Overview

overview

10

Static

static

3

a0340430d4...18.exe

windows11-21h2-x64

10

Resubmissions

27/11/2024, 09:18

241127-k9zz4atpgm 10

27/11/2024, 07:19

241127-h5x9laznhp 10

26/11/2024, 11:44

241126-nwbl5awlcj 10

26/11/2024, 11:26

241126-nj43xavqgk 10

26/11/2024, 11:06

241126-m7p38aykas 10

26/11/2024, 11:05

241126-m64j8avlem 10

26/11/2024, 10:59

241126-m3e3fsvkcm 10

26/11/2024, 06:07

241126-gvaj4svlhl 10

26/11/2024, 06:03

241126-gsj1rsvlbr 10

Analysis

  • max time kernel
    484s
  • max time network
    478s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/11/2024, 09:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe

  • Size

    388KB

  • MD5

    a0340430d4b1c1f6dd4048ab98f2e4b2

  • SHA1

    a43ff275972b4ed9b7f3ece61d7d49375db635e9

  • SHA256

    9b1622602d4ae8196316deeb91fbdd1346a4b31453f3762be119e24c84827217

  • SHA512

    54ca85bee0ded2a742c767565159c0e3121d8cd1d97cebc751d067b1ea45d9fca86b6d5acad5b472eddef23d20afcc8ae3497cdd411fd9f393d80e0c90f2cd8d

  • SSDEEP

    12288:XhTjRwlkwFrnAEryLFcG3yBrZTRDgZ8zOhG6:p4DRw7325gPh

Score
10/10
teslacryptdefense_evasiondiscoveryexecutionimpactpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\Recovery+jbwtx.txt

Family

teslacrypt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://tt54rfdjhb34rfbnknaerg.milerteddy.com/89A734646B474759 2. http://kkd47eh4hdjshb5t.angortra.at/89A734646B474759 3. http://ytrest84y5i456hghadefdsd.pontogrot.com/89A734646B474759 If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser 3. Type in the address bar: xlowfznrg4wf7dli.onion/89A734646B474759 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://tt54rfdjhb34rfbnknaerg.milerteddy.com/89A734646B474759 http://kkd47eh4hdjshb5t.angortra.at/89A734646B474759 http://ytrest84y5i456hghadefdsd.pontogrot.com/89A734646B474759 *-*-* Your personal page Tor-Browser: xlowfznrg4wf7dli.ONION/89A734646B474759
URLs

http://tt54rfdjhb34rfbnknaerg.milerteddy.com/89A734646B474759

http://kkd47eh4hdjshb5t.angortra.at/89A734646B474759

http://ytrest84y5i456hghadefdsd.pontogrot.com/89A734646B474759

http://xlowfznrg4wf7dli.ONION/89A734646B474759

Signatures

  • TeslaCrypt, AlphaCrypt

    Ransomware based on CryptoLocker. Shut down by the developers in 2016.

    ransomwareteslacrypt
  • Teslacrypt family
    teslacrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (795) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops startup file 6 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 52 IoCs
  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 1 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Checks system information in the registry 2 TTPs 6 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5468
    • C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\a0340430d4b1c1f6dd4048ab98f2e4b2_JaffaCakes118.exe"
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5948
      • C:\Windows\syqdcntkeekl.exe
        C:\Windows\syqdcntkeekl.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:6112
        • C:\Windows\syqdcntkeekl.exe
          C:\Windows\syqdcntkeekl.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5500
          • C:\Windows\System32\wbem\WMIC.exe
            "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:876
          • C:\Windows\SysWOW64\NOTEPAD.EXE
            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RECOVERY.TXT
            5⤵
            • System Location Discovery: System Language Discovery
            • Opens file in notepad (likely ransom note)
            PID:2396
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\RECOVERY.HTM
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:6004
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff518f3cb8,0x7fff518f3cc8,0x7fff518f3cd8
              6⤵
                PID:5188
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
                6⤵
                  PID:1476
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
                  6⤵
                    PID:1684
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
                    6⤵
                      PID:4460
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
                      6⤵
                        PID:3116
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
                        6⤵
                          PID:2664
                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
                          6⤵
                            PID:5088
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
                            6⤵
                              PID:3748
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
                              6⤵
                                PID:5028
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
                                6⤵
                                  PID:2692
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
                                  6⤵
                                    PID:5412
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
                                    6⤵
                                      PID:5428
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,5146504874487394807,14278116357191915362,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4856 /prefetch:2
                                      6⤵
                                        PID:4612
                                    • C:\Windows\System32\wbem\WMIC.exe
                                      "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /noin teractive
                                      5⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:5964
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c DEL C:\Windows\SYQDCN~1.EXE
                                      5⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:5036
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\A03404~1.EXE
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2152
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                              1⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4620
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5084cc40,0x7fff5084cc4c,0x7fff5084cc58
                                2⤵
                                  PID:5708
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:3900
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:944
                                  • C:\Windows\System32\rundll32.exe
                                    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                    1⤵
                                      PID:5684
                                    • C:\Program Files\Mozilla Firefox\private_browsing.exe
                                      "C:\Program Files\Mozilla Firefox\private_browsing.exe"
                                      1⤵
                                        PID:4376
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
                                          2⤵
                                            PID:5840
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -private-window
                                              3⤵
                                              • Checks processor information in registry
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SetWindowsHookEx
                                              PID:2008
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1852 -parentBuildID 20240401114208 -prefsHandle 1744 -prefMapHandle 1892 -prefsLen 21583 -prefMapSize 241323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b105156-2f64-4ed6-93e0-e4bf87fcc5f9} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" gpu
                                                4⤵
                                                  PID:3288
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2504 -parentBuildID 20240401114208 -prefsHandle 2496 -prefMapHandle 2484 -prefsLen 21583 -prefMapSize 241323 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c25bf6f0-365c-4eae-bd54-bb118de5a87b} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" socket
                                                  4⤵
                                                  • Checks processor information in registry
                                                  PID:5192
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3488 -childID 1 -isForBrowser -prefsHandle 3468 -prefMapHandle 3464 -prefsLen 21228 -prefMapSize 241323 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c68d8c17-17f2-4881-90b8-df9b35e16bb3} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" tab
                                                  4⤵
                                                    PID:2408
                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1480 -childID 2 -isForBrowser -prefsHandle 4092 -prefMapHandle 4088 -prefsLen 23850 -prefMapSize 241323 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f39a05af-96a2-407d-89aa-04aa39ded358} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" tab
                                                    4⤵
                                                      PID:3068
                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4092 -childID 3 -isForBrowser -prefsHandle 4180 -prefMapHandle 4408 -prefsLen 29491 -prefMapSize 241323 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f37ad234-0dde-4249-8d97-f73482742b43} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" tab
                                                      4⤵
                                                        PID:3296
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5300 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 5292 -prefMapHandle 5288 -prefsLen 30275 -prefMapSize 241323 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0c93638-4b38-4fc7-abfd-1950d5541ee8} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" utility
                                                        4⤵
                                                        • Checks processor information in registry
                                                        PID:5572
                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -parentBuildID 20240401114208 -prefsHandle 5704 -prefMapHandle 5696 -prefsLen 30275 -prefMapSize 241323 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac851356-f984-4dbe-b0a7-6ce3bae5b91d} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" rdd
                                                        4⤵
                                                          PID:3376
                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3548 -childID 4 -isForBrowser -prefsHandle 3932 -prefMapHandle 3504 -prefsLen 28707 -prefMapSize 241323 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92fd85fd-6228-4c35-8405-02158d6bd384} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" tab
                                                          4⤵
                                                            PID:5704
                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6120 -childID 5 -isForBrowser -prefsHandle 6148 -prefMapHandle 6152 -prefsLen 28707 -prefMapSize 241323 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc60c22d-ee53-43cb-9d43-b26f53761632} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" tab
                                                            4⤵
                                                              PID:5760
                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6424 -childID 6 -isForBrowser -prefsHandle 6344 -prefMapHandle 6352 -prefsLen 28707 -prefMapSize 241323 -jsInitHandle 948 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {734599a6-ab5b-485e-b0de-1756a2b0d537} 2008 "\\.\pipe\gecko-crash-server-pipe.2008" tab
                                                              4⤵
                                                                PID:5136
                                                        • C:\Windows\system32\BackgroundTransferHost.exe
                                                          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
                                                          1⤵
                                                            PID:1512
                                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                                                            1⤵
                                                            • Modifies system executable filetype association
                                                            • System Location Discovery: System Language Discovery
                                                            • Checks processor information in registry
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:860
                                                            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Checks system information in the registry
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1000
                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Modifies system executable filetype association
                                                                • Adds Run key to start application
                                                                • Checks system information in the registry
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies Internet Explorer settings
                                                                • Modifies registry class
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:5604
                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                                                                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Drops desktop.ini file(s)
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:556
                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                  /updateInstalled /background
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Modifies system executable filetype association
                                                                  • Checks system information in the registry
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies Internet Explorer settings
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4652
                                                          • C:\Windows\SysWOW64\DllHost.exe
                                                            "C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
                                                            1⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            PID:4776
                                                          • C:\Windows\SysWOW64\DllHost.exe
                                                            "C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
                                                            1⤵
                                                            • Loads dropped DLL
                                                            • System Location Discovery: System Language Discovery
                                                            PID:5488
                                                          • C:\Windows\system32\NOTEPAD.EXE
                                                            "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Recovery+jbwtx.txt
                                                            1⤵
                                                              PID:4752
                                                            • C:\Windows\SysWOW64\DllHost.exe
                                                              "C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
                                                              1⤵
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5984
                                                            • C:\Windows\SysWOW64\DllHost.exe
                                                              "C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
                                                              1⤵
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:5400
                                                            • C:\Windows\SysWOW64\DllHost.exe
                                                              "C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
                                                              1⤵
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:2764
                                                            • C:\Windows\SysWOW64\DllHost.exe
                                                              "C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}
                                                              1⤵
                                                              • Loads dropped DLL
                                                              • System Location Discovery: System Language Discovery
                                                              PID:3472
                                                            • C:\Windows\system32\svchost.exe
                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                              1⤵
                                                                PID:1696
                                                              • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                1⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                PID:5956
                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe
                                                                "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileCoAuth.exe" -Embedding
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • System Location Discovery: System Language Discovery
                                                                PID:6052

                                                              Network

                                                              MITRE ATT&CK Enterprise v15

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Windows Management Instrumentation

                                                              1
                                                              T1047

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Event Triggered Execution

                                                              2
                                                              T1546

                                                              Change Default File Association

                                                              1
                                                              T1546.001

                                                              Component Object Model Hijacking

                                                              1
                                                              T1546.015

                                                              Privilege Escalation

                                                              Boot or Logon Autostart Execution

                                                              1
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Event Triggered Execution

                                                              2
                                                              T1546

                                                              Change Default File Association

                                                              1
                                                              T1546.001

                                                              Component Object Model Hijacking

                                                              1
                                                              T1546.015

                                                              Defense Evasion

                                                              Indicator Removal

                                                              2
                                                              T1070

                                                              File Deletion

                                                              2
                                                              T1070.004

                                                              Modify Registry

                                                              4
                                                              T1112

                                                              Credential Access

                                                              Credentials from Password Stores

                                                              1
                                                              T1555

                                                              Credentials from Web Browsers

                                                              1
                                                              T1555.003

                                                              Unsecured Credentials

                                                              1
                                                              T1552

                                                              Credentials In Files

                                                              1
                                                              T1552.001

                                                              Discovery

                                                              Browser Information Discovery

                                                              1
                                                              T1217

                                                              Query Registry

                                                              5
                                                              T1012

                                                              System Information Discovery

                                                              4
                                                              T1082

                                                              System Location Discovery

                                                              1
                                                              T1614

                                                              System Language Discovery

                                                              1
                                                              T1614.001

                                                              Lateral Movement

                                                              Collection

                                                              Data from Local System

                                                              1
                                                              T1005

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Inhibit System Recovery

                                                              1
                                                              T1490

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              • C:\Program Files\7-Zip\Lang\Recovery+jbwtx.html
                                                                Filesize

                                                                9KB

                                                                MD5

                                                                3642dc859b1bfce74149ee056c0dade2

                                                                SHA1

                                                                4a618fb6b2ab814e34a1ae897a504682ccaae393

                                                                SHA256

                                                                fcffe560f1f536655d918b6e4cf974b7028f51db84152d80cca443833585b2fa

                                                                SHA512

                                                                0f5cbb164b8741ae83a2dc10d31025af4a8b983aeb1afeb27c592e61cb83cb1cc74db7acc77ac0f0cc36b88140074b45c89950cdd501777f8d69c5636baaaf2c

                                                                Download Submit

                                                              • C:\Program Files\7-Zip\Lang\Recovery+jbwtx.png
                                                                Filesize

                                                                62KB

                                                                MD5

                                                                e9a9d5e115c656ed5c88c1786cbd741b

                                                                SHA1

                                                                b441bff78af387c23ff7fe25f56ef693b8368e75

                                                                SHA256

                                                                cb4bfaf28b6d6102b9c4d700fb9924225f8c78b0cf997fe10b1d130d4521a793

                                                                SHA512

                                                                52f8eba3f058712da9ceadbc42f15cef1bba86573f6a2dea108ef40dc68250ab84abda4b4d0fc7183982636c6380b6bd918486f5e9ee89b4fbc15ea62905d6b3

                                                                Download Submit

                                                              • C:\Program Files\7-Zip\Lang\Recovery+jbwtx.txt
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                0c9bed92433007a9610efcc9dd721ca4

                                                                SHA1

                                                                f3482a6ad1875018d659b05bb42e27dc2d64664b

                                                                SHA256

                                                                b9f7a5b3f22b8dcf48a6c8a836745d8fe6c3df9505b38afa3662c8bf363ff3aa

                                                                SHA512

                                                                8b26d14f6720022c045a3617cf00d367fc7c66206e2ae437b93825ec4f617ae52814a19ec6f3a0010460c5bf027e6507c70bd1fcf980f23f40b0506cfeeada35

                                                                Download Submit

                                                              • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                                                Filesize

                                                                560B

                                                                MD5

                                                                d5b7d3bcca0a8a0e4ba76640023822e8

                                                                SHA1

                                                                2750812a1aab34b738d5f5da52e9da58b1803608

                                                                SHA256

                                                                b46b1e5659d84c81e8cfb3b77a263348f5f19af63151fb8dad5a71a10dfd227f

                                                                SHA512

                                                                705ef756a4e921bb460601f95ddb85ebe4b69f448604e528c8a6876ba2229be38c3b77b3f3c7c72b7590b28bdb1aadacd2545b6ae7b19ea1c0a1be7ea0132c4c

                                                                Download Submit

                                                              • C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
                                                                Filesize

                                                                560B

                                                                MD5

                                                                0d86f4d6a730b1432a5395ef9dffc2b8

                                                                SHA1

                                                                2b3da5a0b4de2c797d9136559ea4a8bb422e328a

                                                                SHA256

                                                                3b337a5b888fe42bb11ca1a598c68da78ca28f8fe82268554d3b82a22eff5ada

                                                                SHA512

                                                                a39a5d427b080de35fc5ab663341c47103fc187e99ce50a1779d4f7607d1975cfb74ab521602cb3ecc6bdede7415ecbece0b8f2cd2e5e168ca767e321773125a

                                                                Download Submit

                                                              • C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                                                Filesize

                                                                416B

                                                                MD5

                                                                7730e2a4d83e8fe02e962f85175df753

                                                                SHA1

                                                                82ab118fa8673252cd15467e955a4f9c9379fda9

                                                                SHA256

                                                                3e76902dbeded8a05da9d792cc01ef38b0cde72d4c8d3f6148b81d362c23cac6

                                                                SHA512

                                                                2db9e790656e174822924194f86aa605469a527fff9e2607edb348a983cefbf305826bf2b6ec92406a9b7baecedc3a3abc1de535ac7957971396f8a31a191e1a

                                                                Download Submit

                                                              • C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json
                                                                Filesize

                                                                102B

                                                                MD5

                                                                7d1d7e1db5d8d862de24415d9ec9aca4

                                                                SHA1

                                                                f4cdc5511c299005e775dc602e611b9c67a97c78

                                                                SHA256

                                                                ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

                                                                SHA512

                                                                1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                Filesize

                                                                40B

                                                                MD5

                                                                46b257e2db3a3cab4fe4e8b36a53c612

                                                                SHA1

                                                                2327a773bca75530bc9bd7c74ef0ec3acbf99adf

                                                                SHA256

                                                                e7c310337da9c0b11f73414f116c230092a508f82fe7a57d2fb80a16d1d0973f

                                                                SHA512

                                                                6c9cdbac647aa323073edce54767cff14c7d54ae4b41034980833ccf8567d05985fb9a148772241f9a070622951af71e0cd943dddc1bbf445dc1c217393855e2

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\58be31ff-a690-4f88-bfa7-1cb3437a4644.tmp
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                057fa075f34c57817a57e16955721b4b

                                                                SHA1

                                                                b8cf82a8ba7d957c69ed18ce1e5ff0cc23a664ff

                                                                SHA256

                                                                8bd67426541d476cfaa67f77434fe4efba1301c8b33dd01607c95ece1a02fb8f

                                                                SHA512

                                                                143845834d9914ba45e1bba4802d3a0e5f5be6dd1a79fbf78d9cc8a0c3ca15213bcc1e1f3476e284dc1600e67b66fb528973d9737472e5dce5239e5e67122ba5

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                Filesize

                                                                152B

                                                                MD5

                                                                c03d23a8155753f5a936bd7195e475bc

                                                                SHA1

                                                                cdf47f410a3ec000e84be83a3216b54331679d63

                                                                SHA256

                                                                6f5f7996d9b0e131dc2fec84859b7a8597c11a67dd41bdb5a5ef21a46e1ae0ca

                                                                SHA512

                                                                6ea9a631b454d7e795ec6161e08dbe388699012dbbc9c8cfdf73175a0ecd51204d45cf28a6f1706c8d5f1780666d95e46e4bc27752da9a9d289304f1d97c2f41

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                Filesize

                                                                152B

                                                                MD5

                                                                3d68c7edc2a288ee58e6629398bb9f7c

                                                                SHA1

                                                                6c1909dea9321c55cae38b8f16bd9d67822e2e51

                                                                SHA256

                                                                dfd733ed3cf4fb59f2041f82fdf676973783ffa75b9acca095609c7d4f73587b

                                                                SHA512

                                                                0eda66a07ec4cdb46b0f27d6c8cc157415d803af610b7430adac19547e121f380b9c6a2840f90fe49eaea9b48fa16079d93833c2bcf4b85e3c401d90d464ad2f

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                Filesize

                                                                5KB

                                                                MD5

                                                                d1bfeb2f8fae0be98fc19c889e3ed5d4

                                                                SHA1

                                                                d71a31cea9ec9f8121c2bf9f8e7a94a9e9dc07ce

                                                                SHA256

                                                                2c062a52c828201af17419eb276f6fe12fe993fbcaf6dced303efc46a682b69f

                                                                SHA512

                                                                f465fdf3796689f9987a1ae9c89c36ad486a38fa67969c6973eaaac500113330b2ef065a03df8cda195bc136dc4942ce3359e1d038525c4999cc332a8ca22e98

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                Filesize

                                                                5KB

                                                                MD5

                                                                f47e4b7c46f990a5bd951a345b3d3b85

                                                                SHA1

                                                                ceea93f5d4495332a6ae1aaec46c83246b2267b9

                                                                SHA256

                                                                d6ab4405f8e4db550b8e84bc98073905da06db3dc8400ba9b2baf008386144e9

                                                                SHA512

                                                                a2f78f33b57c4fdcba13a6b782eb0833cca5997d894e310aaf553d5f20a9f9de12cd0f29e32427394f3d05752ceef6a1511bf6362c0bdbfec9858542ea481367

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                Filesize

                                                                5KB

                                                                MD5

                                                                cef9547e6e2f1ba077abffc0102b789b

                                                                SHA1

                                                                689dc46af3fefbf16f16cc39713ec4179344e488

                                                                SHA256

                                                                575101cfd03281f5dee8e515d5cc2d11f197072635800ee763183c5255516026

                                                                SHA512

                                                                9f7aafadfddc11e9fd74a1536e0e2019c342d4b63bb3111a26c3da600e849d03fb19130ea31abbc2dd082acb62986f2a6f9cc18aa263f5a639477ee93e61ff34

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                Filesize

                                                                16B

                                                                MD5

                                                                206702161f94c5cd39fadd03f4014d98

                                                                SHA1

                                                                bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                SHA256

                                                                1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                SHA512

                                                                0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                Filesize

                                                                16B

                                                                MD5

                                                                46295cac801e5d4857d09837238a6394

                                                                SHA1

                                                                44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                SHA256

                                                                0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                SHA512

                                                                8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                134a33d7c94476f03d20d7d6f856c6e7

                                                                SHA1

                                                                dbc74894e7859530391fa4d1ce937ee627d5c4fa

                                                                SHA256

                                                                2e1ddd6966267781a9e33b6d70048c5fde655508695dac65c3dc9482738c8e05

                                                                SHA512

                                                                b13fc569926fdcf9bf0d03eedd41595f3cbfd34b16879d902184f6befeeed8cc5f700a0023113db595acc6f8418ab67bf94a15eee6c70f64484d7a70cbe22c00

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                7e964082621c08762b43eb2a9dad150d

                                                                SHA1

                                                                dc6e7b654054cabd6b81969ec4364de66d19532f

                                                                SHA256

                                                                396f9f346483e6626770e2e02548da931746459aff0000a4f2a87f8330d8c066

                                                                SHA512

                                                                49ac42f411c24ec4377d66f8fa0e092bd5c9091c13cba73b149e85b38b6b450e21b40ea9b55b3f529772f5844dbb55906fd93c022eb970d2538ebe8d7fb79927

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                                                                Filesize

                                                                553KB

                                                                MD5

                                                                57bd9bd545af2b0f2ce14a33ca57ece9

                                                                SHA1

                                                                15b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1

                                                                SHA256

                                                                a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf

                                                                SHA512

                                                                d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.dll
                                                                Filesize

                                                                504KB

                                                                MD5

                                                                4ffef06099812f4f86d1280d69151a3f

                                                                SHA1

                                                                e5da93b4e0cf14300701a0efbd7caf80b86621c3

                                                                SHA256

                                                                d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3

                                                                SHA512

                                                                d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-100.png
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                72747c27b2f2a08700ece584c576af89

                                                                SHA1

                                                                5301ca4813cd5ff2f8457635bc3c8944c1fb9f33

                                                                SHA256

                                                                6f028542f6faeaaf1f564eab2605bedb20a2ee72cdd9930bde1a3539344d721b

                                                                SHA512

                                                                3e7f84d3483a25a52a036bf7fd87aac74ac5af327bb8e4695e39dada60c4d6607d1c04e7769a808be260db2af6e91b789008d276ccc6b7e13c80eb97e2818aba

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-125.png
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                b83ac69831fd735d5f3811cc214c7c43

                                                                SHA1

                                                                5b549067fdd64dcb425b88fabe1b1ca46a9a8124

                                                                SHA256

                                                                cbdcf248f8a0fcd583b475562a7cdcb58f8d01236c7d06e4cdbfe28e08b2a185

                                                                SHA512

                                                                4b2ee6b3987c048ab7cc827879b38fb3c216dab8e794239d189d1ba71122a74fdaa90336e2ea33abd06ba04f37ded967eb98fd742a02463b6eb68ab917155600

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-150.png
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                771bc7583fe704745a763cd3f46d75d2

                                                                SHA1

                                                                e38f9d7466eefc6d3d2aaa327f1bd42c5a5c7752

                                                                SHA256

                                                                36a6aad9a9947ab3f6ac6af900192f5a55870d798bca70c46770ccf2108fd62d

                                                                SHA512

                                                                959ea603abec708895b7f4ef0639c3f2d270cfdd38d77ac9bab8289918cbd4dbac3c36c11bb52c6f01b0adae597b647bb784bba513d77875979270f4962b7884

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-200.png
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                09773d7bb374aeec469367708fcfe442

                                                                SHA1

                                                                2bfb6905321c0c1fd35e1b1161d2a7663e5203d6

                                                                SHA256

                                                                67d1bb54fcb19c174de1936d08b5dbdb31b98cfdd280bcc5122fb0693675e4f2

                                                                SHA512

                                                                f500ea4a87a24437b60b0dc3ec69fcc5edbc39c2967743ddb41093b824d0845ffddd2df420a12e17e4594df39f63adad5abb69a29f8456fed03045a6b42388bc

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-black_scale-400.png
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                e01cdbbd97eebc41c63a280f65db28e9

                                                                SHA1

                                                                1c2657880dd1ea10caf86bd08312cd832a967be1

                                                                SHA256

                                                                5cb8fd670585de8a7fc0ceede164847522d287ef17cd48806831ea18a0ceac1f

                                                                SHA512

                                                                ffd928e289dc0e36fa406f0416fb07c2eb0f3725a9cdbb27225439d75b8582d68705ec508e3c4af1fc4982d06d70ef868cafbfc73a637724dee7f34828d14850

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-100.png
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                19876b66df75a2c358c37be528f76991

                                                                SHA1

                                                                181cab3db89f416f343bae9699bf868920240c8b

                                                                SHA256

                                                                a024fc5dbe0973fd9267229da4ebfd8fc41d73ca27a2055715aafe0efb4f3425

                                                                SHA512

                                                                78610a040bbbb026a165a5a50dfbaf4208ebef7407660eea1a20e95c30d0d42ef1d13f647802a2f0638443ae2253c49945ebe018c3499ddbf00cfdb1db42ced1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-125.png
                                                                Filesize

                                                                3KB

                                                                MD5

                                                                8347d6f79f819fcf91e0c9d3791d6861

                                                                SHA1

                                                                5591cf408f0adaa3b86a5a30b0112863ec3d6d28

                                                                SHA256

                                                                e8b30bfcee8041f1a70e61ca46764416fd1df2e6086ba4c280bfa2220c226750

                                                                SHA512

                                                                9f658bc77131f4ac4f730ed56a44a406e09a3ceec215b7a0b2ed42d019d8b13d89ab117affb547a5107b5a84feb330329dc15e14644f2b52122acb063f2ba550

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-150.png
                                                                Filesize

                                                                3KB

                                                                MD5

                                                                de5ba8348a73164c66750f70f4b59663

                                                                SHA1

                                                                1d7a04b74bd36ecac2f5dae6921465fc27812fec

                                                                SHA256

                                                                a0bbe33b798c3adac36396e877908874cffaadb240244095c68dff840dcbbf73

                                                                SHA512

                                                                85197e0b13a1ae48f51660525557cceaeed7d893dd081939f62e6e8921bb036c6501d3bb41250649048a286ff6bac6c9c1a426d2f58f3e3b41521db26ef6a17c

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-200.png
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                f1c75409c9a1b823e846cc746903e12c

                                                                SHA1

                                                                f0e1f0cf35369544d88d8a2785570f55f6024779

                                                                SHA256

                                                                fba9104432cbb8ebbd45c18ef1ba46a45dd374773e5aa37d411bb023ded8efd6

                                                                SHA512

                                                                ed72eb547e0c03776f32e07191ce7022d08d4bcc66e7abca4772cdd8c22d8e7a423577805a4925c5e804ed6c15395f3df8aac7af62f1129e4982685d7e46bd85

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.contrast-white_scale-400.png
                                                                Filesize

                                                                8KB

                                                                MD5

                                                                adbbeb01272c8d8b14977481108400d6

                                                                SHA1

                                                                1cc6868eec36764b249de193f0ce44787ba9dd45

                                                                SHA256

                                                                9250ef25efc2a9765cf1126524256fdfc963c8687edfdc4a2ecde50d748ada85

                                                                SHA512

                                                                c15951cf2dc076ed508665cd7dac2251c8966c1550b78549b926e98c01899ad825535001bd65eeb2f8680cd6753cd47e95606ecf453919f5827ed12bca062887

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-100.png
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                57a6876000151c4303f99e9a05ab4265

                                                                SHA1

                                                                1a63d3dd2b8bdc0061660d4add5a5b9af0ff0794

                                                                SHA256

                                                                8acbdd41252595b7410ca2ed438d6d8ede10bd17fe3a18705eedc65f46e4c1c4

                                                                SHA512

                                                                c6a2a9124bc6bcf70d2977aaca7e3060380a4d9428a624cc6e5624c75ebb6d6993c6186651d4e54edf32f3491d413714ef97a4cdc42bae94045cd804f0ad7cba

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-125.png
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                d03b7edafe4cb7889418f28af439c9c1

                                                                SHA1

                                                                16822a2ab6a15dda520f28472f6eeddb27f81178

                                                                SHA256

                                                                a5294e3c7cd855815f8d916849d87bd2357f5165eb4372f248fdf8b988601665

                                                                SHA512

                                                                59d99f0b9a7813b28bae3ea1ae5bdbbf0d87d32ff621ff20cbe1b900c52bb480c722dd428578dea5d5351cc36f1fa56b2c1712f2724344f026fe534232812962

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-150.png
                                                                Filesize

                                                                5KB

                                                                MD5

                                                                a23c55ae34e1b8d81aa34514ea792540

                                                                SHA1

                                                                3b539dfb299d00b93525144fd2afd7dd9ba4ccbf

                                                                SHA256

                                                                3df4590386671e0d6fee7108e457eb805370a189f5fdfeaf2f2c32d5adc76abd

                                                                SHA512

                                                                1423a2534ae71174f34ee527fe3a0db38480a869cac50b08b60a2140b5587b3944967a95016f0b00e3ca9ced1f1452c613bb76c34d7ebd386290667084bce77d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-200.png
                                                                Filesize

                                                                6KB

                                                                MD5

                                                                13e6baac125114e87f50c21017b9e010

                                                                SHA1

                                                                561c84f767537d71c901a23a061213cf03b27a58

                                                                SHA256

                                                                3384357b6110f418b175e2f0910cffe588c847c8e55f2fe3572d82999a62c18e

                                                                SHA512

                                                                673c3bec7c2cd99c07ebfca0f4ab14cd6341086c8702fe9e8b5028aed0174398d7c8a94583da40c32cd0934d784062ad6db71f49391f64122459f8bb00222e08

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveMedTile.scale-400.png
                                                                Filesize

                                                                15KB

                                                                MD5

                                                                e593676ee86a6183082112df974a4706

                                                                SHA1

                                                                c4e91440312dea1f89777c2856cb11e45d95fe55

                                                                SHA256

                                                                deb0ec0ee8f1c4f7ea4de2c28ff85087ee5ff8c7e3036c3b0a66d84bae32b6bb

                                                                SHA512

                                                                11d7ed45f461f44fa566449bb50bcfce35f73fc775744c2d45ea80aeb364fe40a68a731a2152f10edc059dea16b8bab9c9a47da0c9ffe3d954f57da0ff714681

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                                                                Filesize

                                                                783B

                                                                MD5

                                                                f4e9f958ed6436aef6d16ee6868fa657

                                                                SHA1

                                                                b14bc7aaca388f29570825010ebc17ca577b292f

                                                                SHA256

                                                                292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b

                                                                SHA512

                                                                cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                                                                Filesize

                                                                1018B

                                                                MD5

                                                                2c7a9e323a69409f4b13b1c3244074c4

                                                                SHA1

                                                                3c77c1b013691fa3bdff5677c3a31b355d3e2205

                                                                SHA256

                                                                8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2

                                                                SHA512

                                                                087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                552b0304f2e25a1283709ad56c4b1a85

                                                                SHA1

                                                                92a9d0d795852ec45beae1d08f8327d02de8994e

                                                                SHA256

                                                                262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535

                                                                SHA512

                                                                9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                22e17842b11cd1cb17b24aa743a74e67

                                                                SHA1

                                                                f230cb9e5a6cb027e6561fabf11a909aa3ba0207

                                                                SHA256

                                                                9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42

                                                                SHA512

                                                                8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                                                                Filesize

                                                                3KB

                                                                MD5

                                                                3c29933ab3beda6803c4b704fba48c53

                                                                SHA1

                                                                056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c

                                                                SHA256

                                                                3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633

                                                                SHA512

                                                                09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-100.png
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                1f156044d43913efd88cad6aa6474d73

                                                                SHA1

                                                                1f6bd3e15a4bdb052746cf9840bdc13e7e8eda26

                                                                SHA256

                                                                4e11167708801727891e8dd9257152b7391fc483d46688d61f44b96360f76816

                                                                SHA512

                                                                df791d7c1e7a580e589613b5a56ba529005162d3564fffd4c8514e6afaa5eccea9cea9e1ac43bd9d74ee3971b2e94d985b103176db592e3c775d5feec7aac6d1

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-125.png
                                                                Filesize

                                                                2KB

                                                                MD5

                                                                09f3f8485e79f57f0a34abd5a67898ca

                                                                SHA1

                                                                e68ae5685d5442c1b7acc567dc0b1939cad5f41a

                                                                SHA256

                                                                69e432d1eec44bed4aad35f72a912e1f0036a4b501a50aec401c9fa260a523e3

                                                                SHA512

                                                                0eafeaf735cedc322719049db6325ccbf5e92de229cace927b78a08317e842261b7adbda03ec192f71ee36e35eb9bf9624589de01beaec2c5597a605fc224130

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-150.png
                                                                Filesize

                                                                3KB

                                                                MD5

                                                                ed306d8b1c42995188866a80d6b761de

                                                                SHA1

                                                                eadc119bec9fad65019909e8229584cd6b7e0a2b

                                                                SHA256

                                                                7e3f35d5eb05435be8d104a2eacf5bace8301853104a4ea4768601c607ddf301

                                                                SHA512

                                                                972a42f7677d57fcb8c8cb0720b21a6ffe9303ea58dde276cfe2f26ee68fe4cc8ae6d29f3a21a400253de7c0a212edf29981e9e2bca49750b79dd439461c8335

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-200.png
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                d9d00ecb4bb933cdbb0cd1b5d511dcf5

                                                                SHA1

                                                                4e41b1eda56c4ebe5534eb49e826289ebff99dd9

                                                                SHA256

                                                                85823f7a5a4ebf8274f790a88b981e92ede57bde0ba804f00b03416ee4feda89

                                                                SHA512

                                                                8b53dec59bba8b4033e5c6b2ff77f9ba6b929c412000184928978f13b475cd691a854fee7d55026e48eab8ac84cf34fc7cb38e3766bbf743cf07c4d59afb98f4

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.scale-400.png
                                                                Filesize

                                                                11KB

                                                                MD5

                                                                096d0e769212718b8de5237b3427aacc

                                                                SHA1

                                                                4b912a0f2192f44824057832d9bb08c1a2c76e72

                                                                SHA256

                                                                9a0b901e97abe02036c782eb6a2471e18160b89fd5141a5a9909f0baab67b1ef

                                                                SHA512

                                                                99eb3d67e1a05ffa440e70b7e053b7d32e84326671b0b9d2fcfcea2633b8566155477b2a226521bf860b471c5926f8e1f8e3a52676cacb41b40e2b97cb3c1173

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDrive.VisualElementsManifest.xml
                                                                Filesize

                                                                344B

                                                                MD5

                                                                5ae2d05d894d1a55d9a1e4f593c68969

                                                                SHA1

                                                                a983584f58d68552e639601538af960a34fa1da7

                                                                SHA256

                                                                d21077ad0c29a4c939b8c25f1186e2b542d054bb787b1d3210e9cab48ec3080c

                                                                SHA512

                                                                152949f5b661980f33608a0804dd8c43d70e056ae0336e409006e764664496fef6e60daa09fecb8d74523d3e7928c0dbd5d8272d8be1cf276852d88370954adc

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveStandaloneUpdater.exe
                                                                Filesize

                                                                2.9MB

                                                                MD5

                                                                9cdabfbf75fd35e615c9f85fedafce8a

                                                                SHA1

                                                                57b7fc9bf59cf09a9c19ad0ce0a159746554d682

                                                                SHA256

                                                                969fbb03015dd9f33baf45f2750e36b77003a7e18c3954fab890cddc94046673

                                                                SHA512

                                                                348923f497e615a5cd0ed428eb1e30a792dea310585645b721235d48f3f890398ad51d8955c1e483df0a712ba2c0a18ad99b977be64f5ee6768f955b12a4a236

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Resources.pri
                                                                Filesize

                                                                4KB

                                                                MD5

                                                                7473be9c7899f2a2da99d09c596b2d6d

                                                                SHA1

                                                                0f76063651fe45bbc0b5c0532ad87d7dc7dc53ac

                                                                SHA256

                                                                e1252527bc066da6838344d49660e4c6ff2d1ddfda036c5ec19b07fdfb90c8c3

                                                                SHA512

                                                                a4a5c97856e314eedbad38411f250d139a668c2256d917788697c8a009d5408d559772e0836713853704e6a3755601ae7ee433e07a34bd0e7f130a3e28729c45

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dll
                                                                Filesize

                                                                451KB

                                                                MD5

                                                                50ea1cd5e09e3e2002fadb02d67d8ce6

                                                                SHA1

                                                                c4515f089a4615d920971b28833ec739e3c329f3

                                                                SHA256

                                                                414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902

                                                                SHA512

                                                                440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dll
                                                                Filesize

                                                                432KB

                                                                MD5

                                                                037df27be847ef8ab259be13e98cdd59

                                                                SHA1

                                                                d5541dfa2454a5d05c835ec5303c84628f48e7b2

                                                                SHA256

                                                                9fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec

                                                                SHA512

                                                                7e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\msvcp140.dll
                                                                Filesize

                                                                425KB

                                                                MD5

                                                                ce8a66d40621f89c5a639691db3b96b4

                                                                SHA1

                                                                b5f26f17ddd08e1ba73c57635c20c56aaa46b435

                                                                SHA256

                                                                545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7

                                                                SHA512

                                                                85fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dll
                                                                Filesize

                                                                73KB

                                                                MD5

                                                                cefcd5d1f068c4265c3976a4621543d4

                                                                SHA1

                                                                4d874d6d6fa19e0476a229917c01e7c1dd5ceacd

                                                                SHA256

                                                                c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817

                                                                SHA512

                                                                d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                Filesize

                                                                2.3MB

                                                                MD5

                                                                c2938eb5ff932c2540a1514cc82c197c

                                                                SHA1

                                                                2d7da1c3bfa4755ba0efec5317260d239cbb51c3

                                                                SHA256

                                                                5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665

                                                                SHA512

                                                                5deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                Filesize

                                                                40.2MB

                                                                MD5

                                                                fb4aa59c92c9b3263eb07e07b91568b5

                                                                SHA1

                                                                6071a3e3c4338b90d892a8416b6a92fbfe25bb67

                                                                SHA256

                                                                e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

                                                                SHA512

                                                                60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
                                                                Filesize

                                                                38B

                                                                MD5

                                                                cc04d6015cd4395c9b980b280254156e

                                                                SHA1

                                                                87b176f1330dc08d4ffabe3f7e77da4121c8e749

                                                                SHA256

                                                                884d272d16605590e511ae50c88842a8ce203a864f56061a3c554f8f8265866e

                                                                SHA512

                                                                d3cb7853b69649c673814d5738247b5fbaaae5bb7b84e4c7b3ff5c4f1b1a85fc7261a35f0282d79076a9c862e5e1021d31a318d8b2e5a74b80500cb222642940

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\Personal\logUploaderSettings_temp.ini
                                                                Filesize

                                                                108B

                                                                MD5

                                                                bd2acfe951ad66b9b5aa18f15207ca12

                                                                SHA1

                                                                7460d2627597502bc1614fd99d3de1fe6e5572c8

                                                                SHA256

                                                                4a4e1e31ead81081263f3edcc4918af7ff9892a08f0e8ef3a85c32b368a745e2

                                                                SHA512

                                                                7c05f3f539595950bcd34b2552077f31d396105dd855cbc987bd58a254d7301550ffabbcb0d78c6fbceaed693cf641e482b0822d16c16a710d8d40ab2543d6b0

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                                                                Filesize

                                                                63KB

                                                                MD5

                                                                e516a60bc980095e8d156b1a99ab5eee

                                                                SHA1

                                                                238e243ffc12d4e012fd020c9822703109b987f6

                                                                SHA256

                                                                543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

                                                                SHA512

                                                                9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
                                                                Filesize

                                                                77B

                                                                MD5

                                                                7b9f62105c3eca365720f7d2493e8a48

                                                                SHA1

                                                                759ba360475e21dd14e68d9820695d94dc1638e1

                                                                SHA256

                                                                466b7af39ac0f71f8239fd70aed21689b4c34e891c4c6b33517ab917463e3884

                                                                SHA512

                                                                f5597f21a69fca9b1ee37a2e5a7fac6b29e3a2b3efc47edfe8b9117957c1ead20884f97d82e6aa7e45a7b4f1750061a6ed26add4d5c1667670fe46e9d2b9470d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WWJCOAEQ\update100[1].xml
                                                                Filesize

                                                                726B

                                                                MD5

                                                                53244e542ddf6d280a2b03e28f0646b7

                                                                SHA1

                                                                d9925f810a95880c92974549deead18d56f19c37

                                                                SHA256

                                                                36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

                                                                SHA512

                                                                4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\activity-stream.discovery_stream.json.tmp
                                                                Filesize

                                                                19KB

                                                                MD5

                                                                5b658457e8bc1e88aceba2b43988213b

                                                                SHA1

                                                                5ffaa22b1058aa057c26b8d4be38d1559239640d

                                                                SHA256

                                                                d824d872e9f5932a4167ee2334a8be5c006f0bcfe8a3c5a362dab902be5226ea

                                                                SHA512

                                                                f2e82a248124fbbdb2d2c557307bf649349992f6717f575db5dee79b973c012bcf5f881608563a52e58bb511291f720fbfdec5149067b056d66723a5f29366e5

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\cache2\entries\15AB8100E9EA03F53EFED5C8DC84E5E397EDB150
                                                                Filesize

                                                                13KB

                                                                MD5

                                                                f3401fd4222276b41ea9a7197d1e2268

                                                                SHA1

                                                                ff05f8ed6847fa506b34b841c06c0032ad14d02b

                                                                SHA256

                                                                6d5b9b2210dd78c9f997b64e8d33aa577d180239a10f682d76a2a73a990a1d87

                                                                SHA512

                                                                6397825938344bc665b4d9045671313a55900a1ebcc7de82bed6ac66c2f447ba187e4a32ebdf8a2ace4cdcc23ed761bbf5bebe96ad9b31ef72e5a0f8b65b7795

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\o7bdpohx.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl.tmp
                                                                Filesize

                                                                13KB

                                                                MD5

                                                                f99b4984bd93547ff4ab09d35b9ed6d5

                                                                SHA1

                                                                73bf4d313cb094bb6ead04460da9547106794007

                                                                SHA256

                                                                402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069

                                                                SHA512

                                                                cd0ed84a24d3faae94290aca1b5ef65eef4cfba8a983da9f88ee3268fc611484a72bd44ca0947c0ca8de174619debae4604e15e4b2c364e636424ba1d37e1759

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\21d2d7f2-16b3-4cfd-9290-efef95674fbb.down_data
                                                                Filesize

                                                                555KB

                                                                MD5

                                                                5683c0028832cae4ef93ca39c8ac5029

                                                                SHA1

                                                                248755e4e1db552e0b6f8651b04ca6d1b31a86fb

                                                                SHA256

                                                                855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

                                                                SHA512

                                                                aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Local\Temp\tmp8077.tmp
                                                                Filesize

                                                                35.9MB

                                                                MD5

                                                                5b16ef80abd2b4ace517c4e98f4ff551

                                                                SHA1

                                                                438806a0256e075239aa8bbec9ba3d3fb634af55

                                                                SHA256

                                                                bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009

                                                                SHA512

                                                                69a22b063ab92ca7e941b826400c62be41ae0317143387c8aa8c727b5c9ee3528ddd4014de22a2a2e2cbae801cb041fe477d68d2684353cdf6c83d7ee97c43d4

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\db\data.safe.tmp
                                                                Filesize

                                                                280B

                                                                MD5

                                                                1ccdc2b414994d78374749a040b07f54

                                                                SHA1

                                                                1ba2b949b476a22f06a56f6bd365bbf65d93023e

                                                                SHA256

                                                                d7c1c99cdab08f2c32f1b5efc5ddcac2278a584fdaab1ef7459b25ee49981cbc

                                                                SHA512

                                                                f9a00b90b5a096b3122e6f252f5a62c3c317624a722274f2a92aaf98b2ba0610b34ac53fb230de2823268a4a3ab4b19f4e231f58bfb681ca840791cea3cb8457

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\datareporting\glean\deletion_request\1ade3cdd-5f80-4f37-bc2c-2c3bf841f85a
                                                                Filesize

                                                                575B

                                                                MD5

                                                                b950f513d8a1f674bbf362142f51ad4f

                                                                SHA1

                                                                a80be57c53b05961d75df0a969daac74e90a9471

                                                                SHA256

                                                                5d99439e6892a3b48d19bf7cc357ea6bad55b493c8a81a2876d3e80b5096fd29

                                                                SHA512

                                                                f8a61b857d06a4351e3fa91f8773cbab6f4c1742887471cd795aa1441708f306968baa9e32d758a40a87d6ead5846b387fd7cb899c25a53adaa3ca589539c0b4

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                f1efe2ddb25f4933521e231743a2caa2

                                                                SHA1

                                                                b3ea4ef234d005937012cf7d31dddfb15ea522d8

                                                                SHA256

                                                                c6a3198922d4d6f3f9a9a9e94d6765e9b858683c55a8681f730d2999f18dc694

                                                                SHA512

                                                                5cf0ed83b3b4132d43c7187f90bdab2b349e58142e95046ede9db1eff8fb49a4e4e034c67a79f7310f4debc105b1aa4f04d1db73b18626ba9dedeb974f4622d4

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                289cf784e7fe141508762134efc42cf3

                                                                SHA1

                                                                7426ac95800255f696c2c681b9fac73254a669ee

                                                                SHA256

                                                                ab77a1ab3c3544332c594b3a5de85a58c8a8c622a3f2da59ef4fd7e71d7a61f1

                                                                SHA512

                                                                65366476a4f71e89d5b738e97575d98e08e71ada4ad8c5cd1263c7b714fc029628258d0eb7b41684fd8590f008880ac454416907c9749b7041d4fd33c07321bb

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs-1.js
                                                                Filesize

                                                                10KB

                                                                MD5

                                                                efed12a87c58e7d7c102c296e645dea9

                                                                SHA1

                                                                e2d6b6df6af5c61240c40b6778a02ed7ea320e14

                                                                SHA256

                                                                9b4f8af441e87c44bae64e6042dc685d9a09e963abcfc7b04c7da03b4b23373b

                                                                SHA512

                                                                433c89e04034e574a9b2ca7e0a90eac0206f73de385624fc23221c0869ab7fc156d9e76dd33e261602bef7cfb66506054284898295c6b959bbe3cb16996eb3fe

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\prefs.js
                                                                Filesize

                                                                1KB

                                                                MD5

                                                                45985326a73fefbdb5810bb8ea86dd5a

                                                                SHA1

                                                                50a797c8e4ad0ed89690a97ea0616f1fd692609a

                                                                SHA256

                                                                70aa7e17c69f51c4bed86632aafad9babca0289a26f5c8be7efb8af239de06d3

                                                                SHA512

                                                                0319fdfbd96525163fc06eeff1ca3460b1766ff232389628cd07de7c719876218edf44d5044a3c8a5cd20375ddcd1e303cd58f5ac3a47a055b32f9528779a57d

                                                                Download Submit

                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\o7bdpohx.default-release\sessionCheckpoints.json.tmp
                                                                Filesize

                                                                259B

                                                                MD5

                                                                e6c20f53d6714067f2b49d0e9ba8030e

                                                                SHA1

                                                                f516dc1084cdd8302b3e7f7167b905e603b6f04f

                                                                SHA256

                                                                50a670fb78ff2712aae2c16d9499e01c15fddf24e229330d02a69b0527a38092

                                                                SHA512

                                                                462415b8295c1cdcac0a7cb16bb8a027ef36ae2ce0b061071074ac3209332a7eae71de843af4b96bbbd6158ca8fd5c18147bf9a79b8a7768a9a35edce8b784bf

                                                                Download Submit

                                                              • C:\Users\Admin\OneDrive\desktop.ini
                                                                Filesize

                                                                96B

                                                                MD5

                                                                2b98cc2afc1d0907c7066453643faac3

                                                                SHA1

                                                                864b3477bba5fb913b0e017f7bc087c3c6af95c4

                                                                SHA256

                                                                f625a1050e8ba6df4de974c2acc572e1e637a3429bf2ee1449c552999a6c7268

                                                                SHA512

                                                                9e2eecf1715378f44539cc79c718bcfd9181728e9f2330e34d228badd482ce48a8b916275a0d063dfbcdcadcde25be82c43fea44aea0393ecf3385095550c6e2

                                                                Download Submit

                                                              • C:\Windows\syqdcntkeekl.exe
                                                                Filesize

                                                                388KB

                                                                MD5

                                                                a0340430d4b1c1f6dd4048ab98f2e4b2

                                                                SHA1

                                                                a43ff275972b4ed9b7f3ece61d7d49375db635e9

                                                                SHA256

                                                                9b1622602d4ae8196316deeb91fbdd1346a4b31453f3762be119e24c84827217

                                                                SHA512

                                                                54ca85bee0ded2a742c767565159c0e3121d8cd1d97cebc751d067b1ea45d9fca86b6d5acad5b472eddef23d20afcc8ae3497cdd411fd9f393d80e0c90f2cd8d

                                                                Download Submit

                                                              • memory/5468-0-0x0000000000D80000-0x0000000000D83000-memory.dmp

                                                                Filesize

                                                                12KB

                                                                Download

                                                              • memory/5468-1-0x0000000000D80000-0x0000000000D83000-memory.dmp

                                                                Filesize

                                                                12KB

                                                                Download

                                                              • memory/5468-4-0x0000000000D80000-0x0000000000D83000-memory.dmp

                                                                Filesize

                                                                12KB

                                                                Download

                                                              • memory/5500-4623-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-17-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-10565-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-2366-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-2365-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-511-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-25-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-24-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-10566-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-20-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-19-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-8050-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-18-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-10615-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-10575-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5500-10574-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5948-6-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5948-5-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5948-3-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5948-2-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/5948-13-0x0000000000400000-0x0000000000486000-memory.dmp

                                                                Filesize

                                                                536KB

                                                                Download

                                                              • memory/6112-12-0x0000000000400000-0x0000000000633000-memory.dmp

                                                                Filesize

                                                                2.2MB

                                                                Download