3022d3faa6babd5a28fe22a54d5dbdbc326f5ae3321ee50907acd6e6bb7fd2dc04112239ed391

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        9KB

                                                                                                        MD5

                                                                                                        c5780b648a67097477158a1d59c7402a

                                                                                                        SHA1

                                                                                                        7feceda7f5fba4b847429465f13c93c584db647e

                                                                                                        SHA256

                                                                                                        25114bfaf86928f50f65f4d82e73d89bdc31757b063fcdedc1a22ca770df3fc6

                                                                                                        SHA512

                                                                                                        d4eb7292124b9c083ff73946d0aea2d6624a443d4c73f60808f69a1aa143f73af4d7ad4eac1bc006181a5d9aa3726bdf7ed8bae9aaa0f52ddcc79abea6381367

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

                                                                                                        Filesize

                                                                                                        264KB

                                                                                                        MD5

                                                                                                        056b952a1de6e62bc199a69f686e3ebb

                                                                                                        SHA1

                                                                                                        2b121cb2f7749fa8ac691ab18af8a10bedf17331

                                                                                                        SHA256

                                                                                                        e7c61c6482f100961de6a2e8f40d7c826199caa10928bc0dcf06ae1978050e06

                                                                                                        SHA512

                                                                                                        eee3dba3d262654f858654da9fe7fe7533af5532919a43433b72f70ecfa1914d5307bba8cb61a235451dd915b9f948621306e5e5e298555fcdae66c7a6692df2

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                        Filesize

                                                                                                        99KB

                                                                                                        MD5

                                                                                                        eb9d0f01cfa953429dd884d3735652f5

                                                                                                        SHA1

                                                                                                        949c20b72921ce99901e4f719969f8d2d7c4fbd7

                                                                                                        SHA256

                                                                                                        0b6ed9d57ad3573e53a9f0f26bad5a2b4d5b655e3075befa90d8fdec4cbbec92

                                                                                                        SHA512

                                                                                                        17880851f9e6b557d655d8d59b6da80cf0eaa75f338d6265e3ce72039cb2748403d7598d71f6052df83785de8a419f2a9920c15bdaf157040d387840a82ecca6

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                        Filesize

                                                                                                        99KB

                                                                                                        MD5

                                                                                                        9362874d6c107bc211772160d5d39de9

                                                                                                        SHA1

                                                                                                        cc39663f706677c70d3aa0369088c43b4ce90bf9

                                                                                                        SHA256

                                                                                                        30b1af49509b781fa8bad84a807660e7dbe44a75ad8c43539639c22c61437ac5

                                                                                                        SHA512

                                                                                                        0258872bb85c9b386316e140740c9c423a9198cb5bdefd1a66068ec71738c3b6a47a86bb3d144f8d04845633edc7deae8772a54c16f052afb7ef0291b6435ee5

                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                        Filesize

                                                                                                        99KB

                                                                                                        MD5

                                                                                                        881363a2843c4bf2a3874d180ff13ab5

                                                                                                        SHA1

                                                                                                        00ea5aac7e8802eb7bad970e6a2ed060395bc282

                                                                                                        SHA256

                                                                                                        3c64e47bb8ed037b2a389ec6706376fdcd51c7217ae8f1ca712ff1203be5d5fc

                                                                                                        SHA512

                                                                                                        83f61a6dc0df5cb5606853435b656135233857ab0cb6c463031e6f15747237ef194fa10f08b543d23a7c5e09d21ac992070a97a6c1967fe97d283b1d06ba6a9f

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SolaraFixer.exe.log

                                                                                                        Filesize

                                                                                                        654B

                                                                                                        MD5

                                                                                                        2ff39f6c7249774be85fd60a8f9a245e

                                                                                                        SHA1

                                                                                                        684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                        SHA256

                                                                                                        e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                        SHA512

                                                                                                        1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                        Filesize

                                                                                                        2KB

                                                                                                        MD5

                                                                                                        d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                        SHA1

                                                                                                        31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                        SHA256

                                                                                                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                        SHA512

                                                                                                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\CrashpadMetrics-active.pma

                                                                                                        Filesize

                                                                                                        16KB

                                                                                                        MD5

                                                                                                        3116632b5cce5c8477c694b708a9d8b6

                                                                                                        SHA1

                                                                                                        1711664c9680416067b96dedbd344b057b88f4aa

                                                                                                        SHA256

                                                                                                        b4335dbc7e97d271093ec652708e865214b03d1115628cea8255e5d13be14350

                                                                                                        SHA512

                                                                                                        d124de1b88e858d01cdd4c6c432f417cfbe67716183581b28be3ccdc60b67e09deb0268453e79931184df17cb491238a1b3fe43f71892515320d972a48d1851d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\CrashpadMetrics.pma

                                                                                                        Filesize

                                                                                                        16KB

                                                                                                        MD5

                                                                                                        f9abba11224c1ad45bcdaa95e882842b

                                                                                                        SHA1

                                                                                                        1c8bfbcb53d611f72ccc9b80c04eb4a1e45a2400

                                                                                                        SHA256

                                                                                                        bb7428477de5d502b5414b3123ae7bcd5aeb61d37da8492318a9a6b45242884b

                                                                                                        SHA512

                                                                                                        90a9a486a505a44e012d49104f3d87954f3c729a800939cc9b127f283eafd841db8c019ba30b96ab2ebed0ce4226af2147417b41242de2dc2d600af119345926

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata

                                                                                                        Filesize

                                                                                                        418B

                                                                                                        MD5

                                                                                                        d1880b52ace6a160627fafc5756ce857

                                                                                                        SHA1

                                                                                                        c99595518408c831908ca1ff7fcea71c90984b45

                                                                                                        SHA256

                                                                                                        c2b1dba54b609dd99e81dca60e6bc1450684fe29c1d6ffc2a69aeab533e313ff

                                                                                                        SHA512

                                                                                                        d404c20196f80e88abe0c94898c6368360520a5de17c6962613f5f14674cc892a898fd31ee15dd698ab8e17e87b54820e68717736ec69054620b2a907f0b0b67

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata

                                                                                                        Filesize

                                                                                                        552B

                                                                                                        MD5

                                                                                                        f682ba71a24342ef20ee68ce4c4b48da

                                                                                                        SHA1

                                                                                                        771c5a007e21b68531bcf7c34f7cf3c541f42ccc

                                                                                                        SHA256

                                                                                                        b6f255a42561d8ad9fbe9497ea1d2e85b2d6632a66e16d58a2dfb6a9d1d3ca87

                                                                                                        SHA512

                                                                                                        d64f34c91dde55ec2c85b7c6c7c05c93ade1d35acb3d1a87cdae8266316ae7e69aad207220ea02ca3db0548ae4ab9557cda8238f56b3fbab7f2f738131eb8460

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\008e3cb2-4581-4b0f-8f53-0e4c771166e6.dmp

                                                                                                        Filesize

                                                                                                        6.1MB

                                                                                                        MD5

                                                                                                        8dbbd958f83f2a2dbc55ebb2ceb3732b

                                                                                                        SHA1

                                                                                                        d2167fbafe884490e128ce6a67e75c7d7b443c20

                                                                                                        SHA256

                                                                                                        f446a9191b64d7abd0ca68965b4f3f667f228492db3951d4b553e2249cf89c46

                                                                                                        SHA512

                                                                                                        8f34cad880b75dc4bd1b31c964bfe2e1e458491ad3012c752a15c2634e25eddc260c04ae7a23265741cb27dffbf16d300c36595086a503424f90aec62b21fbdb

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\13812cab-814a-4649-bda0-ebe2de53bebe.dmp

                                                                                                        Filesize

                                                                                                        842KB

                                                                                                        MD5

                                                                                                        c8c20993ae7ffb4e9b3b609040c02558

                                                                                                        SHA1

                                                                                                        2512ae87c0fe64919e8d28a7f24922f82197651d

                                                                                                        SHA256

                                                                                                        237d4a1ffb063a7d4e4ebc16ddd6433dd694f193ab175f791780010c5c975540

                                                                                                        SHA512

                                                                                                        ece0a6cffd292a18f3a5356b257b50c33ff258bb0947e9229f7f56b69105e5cfe13df29e29ee4c8c5408db718d14c59e4c93c7e6cc03c8653d2e790829789fdb

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\186828fc-bc00-4488-83eb-25cfbfb5fb4f.dmp

                                                                                                        Filesize

                                                                                                        842KB

                                                                                                        MD5

                                                                                                        91e690fd40a4283ee6f9576c1a636b39

                                                                                                        SHA1

                                                                                                        f82cd8a810ec7ad7d74b6b45d84685b1ef4d6063

                                                                                                        SHA256

                                                                                                        be3bedec998356f5ce6dc08443bba881736e5b1cb69ffdc71fc5915fdc80f715

                                                                                                        SHA512

                                                                                                        4e93b648b470526f2c915f0afc571331244d44fb687278143498959e06258493ed10c4d1d3b9c0d293a0fe65b9d6b77b79e811e0f327a755a198ae122a9f626c

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ab40791f-4652-4d6f-ab68-ae661df8ffb1.dmp

                                                                                                        Filesize

                                                                                                        842KB

                                                                                                        MD5

                                                                                                        20ed30e579c7bab2bf7505bfc1e15c45

                                                                                                        SHA1

                                                                                                        61f688f063c2d86cc92390f9f590190c370768d9

                                                                                                        SHA256

                                                                                                        552c3d143a6e0d2a0ad5669837399f3d68eba1b2d56ce0bb8da3e203b0d17cd3

                                                                                                        SHA512

                                                                                                        3c76fe97f9f19c11edd4e8f0badc9b38cd4dbc2f32517cc601601b8e7e6534e2514ec61fe419beac6d841f808e84afda5d2cf3b2ff6c29e3e33f0cceefff649d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\e1fd1117-aaaf-4c88-92ae-dfbbadd30750.dmp

                                                                                                        Filesize

                                                                                                        842KB

                                                                                                        MD5

                                                                                                        bfd9aba0776e55dcb8aaa5eb70e97fa8

                                                                                                        SHA1

                                                                                                        52330295a1d677c23012da77775d3fd3368cbb3f

                                                                                                        SHA256

                                                                                                        ee8778a2bc59188ef52e149973e9bafd10f12efdce782f97784322ae3e0d9c30

                                                                                                        SHA512

                                                                                                        e60e3400ec0397b12e255a7b0d2f3fcb38fb6d69a2b569f8b6ed561443f278b3e6e5fc4972add8f4a1d7d703de0cfa76a9d03ce04e6500de6999eb41ce66cd94

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ecc4cdcf-f711-4a7d-9c58-66c1bbbb6650.dmp

                                                                                                        Filesize

                                                                                                        846KB

                                                                                                        MD5

                                                                                                        6f12cf4f85f34123731df1dca08441df

                                                                                                        SHA1

                                                                                                        b26b90f2f257fcfcacd84894cc04d829949060aa

                                                                                                        SHA256

                                                                                                        1651850af5df753944e885b0eab4b752b596cb4d9e6fddfab395c0946162bd87

                                                                                                        SHA512

                                                                                                        e7b02da792d3201e02496038da2896cfabff05ca969e245a5c5fdc98c2eb0c79e948457aff5d925a60962627f2b11d6fc62f9c47d60ddfcc449206e798801da9

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ed94f25a-5f77-4fdd-ac5a-0824c684a19c.dmp

                                                                                                        Filesize

                                                                                                        842KB

                                                                                                        MD5

                                                                                                        e51f06751ccea47f58af00a519f22daa

                                                                                                        SHA1

                                                                                                        2e5911382b40d19ed8473c9e20e3b30339761bb8

                                                                                                        SHA256

                                                                                                        7ea230d9bb55bbf8b943aab26e9615a7a513c62ef3ffdabace49c1ba4a7ae28f

                                                                                                        SHA512

                                                                                                        30a897e4b816b3e5e6bf33fe25735f87fde3501144bcedc5ffe4c0f9ff4f5b5d25783ba228a9a0d532c56818293218111f8f594dbdcbb17643a5814f8ba326a2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat

                                                                                                        Filesize

                                                                                                        152B

                                                                                                        MD5

                                                                                                        501f15e52b4b71879e8409455cac6d18

                                                                                                        SHA1

                                                                                                        a622abc49bd7c08d6413f55579527cff9ecaef9e

                                                                                                        SHA256

                                                                                                        6ccca8b65e3ca8cbe95c52985eb153b39ccc0ea3200bfde6b01a823975c861d5

                                                                                                        SHA512

                                                                                                        279a9112d0a05bfd8217dd19e6a04e3d49bc2a171af631300d1fc0f57eeebd9302713e593738d1312dd04c635d90235e27156db6bf4f56f1fe6eb30b01191836

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat

                                                                                                        Filesize

                                                                                                        152B

                                                                                                        MD5

                                                                                                        a720b09762b9b6e7ad667e84e7f9ad4e

                                                                                                        SHA1

                                                                                                        5e0d244b9012e13a9d9422347661e23d64c4dec7

                                                                                                        SHA256

                                                                                                        8f753db65f73cd3b0c8454bdfdd05fe9ab711a86207bcf3c733aa2d322bc01cf

                                                                                                        SHA512

                                                                                                        fe855256f0eabe1657fb0cf2506bf63ba38dd0e9db779ec93862c9410992679ae05fa2565fb3a0ba2d6966c01f44ebff4c9140a983ff6e348f79090fd35542f0

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\throttle_store.dat

                                                                                                        Filesize

                                                                                                        20B

                                                                                                        MD5

                                                                                                        9e4e94633b73f4a7680240a0ffd6cd2c

                                                                                                        SHA1

                                                                                                        e68e02453ce22736169a56fdb59043d33668368f

                                                                                                        SHA256

                                                                                                        41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                                                                                                        SHA512

                                                                                                        193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\5d26ca8e-a849-446c-aa95-a34d2ac64c84.tmp

                                                                                                        Filesize

                                                                                                        1B

                                                                                                        MD5

                                                                                                        5058f1af8388633f609cadb75a75dc9d

                                                                                                        SHA1

                                                                                                        3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                        SHA256

                                                                                                        cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                        SHA512

                                                                                                        0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        6KB

                                                                                                        MD5

                                                                                                        99a550f96a67eea2689fedb2908b4388

                                                                                                        SHA1

                                                                                                        905e55fa5f77ec216d845073df6450069650823b

                                                                                                        SHA256

                                                                                                        7d3f05f662582bf57ec1bd765171ee1c424143b54142efa685a1e161b2641516

                                                                                                        SHA512

                                                                                                        e66f6a364e3451830429532017217a684f900ded0fe9e1ac5d9e741cd2a408415893fc22bf5e142fd2ab0edd9421197419d263fed235a117677c6cb449d40ad2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Secure Preferences

                                                                                                        Filesize

                                                                                                        24KB

                                                                                                        MD5

                                                                                                        852d886f30a60b001ee9e16d15da655c

                                                                                                        SHA1

                                                                                                        713ae02473e2af931fb4455db3be07a00c734e97

                                                                                                        SHA256

                                                                                                        0c05a4e24bafde15c1c9cfa778ac25eb5552c22b1a589b7b473eebc752a6ca68

                                                                                                        SHA512

                                                                                                        09625a70076a264b7138dc14f2fe81b0e8ad6cc0ecb3cc4f5d5bd73eb58fab1e2528c5e3a3a40837740895a5a694b94b2fa174a8595960ef122823a4132d4f73

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Sync Data\LevelDB\LOG.old

                                                                                                        Filesize

                                                                                                        323B

                                                                                                        MD5

                                                                                                        0b3b9474b6ae312752c2bf1b7992c3a9

                                                                                                        SHA1

                                                                                                        fb4e52da92bfd5ddd4e71635ae717356b57818db

                                                                                                        SHA256

                                                                                                        0dd2892058c5ef992a841c4c027344245e39899f15e868e5a360d4847c3d02dc

                                                                                                        SHA512

                                                                                                        001f969519fc02b969ad7474b3a4989e916d5615be2032dfe83bf83856b88bd8b89bbe2bf8c105f383f2497422e7ce437f439effbcfd0da07b6e11e1e1dee6cb

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Web Data

                                                                                                        Filesize

                                                                                                        116KB

                                                                                                        MD5

                                                                                                        f70aa3fa04f0536280f872ad17973c3d

                                                                                                        SHA1

                                                                                                        50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                        SHA256

                                                                                                        8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                        SHA512

                                                                                                        30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                        SHA1

                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                        SHA256

                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                        SHA512

                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\CURRENT

                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                        SHA1

                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                        SHA256

                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                        SHA512

                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\MANIFEST-000001

                                                                                                        Filesize

                                                                                                        41B

                                                                                                        MD5

                                                                                                        5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                        SHA1

                                                                                                        d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                        SHA256

                                                                                                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                        SHA512

                                                                                                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\SmartScreen\local\download_cache

                                                                                                        Filesize

                                                                                                        184B

                                                                                                        MD5

                                                                                                        24127606dac5cc6142848b0387a3afb6

                                                                                                        SHA1

                                                                                                        2dd825cba2ded5f73de2f70d3056764788d6b3cd

                                                                                                        SHA256

                                                                                                        7680b8117dce679eaf37a1c4670506fda78781cfcd994295b5108db18fbbc3a8

                                                                                                        SHA512

                                                                                                        0c37b62b580255716371554cd47a1d7aa15a92b5376ff66d42cacf1e2fd95c027e7f8781231c4b0d9ccc17521a94f1e719cfd2307853d6d7d72dd8155ba6868b

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\SmartScreen\local\warnStateCache

                                                                                                        Filesize

                                                                                                        72B

                                                                                                        MD5

                                                                                                        3f66f244278461dd07a3feb77a17712f

                                                                                                        SHA1

                                                                                                        8d570b550699ad0f248ec98b5d678f54248c0a84

                                                                                                        SHA256

                                                                                                        203ce5c7c1680c6e98f5ceca920e9d904122a9e26a743191e9b0fe1f6584ed60

                                                                                                        SHA512

                                                                                                        8d4733222e2e0bbc18370055d0602d0389e7a562887e97b2e54073017ffea024e9b1341ed95e28883861ef5e0d4fa9d27ed0894912ffe167632aed2e4cf53e7d

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                        Filesize

                                                                                                        152B

                                                                                                        MD5

                                                                                                        983cbc1f706a155d63496ebc4d66515e

                                                                                                        SHA1

                                                                                                        223d0071718b80cad9239e58c5e8e64df6e2a2fe

                                                                                                        SHA256

                                                                                                        cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

                                                                                                        SHA512

                                                                                                        d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                        Filesize

                                                                                                        152B

                                                                                                        MD5

                                                                                                        111c361619c017b5d09a13a56938bd54

                                                                                                        SHA1

                                                                                                        e02b363a8ceb95751623f25025a9299a2c931e07

                                                                                                        SHA256

                                                                                                        d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

                                                                                                        SHA512

                                                                                                        fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

                                                                                                        Filesize

                                                                                                        319B

                                                                                                        MD5

                                                                                                        deb7e74e4f6694d41e324928f5a2dace

                                                                                                        SHA1

                                                                                                        e846da746c7515d7cc2f261479d35f3b764df819

                                                                                                        SHA256

                                                                                                        76d4b0e7ee9ee74ca6731e6137adc890c188611b00884c55773885476cf4fc4f

                                                                                                        SHA512

                                                                                                        fe334866943e7299b627d61afc586b113f1b737651e3074d4d569a25a92c28e6d36cda4c390dd73d20a1ef810078740ab04855d4c0aef8e552d862479e54d11b

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

                                                                                                        Filesize

                                                                                                        124KB

                                                                                                        MD5

                                                                                                        24c8470b7f78c805930c809d650d4f29

                                                                                                        SHA1

                                                                                                        fb0f8342f32197926d6d37deca3719ff06b09a6d

                                                                                                        SHA256

                                                                                                        3a5ba69e1321203163547b003d2f3bbf5f11cfff50e864df8db54ce4cc39e605

                                                                                                        SHA512

                                                                                                        d22ad74993ea657d0907b4be05bb7a4e00fb1ab4e51c6150ab1d41a8f7721e77726a1ef19a23f7fe87ce7d20e0ea5c85af53cace4d56a6082decbb5c5ada6f91

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        MD5

                                                                                                        228cf90dd19b6b420e1d186af8896d72

                                                                                                        SHA1

                                                                                                        3a23a263d1dca3246d2ac8a669b0b0b0efa9f1a7

                                                                                                        SHA256

                                                                                                        33e1866e50831526dbe1105433bfe9a46b8a537d8e5029840d3b49e065eecc1c

                                                                                                        SHA512

                                                                                                        2a9e85eba6fb170498869b3184d4c1c57ce06ba201734b8c3c2038bdec5089191590e03272dcf3ea1735d12792576e352b76416ac95d1ac3b49fe7ce0fab32b0

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

                                                                                                        Filesize

                                                                                                        334B

                                                                                                        MD5

                                                                                                        9dde91b5ef0417606ad36253a76739b5

                                                                                                        SHA1

                                                                                                        b6f9485b8ad5d1e134a2fb396dd61e095d0ce67c

                                                                                                        SHA256

                                                                                                        bdf4121ce34dce5d9be85392236ad1aec4fba7f6ce095245bb56fec2122adcff

                                                                                                        SHA512

                                                                                                        dbce5b3efebe42f355ff67884f2a679fdfff95ad542faecea422307e42302806fabcd62c5d14b8ef12a78b6a8262bc26e18f618b2d5fa5ec5a756fa506647b59

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        6KB

                                                                                                        MD5

                                                                                                        60747cd80f534794d2ee0addac6b4302

                                                                                                        SHA1

                                                                                                        625d72ceed33a11e4ccd329810bbcb54cb6bbdb6

                                                                                                        SHA256

                                                                                                        ce13b069024bd205614cf3edd988c5019260daf54b3c0805e46ad0dd0ef7a276

                                                                                                        SHA512

                                                                                                        d0821acdc48f7682b17ab4742af67ae6310734edb155c10136bbe1f64014aec0e66cb1889750e58dda00fe4dd24e7070457cbb4e75715b3afd5d7c445342419f

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        5KB

                                                                                                        MD5

                                                                                                        4db849673b4d557fd221522721e9a2c9

                                                                                                        SHA1

                                                                                                        31b41f8d4f25ed1d947d7dbbfdf5336ff48e3f7a

                                                                                                        SHA256

                                                                                                        1a183a93b55611fdfff48dc8c7bf7025d6e9804cf280c1c9ab8da5005360825f

                                                                                                        SHA512

                                                                                                        9f82753ed33eda7debc5b61c8b4a58145c05a1f784924e623bb95c42eaddd4bb603330bef2bbc6a7ecb3c2037a5c52bedd79c668f018cac0670e0351bfa69385

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        6KB

                                                                                                        MD5

                                                                                                        9c10505402b61285db088d23a7f1ac07

                                                                                                        SHA1

                                                                                                        486653857782d73dc7efd3fcd25eddd673e4a258

                                                                                                        SHA256

                                                                                                        c2ed8d412085a78a6a1dacf95ef9cd042f5b60e53359e7b869bff0e781249ecb

                                                                                                        SHA512

                                                                                                        547352d94fdc91eaceb9f053fe993c5bb7bd06894b44ac13b3d852c0f2096bdfcdd463076a981b6b9c19b3fe0ec8d01df0c71b02f8743e1bec498993b05f4613

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        6KB

                                                                                                        MD5

                                                                                                        e7b46e54636ba842bf82c1a02f741b4e

                                                                                                        SHA1

                                                                                                        ed5bae428f9d2aa367d6662c996903f8f41e5110

                                                                                                        SHA256

                                                                                                        5cc9c45f2d848d419fbebbeab7bf576235cd58547d314a378c53cea351290fb2

                                                                                                        SHA512

                                                                                                        a96c4f3db424cb3fb257fa77c7c6b82a8771cc65b1ab0eea0f55df58270644ba8e647415c868cef28885f1d4fab80f8f5b9ffa54cfeaf5eee28514241f3bcabd

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                        Filesize

                                                                                                        6KB

                                                                                                        MD5

                                                                                                        16483dd01e18eb31b4b7561ad1d81085

                                                                                                        SHA1

                                                                                                        75a2d7f9121a378dff5b4e05f073795de0578d2d

                                                                                                        SHA256

                                                                                                        5951f0c773abff9743ce421e90d35ddaa17428565f54b7d0cee5ac32b8c4eb85

                                                                                                        SHA512

                                                                                                        36978dfd131183f3b94125eb455a4044cedf003599b3859128e60729c9cfc04f9a0eeff657f3fdd05694371ac456bdf043066214ac876262710ba85c2ec038e0

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

                                                                                                        Filesize

                                                                                                        99B

                                                                                                        MD5

                                                                                                        ba92e5bbca79ea378c3376187ae43eae

                                                                                                        SHA1

                                                                                                        f0947098577f6d0fe07422acbe3d71510289e2fc

                                                                                                        SHA256

                                                                                                        ccf4c13cd2433fe8a7add616c7d8e6b384cf441e4d948de5c6fc73e9315c619f

                                                                                                        SHA512

                                                                                                        aa1d8b7eb9add6c5ed5635295f501f950914affc3fa9aa1ee58167ed110f99a1760b05e4efb779df8e432eab1b2a0fc9cf9d67a05b2d5432ff8f82c620a38a62

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

                                                                                                        Filesize

                                                                                                        322B

                                                                                                        MD5

                                                                                                        e3d56e98319cc7fa8e7a9b675548493b

                                                                                                        SHA1

                                                                                                        d1606bfaebd768d718212a032837c69e501cf606

                                                                                                        SHA256

                                                                                                        49492535092412ffee6d4fb27cbe627cf18a7d1ac1a1d3dfac182a407195d00a

                                                                                                        SHA512

                                                                                                        986583ac4265f41de895182b33ee3fec28985015640510946ffcc8602c1851e220b53aa173e08ce0bffae4fa33a5e71080aa2728a9e0b7fb9c45c9c5cd522df9

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

                                                                                                        Filesize

                                                                                                        350B

                                                                                                        MD5

                                                                                                        1d4bb4474709796a6484ef140089788c

                                                                                                        SHA1

                                                                                                        7ace846d1f786df462b6af030e1af5456d21ead3

                                                                                                        SHA256

                                                                                                        b582edb4c5cafc90ff37a897d0ab132bf863718b8a3666d4d234605f927972a0

                                                                                                        SHA512

                                                                                                        1649a9f272d4320b3c7d254a9bfdbe704df90721a6e1f2a2de036c10d7ff18f686cc1d22e0c90e312022507da0c5b48263866874f296688a6d57a0fc7a5fbc59

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

                                                                                                        Filesize

                                                                                                        323B

                                                                                                        MD5

                                                                                                        c947e2aebcf7082e7e7e3cdde81f0e6a

                                                                                                        SHA1

                                                                                                        7ad0083edcfb8c5680446348eb57027415b19816

                                                                                                        SHA256

                                                                                                        6e426bf140eeea27835110e5c2b661f8ea5c341a4a6ff0172f3b55e4c3da0a93

                                                                                                        SHA512

                                                                                                        9917554d1acda5c16937bac9a6cb9e76ec47622f2a5617896c1d76bdc225427c009702b3785fe2556270c44ab496884873e57b29ddc3e1e4ce64cdf78a1e40fd

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

                                                                                                        Filesize

                                                                                                        128KB

                                                                                                        MD5

                                                                                                        613def7cc416e5c92ea0623cb9a10473

                                                                                                        SHA1

                                                                                                        e0808dffc5b92f9a68efb5b9d785bbff1b93994b

                                                                                                        SHA256

                                                                                                        0877dd22ce5565f51a548fa4b364581e7a4f26c35401fe76276ecc9f3e54daf9

                                                                                                        SHA512

                                                                                                        5375b633708f6e0714b1fb2fb0a6e0c4d361a6032cf3302acf32744dcac3ac32a94d86eb066f80d4cef399e2a55db77149e98e9a4ea6ce6421831421362b7ea0

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

                                                                                                        Filesize

                                                                                                        57B

                                                                                                        MD5

                                                                                                        41c7d1373de8e7bd508c548a70910e51

                                                                                                        SHA1

                                                                                                        f919499049571c75c7eb73fdaaa5198e6dd641b6

                                                                                                        SHA256

                                                                                                        99c59cbe7db56d56a286485635e4467004641c6275e708887dd35728eb05109a

                                                                                                        SHA512

                                                                                                        c30cb4ea2478fd816b4a160626b08cb63d2b9dc50eab694607d44d05117e6af8dd707bf4e14cf001cf69007a654ade55149a61ed07f9de6a9a2edcb51afa0773

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

                                                                                                        Filesize

                                                                                                        319B

                                                                                                        MD5

                                                                                                        c33211a1c981d8cd7261e6c071b30e1b

                                                                                                        SHA1

                                                                                                        8d7be925015066db7bb2af43ba98fa72cccc08d0

                                                                                                        SHA256

                                                                                                        61e91428e97e08e9b17c511630cc252bc59cc83ed6c73167d355b5ad2a05d5ab

                                                                                                        SHA512

                                                                                                        8f4978ea2efb141cfbee741beb809a3b01692f59f70338c9eec27f53f6222001b973702558d7418010c9041e166dd13ea1919b73e58bb14caf876ba9680460f5

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

                                                                                                        Filesize

                                                                                                        160B

                                                                                                        MD5

                                                                                                        2e19a9040ed4a0c3ed82996607736b8f

                                                                                                        SHA1

                                                                                                        5a78ac2b74f385a12b019c420a681fd13e7b6013

                                                                                                        SHA256

                                                                                                        2eeb6d38d7aad1dc32e24d3ffd6438698c16a13efd1463d281c46b8af861a8ce

                                                                                                        SHA512

                                                                                                        86669994386b800888d4e3acb28ab36296594803824d78e095eb0c79642224f24aca5d2892596ac33b7a01b857367ed3a5e2c2fb3405f69a64eb8bf52c26753f

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

                                                                                                        Filesize

                                                                                                        337B

                                                                                                        MD5

                                                                                                        a0e9d50dfe241e8bacbfde35cc569dfd

                                                                                                        SHA1

                                                                                                        d181602182cf832023ae5471582edb38c977faf2

                                                                                                        SHA256

                                                                                                        40b28430410017a171a0bdacea19d018d0bbfa3e75fcad6f1163e0a8e29ea8d9

                                                                                                        SHA512

                                                                                                        a8834b693937a4aad87c48639e84f9750ab4415bbf61eb7c58861580d28ca40baea92ef88a67be07e55d9ecf887a8599f9d31e01a02720484ac94847575cba04

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

                                                                                                        Filesize

                                                                                                        44KB

                                                                                                        MD5

                                                                                                        b622ae214d410389f9f47b9c261f9000

                                                                                                        SHA1

                                                                                                        af3bb9a655d349f56568f5d9f58979f2acddc38a

                                                                                                        SHA256

                                                                                                        46d37bb15549f6452f9e96e692af8cd94d1ed4bba8ec92686cc8b43579e8458b

                                                                                                        SHA512

                                                                                                        30bf1ad3d3936a41b7944bdadead2b8696502d2cd6d5034abc909df0c0fb054081be4680d6c73bae12ca5b6c7ee9f5dad561fd3287ddffd2ec9f1fb30c2fedfa

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

                                                                                                        Filesize

                                                                                                        264KB

                                                                                                        MD5

                                                                                                        bc886700f15c286d7c21f263852bd248

                                                                                                        SHA1

                                                                                                        eebf6a1cb0cd98a6980976838ac14792ddbcdbe1

                                                                                                        SHA256

                                                                                                        9ef1cd03fcb831f1739d34b6271780a99a793c6535e54ba291c43e128a441e67

                                                                                                        SHA512

                                                                                                        d3bcb6357f7844f0c6fe97622b53daf5918061fa5496b8d3441d2962a3ba005d1e4dac720862b927e9564ec46cc7986d2a15ccd15e3a71f137caefb753d4abc9

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

                                                                                                        Filesize

                                                                                                        4.0MB

                                                                                                        MD5

                                                                                                        4459bf26eebf0293b75c624cdf1c6b23

                                                                                                        SHA1

                                                                                                        2a0cf63d7d2a2a729b1b84e221955a5ab46f2e47

                                                                                                        SHA256

                                                                                                        2ddd13a6fc974d25f11c33a905c39ba8b6d266f7c58a93a41e5ada5975c821c7

                                                                                                        SHA512

                                                                                                        f9246c653ea54d90833734d359ebba743e97a7978639a8c48f64f2b026affed9281e65a44d12af2224e0493df1e3ca3dfd8fd101bd4c5170471b5dd6dbaf8f12

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

                                                                                                        Filesize

                                                                                                        11B

                                                                                                        MD5

                                                                                                        838a7b32aefb618130392bc7d006aa2e

                                                                                                        SHA1

                                                                                                        5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                                                        SHA256

                                                                                                        ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                                                        SHA512

                                                                                                        9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        10KB

                                                                                                        MD5

                                                                                                        1c3a5865f3021173bd1e90e3d559b6a4

                                                                                                        SHA1

                                                                                                        2539bf42191d42b5e79754dbc5df2460c79cd025

                                                                                                        SHA256

                                                                                                        c68c6e72026ce68d64929c436fec36887dcc0b38515c72dd7d3736521303113c

                                                                                                        SHA512

                                                                                                        77c579c55114fe6b42a4888bd01e3f5087052d3a81abc82460915c8d8bafbbe714785fd4cb30ed821c1dbc63a63bebddefd2c1754a68d9ab7901009e7dc1d3fe

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                        Filesize

                                                                                                        10KB

                                                                                                        MD5

                                                                                                        59680d00db6655833fbd28419179370f

                                                                                                        SHA1

                                                                                                        686a9e52b03d403fe956ecab64d10202893f9dfd

                                                                                                        SHA256

                                                                                                        fc6b3d4b61833c444cc09248cd5f82e910eafef17d78df3131b6560c835fc5ab

                                                                                                        SHA512

                                                                                                        6789042b7bbe888ce165d4b4ea39f5de98254cf2041ab8e25c5bdca27814d14318092126c83bd4fc9bde665cf0d3de50bc614036d3efdc9f8958062b5a7a1093

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Safe Browsing Cookies

                                                                                                        Filesize

                                                                                                        20KB

                                                                                                        MD5

                                                                                                        49693267e0adbcd119f9f5e02adf3a80

                                                                                                        SHA1

                                                                                                        3ba3d7f89b8ad195ca82c92737e960e1f2b349df

                                                                                                        SHA256

                                                                                                        d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

                                                                                                        SHA512

                                                                                                        b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Filesize

                                                                                                        944B

                                                                                                        MD5

                                                                                                        6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                                        SHA1

                                                                                                        c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                                        SHA256

                                                                                                        2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                                        SHA512

                                                                                                        60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Filesize

                                                                                                        944B

                                                                                                        MD5

                                                                                                        22310ad6749d8cc38284aa616efcd100

                                                                                                        SHA1

                                                                                                        440ef4a0a53bfa7c83fe84326a1dff4326dcb515

                                                                                                        SHA256

                                                                                                        55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

                                                                                                        SHA512

                                                                                                        2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                        Filesize

                                                                                                        944B

                                                                                                        MD5

                                                                                                        50d3033f2bc3a3774c469d03e71a79a9

                                                                                                        SHA1

                                                                                                        22027b1d52085de99b3bffa276530fea5d961471

                                                                                                        SHA256

                                                                                                        2987e99ec7fa17bd4ab7de3cb4dc62645e1052012a5a357904d6fc6db9054147

                                                                                                        SHA512

                                                                                                        ecf7ab1a9e4192454a3e24c60453fd702a8c648e00078fc933b9182f4a3d3c10c6f5da622a5729b35727e6ddc8837029caddcaf76f56e805b9744253b56da5d8

                                                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zrrtvxky.default-release\cache2\entries\58EFA56DB4BFFECB0EDA547894BC9A057159E22F

                                                                                                        Filesize

                                                                                                        13KB

                                                                                                        MD5

                                                                                                        f2e68c70e846c88ed613011c12db54a1

                                                                                                        SHA1

                                                                                                        448f2c92fb1f4bfc34b4b875d70b8798ce527846

                                                                                                        SHA256

                                                                                                        a90a8d8b8d12d68c2d847035e3364d693fa4c34cf62ab42c8b1aa0d2b33c053a

                                                                                                        SHA512

                                                                                                        3c09f946b2b431cfa66f0f83079de0c8fda19da3b1bbf96ec0c614838f02ec9379ad91bfa50d6447aac884832f1a1d24e2331f655d1d5784efdd8b83c85961f8

                                                                                                      • C:\Users\Admin\AppData\Local\SolaraFixer.exe

                                                                                                        Filesize

                                                                                                        86KB

                                                                                                        MD5

                                                                                                        28b71b14a91dc144298ac43e725d27fd

                                                                                                        SHA1

                                                                                                        e6b8bd585e2dabc43d2dbbe6352eac60bdf93ac3

                                                                                                        SHA256

                                                                                                        c3ea1603378e0bfbf7fcc64643144c0c5c699bcffc8505b68a251d00097a0c63

                                                                                                        SHA512

                                                                                                        58446084d1e6365d017a0fac0ba10877b7e96a7dbacfb99dc375a65ce5716611cc341653006c043cd3968556c1d2e0559ebbf161c5c25db18ae23716654218f7

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o5ycz5pk.5md.ps1

                                                                                                        Filesize

                                                                                                        60B

                                                                                                        MD5

                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                        SHA1

                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                        SHA256

                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                        SHA512

                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                                                        Filesize

                                                                                                        479KB

                                                                                                        MD5

                                                                                                        09372174e83dbbf696ee732fd2e875bb

                                                                                                        SHA1

                                                                                                        ba360186ba650a769f9303f48b7200fb5eaccee1

                                                                                                        SHA256

                                                                                                        c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                                                                                        SHA512

                                                                                                        b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                                                        Filesize

                                                                                                        13.8MB

                                                                                                        MD5

                                                                                                        0a8747a2ac9ac08ae9508f36c6d75692

                                                                                                        SHA1

                                                                                                        b287a96fd6cc12433adb42193dfe06111c38eaf0

                                                                                                        SHA256

                                                                                                        32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                                                                                        SHA512

                                                                                                        59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

                                                                                                        Filesize

                                                                                                        5KB

                                                                                                        MD5

                                                                                                        747d17805ff44fa5ff8910458ab68d41

                                                                                                        SHA1

                                                                                                        080ca63067a085d985aaf17a5613e7fca828ffd5

                                                                                                        SHA256

                                                                                                        0d701e7c08e9366084a8c40306d00332a70c63434dfaca556dacb318cd86d3ab

                                                                                                        SHA512

                                                                                                        7b7a937003c5a2294e358f6310a07cdef9abe70a4b2999a6cebbb386830da0524bcef792390d7f975ff8e95d1407433f698db590e33cc9d52ad509437febe518

                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SolaraFixer.lnk

                                                                                                        Filesize

                                                                                                        988B

                                                                                                        MD5

                                                                                                        1456fc00a0d881711c9af65ef9d5c876

                                                                                                        SHA1

                                                                                                        252ae57f2d19771096c67c2be40b04b73079c352

                                                                                                        SHA256

                                                                                                        7a949b014047a8c083431af3099944b79eba09550cf726fb5ce67a150feb0dcd

                                                                                                        SHA512

                                                                                                        9946f611113604fa6a6fadfe0889e003c951585156ce46e87fc7e0c2c6e4bbf885d0edeb18139a804fa1a66db38baa6fdcc5c4a598304b4101366dbafb2865ba

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\AlternateServices.bin

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                        MD5

                                                                                                        f52c31b95a4bc999f78d95c0392224fa

                                                                                                        SHA1

                                                                                                        0f47c676f6ca51eb4644e59cb41ecf932192591e

                                                                                                        SHA256

                                                                                                        87a129fb827a8c3a388c226fb1d0e6b70443def4eacef6734a5ab48ba990f8a2

                                                                                                        SHA512

                                                                                                        7976b2083888beff8d5617450ace8d7d60ec326352d29fa02969687e21bf57c4baaeb6ca27af7950096db9c3c6a33f5d8996cd3f2dec42ccd76402e40fddf4e8

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                        Filesize

                                                                                                        5KB

                                                                                                        MD5

                                                                                                        abf0947fce6fdc43f9c71ebf6da83043

                                                                                                        SHA1

                                                                                                        8399a3ca8475319952e1b2bac194b02e54776c54

                                                                                                        SHA256

                                                                                                        70a01521a50386a8813baa68036ef69a41900ebce493f243596b2b855bdad73b

                                                                                                        SHA512

                                                                                                        f8dc68d88da6c2c62900149e1a1991c5da650dfda60d6080bf0c01dc2a4fc9901c2309380d01e13f5775de8efb3719a4afd8ad28f42c3f8612ff8373f0f51fc3

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                        Filesize

                                                                                                        13KB

                                                                                                        MD5

                                                                                                        b774f06501eeb429e31e6687b6cbbbbc

                                                                                                        SHA1

                                                                                                        9e09d8f374d7a4505c86194ad028f5e22ff57cae

                                                                                                        SHA256

                                                                                                        a39dd4387bc8786a40d5de713d3ab437c2b2a095dae0b9a2121229619aec106b

                                                                                                        SHA512

                                                                                                        d09034bdee0d8666249fd4ac49dfb2629b8d3779c1bcafe4cf4a92b7e833ec776172fbe1b4238992e398aab286c1e9493e2ba8888d601c1ed0e2939897fe0096

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\db\data.safe.tmp

                                                                                                        Filesize

                                                                                                        23KB

                                                                                                        MD5

                                                                                                        c25cf61a168cad6bd3bbbb3abaf4d919

                                                                                                        SHA1

                                                                                                        5ff04b8ba3afb724bf8540e8aa5a81826fe3814c

                                                                                                        SHA256

                                                                                                        cffbb39256be640739a77ae6876f10c0af945451bd9d2746d45c2de305ec2617

                                                                                                        SHA512

                                                                                                        48c68398370d6957d1362930cdcb0d87e04934db041feb2165b9634c9a7cdfbac743bcfddc63579c2e53e4b1485d6e4497581f9495796452f1166ff7828058c0

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\011096db-f604-4fcc-b524-a52d7b5a533f

                                                                                                        Filesize

                                                                                                        27KB

                                                                                                        MD5

                                                                                                        9b1589e09678847f775ca72343208812

                                                                                                        SHA1

                                                                                                        3f427e3bd03a26ed69f4af1cd9c38f367905d9ef

                                                                                                        SHA256

                                                                                                        906f64c6316c70781d8d8b47671a843fbd0e6b3925bafd6963744e4b25f0f04b

                                                                                                        SHA512

                                                                                                        5385d7c3b1a19591f5f4cf6033559c2103ae06835e6954f80d144fea04e8856742aef6bb5d5ff78cbe7da223c8755492d993327eb2413a7d21cdf0d2b410c6c5

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\03eff66f-6337-4661-b938-428245fcb854

                                                                                                        Filesize

                                                                                                        982B

                                                                                                        MD5

                                                                                                        4ae85e252c419a6476eb6c5430fba88a

                                                                                                        SHA1

                                                                                                        616048e64a039843709f8b8644968b1cf7087f79

                                                                                                        SHA256

                                                                                                        09cc5992e54d8c8d8f0d1e4be0e868b8242f1448a5dc586f9417261ddebee433

                                                                                                        SHA512

                                                                                                        00968c88217a95e3b4b9382f5735863145ded7c1c932fdb1e6a7d69b3f7e2ff670d4f3619c06466e2af78d9184fe8bd6a81c0e29d08afd68aaaf9c583b4684f9

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\datareporting\glean\pending_pings\63b003b8-064c-4ea9-ac8d-c0b58f198d9c

                                                                                                        Filesize

                                                                                                        671B

                                                                                                        MD5

                                                                                                        5a3849917c919cf52e625c9cf7f1cb9f

                                                                                                        SHA1

                                                                                                        307cd7d28caf80d4da1b72c91c4e8921eaee1425

                                                                                                        SHA256

                                                                                                        5a3dce59916d290a96496929db5030f7db92476ae09cd991d1b65c3a42a2f6aa

                                                                                                        SHA512

                                                                                                        7ae6d92fb3268d1e131597fc00f4f6ebc0cb401636723e188c18746b783928ed4120a12dc602eb7e1647326bf3aff88e5ed28cf6dc9ebcab7bcd9e2da0f7a062

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                        MD5

                                                                                                        842039753bf41fa5e11b3a1383061a87

                                                                                                        SHA1

                                                                                                        3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                                                                                        SHA256

                                                                                                        d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                                                                                        SHA512

                                                                                                        d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

                                                                                                        Filesize

                                                                                                        116B

                                                                                                        MD5

                                                                                                        2a461e9eb87fd1955cea740a3444ee7a

                                                                                                        SHA1

                                                                                                        b10755914c713f5a4677494dbe8a686ed458c3c5

                                                                                                        SHA256

                                                                                                        4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                                                                                        SHA512

                                                                                                        34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

                                                                                                        Filesize

                                                                                                        372B

                                                                                                        MD5

                                                                                                        bf957ad58b55f64219ab3f793e374316

                                                                                                        SHA1

                                                                                                        a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                                                                                        SHA256

                                                                                                        bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                                                                                        SHA512

                                                                                                        79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

                                                                                                        Filesize

                                                                                                        17.8MB

                                                                                                        MD5

                                                                                                        daf7ef3acccab478aaa7d6dc1c60f865

                                                                                                        SHA1

                                                                                                        f8246162b97ce4a945feced27b6ea114366ff2ad

                                                                                                        SHA256

                                                                                                        bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                                                                                        SHA512

                                                                                                        5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\places.sqlite

                                                                                                        Filesize

                                                                                                        5.0MB

                                                                                                        MD5

                                                                                                        973ac60bd4fb741e243e61749e39cb5e

                                                                                                        SHA1

                                                                                                        84ddcc43de65be7ad4a927bd6692962fcb614347

                                                                                                        SHA256

                                                                                                        8706e6a00042cecca21f7efd3513d2514c6a2377525c9150733008306e9da9c1

                                                                                                        SHA512

                                                                                                        23b3183cc5b72e5f97a026553d545316a11bcab0ce1ae2ebf4fcdda93a0222755bc5269b5ddcccb4a6da568c636d4c920bff305f5c1c5ff96f30e9430a503fed

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                                                                                                        Filesize

                                                                                                        16KB

                                                                                                        MD5

                                                                                                        27b674cd1062569a5ce6289d70cde2cc

                                                                                                        SHA1

                                                                                                        9ab807074a3c3b15ca6727e7b2dc12710eabc3c2

                                                                                                        SHA256

                                                                                                        c3313715c65ccdb0761e5c0df5c43cfff5e5d47cc14f1a2619016f7433c6a9f0

                                                                                                        SHA512

                                                                                                        4cdb744d3e5cead49b45ffb653ae4c4d489d9e68b65ec2bbd6a1cc25363970352b4273fe69caaea132083ab4009fda3b008228de3b45590bc684972f33ff9cee

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                                                                                                        Filesize

                                                                                                        13KB

                                                                                                        MD5

                                                                                                        0f8f4e76147f363a0d22dbd19abc8e85

                                                                                                        SHA1

                                                                                                        d76a34c8d80853621a54fbb4774e59ad1b79bb3a

                                                                                                        SHA256

                                                                                                        8b0728dbafa8cca47c89d1d21b297e2e01ccce44f0da5d40a9c175ed0842978e

                                                                                                        SHA512

                                                                                                        509667ad66b35bf9d77217e5b55c35caaaa162261b24511fcbfd5bbffed6a9a247aba7e7bc0e127ec7ffb92a8260ff2a19196a56e6d0e481389ee5605236a87c

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs-1.js

                                                                                                        Filesize

                                                                                                        16KB

                                                                                                        MD5

                                                                                                        37a552b30c99c6cfd6cd99e23eabdb9f

                                                                                                        SHA1

                                                                                                        ab0a528f3166f667a303210a23d34a8ace5ade96

                                                                                                        SHA256

                                                                                                        2231e6e55bdd59a47c2af4e42b3fada2c2055d484c82d700bb297e8fe750125e

                                                                                                        SHA512

                                                                                                        3df61891bb0d7d3b28cb67d183b5b6b75fa808ad2636289ef12fdd2e37d67383dae287c4f48c842dc5807401d0815e0f40fa95f7908028d698f1a2e71aa5640d

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

                                                                                                        Filesize

                                                                                                        11KB

                                                                                                        MD5

                                                                                                        022aa22afbc5e7438f2ba57d1da8a501

                                                                                                        SHA1

                                                                                                        33c4b6a266ecec6dd7d7e84a831919c6e905c474

                                                                                                        SHA256

                                                                                                        790c3a8f7ed43873f6b81e175d9d9464375e55781f819059c385efec4a6a97a6

                                                                                                        SHA512

                                                                                                        7773c7331355785e91ac710223415006ae5e61f78fa7b15c8868eb304338848343ab53d5ff6a1ea248eda1a6c023fb9f2b77869f24c51a339b338cec20b083b9

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\prefs.js

                                                                                                        Filesize

                                                                                                        11KB

                                                                                                        MD5

                                                                                                        8481aa5502b516806e984a49c40a0328

                                                                                                        SHA1

                                                                                                        2f9dabecd4d8625876d4b917791fdac641a0bda6

                                                                                                        SHA256

                                                                                                        21d807979654ac708ed24fe09511b547f2ffb5f39d2ac16be723094554ce7ef5

                                                                                                        SHA512

                                                                                                        5c3f268462bf8c515ea86517bea089e0a6298be06a131dcdd7cd483e5fadaaf6952de16a4e1255976e0a4092824af1341d5493f7cb202acc7ace7b3e8ca9a0a1

                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zrrtvxky.default-release\sessionCheckpoints.json

                                                                                                        Filesize

                                                                                                        181B

                                                                                                        MD5

                                                                                                        2d87ba02e79c11351c1d478b06ca9b29

                                                                                                        SHA1

                                                                                                        4b0fb1927ca869256e9e2e2d480c3feb8e67e6f1

                                                                                                        SHA256

                                                                                                        16b7be97c92e0b75b9f8a3c22e90177941c7e6e3fbb97c8d46432554429f3524

                                                                                                        SHA512

                                                                                                        be7e128c140a88348c3676afc49a143227c013056007406c66a3cae16aae170543ca8a0749136702411f502f2c933891d7dcdde0db81c5733415c818f1668185

                                                                                                      • C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC

                                                                                                        Filesize

                                                                                                        16B

                                                                                                        MD5

                                                                                                        20d2f870bdce4bf57ef6a10c0dd9eab3

                                                                                                        SHA1

                                                                                                        346d3a5770f677053430c242729981d0b5c0bf17

                                                                                                        SHA256

                                                                                                        8cd72c3892b87d461185d16bfc8682246aaa223ecc7dec8af99f52631ac17f1d

                                                                                                        SHA512

                                                                                                        d172195dd769c46630606973c19e0b6f0fff275f1425b2a1fa0dd8b2149970dd9c4049f49b40e825211c8d60112c6c4aa68dde7d9b83bdf672bd558a1d18a2bb

                                                                                                      • memory/1468-2-0x000001AEEFD80000-0x000001AEEFDA2000-memory.dmp

                                                                                                        Filesize

                                                                                                        136KB

                                                                                                      • memory/1468-15-0x00007FFC51220000-0x00007FFC51CE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1468-14-0x00007FFC51220000-0x00007FFC51CE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1468-13-0x00007FFC51220000-0x00007FFC51CE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1468-12-0x00007FFC51220000-0x00007FFC51CE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/1468-18-0x00007FFC51220000-0x00007FFC51CE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/2876-46-0x00007FFC51223000-0x00007FFC51225000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2876-51-0x00007FFC51220000-0x00007FFC51CE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/2876-1-0x00000000001E0000-0x00000000001FC000-memory.dmp

                                                                                                        Filesize

                                                                                                        112KB

                                                                                                      • memory/2876-52-0x00007FFC51220000-0x00007FFC51CE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/2876-4358-0x0000000000940000-0x000000000094C000-memory.dmp

                                                                                                        Filesize

                                                                                                        48KB

                                                                                                      • memory/2876-57-0x000000001B490000-0x000000001B49C000-memory.dmp

                                                                                                        Filesize

                                                                                                        48KB

                                                                                                      • memory/2876-60-0x00000000008A0000-0x00000000008B2000-memory.dmp

                                                                                                        Filesize

                                                                                                        72KB

                                                                                                      • memory/2876-3725-0x000000001CF10000-0x000000001D02E000-memory.dmp

                                                                                                        Filesize

                                                                                                        1.1MB

                                                                                                      • memory/2876-4603-0x00007FFC51220000-0x00007FFC51CE1000-memory.dmp

                                                                                                        Filesize

                                                                                                        10.8MB

                                                                                                      • memory/2876-0-0x00007FFC51223000-0x00007FFC51225000-memory.dmp

                                                                                                        Filesize

                                                                                                        8KB

                                                                                                      • memory/2876-3771-0x00000000008F0000-0x0000000000900000-memory.dmp

                                                                                                        Filesize

                                                                                                        64KB