Overview

overview

10

Static

static

1

download.jpg

windows10-ltsc 2021-x64

10

download.jpg

windows11-21h2-x64

3

Analysis

  • max time kernel
    1047s
  • max time network
    1050s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    09-12-2024 16:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    download.jpg

  • Size

    8KB

  • MD5

    481a86abe01f14ad73d0d93e454ed545

  • SHA1

    065757d42e841d3448ea2ed5faae9ee0bf9aed97

  • SHA256

    ffd75540b52e4e5ad5725d58ce5af9d65e4984789aff76d82ad2fc5715df0357

  • SHA512

    b39935b0a026fe5c500c7e575da1922f22cf8a439b22d74ff1a7187b3786c18a7ae5568f9f34af4279560fba5a741a3760613eb903f836d444b246c5d56ed4d5

  • SSDEEP

    192:eWY1Lq5qF7bH2cGfx/XmqUZWJgrKj14Y25DXiX:eWY1FJrufBXvIKR14T5WX

Score
10/10
revengeratguestdiscoverypersistenceprivilege_escalationstealertrojan

Malware Config

Extracted

Family

revengerat

Botnet

Guest

C2

0.tcp.ngrok.io:19521

Mutex

RV_MUTEX

Signatures

  • RevengeRAT

    Remote-access trojan with a wide range of capabilities.

    trojanrevengerat
  • Revengerat family
    revengerat
  • RevengeRat Executable 1 IoCs
    stealer
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 40 IoCs
  • Modifies system executable filetype association 2 TTPs 7 IoCs
    persistence
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 24 IoCs
  • Checks system information in the registry 2 TTPs 6 IoCs

    System information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 10 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 11 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 11 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 42 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\download.jpg
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4604
    • C:\Windows\system32\mspaint.exe
      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\download.jpg"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      PID:1188
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
    1⤵
      PID:2980
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffa645746f8,0x7ffa64574708,0x7ffa64574718
        2⤵
          PID:3952
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
          2⤵
            PID:2808
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            PID:4956
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
            2⤵
              PID:4504
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
              2⤵
                PID:3480
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
                2⤵
                  PID:1148
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
                  2⤵
                    PID:1928
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
                    2⤵
                      PID:4348
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                      2⤵
                        PID:4188
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                        2⤵
                        • Drops file in Program Files directory
                        PID:1780
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff66d775460,0x7ff66d775470,0x7ff66d775480
                          3⤵
                            PID:2164
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 /prefetch:8
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4564
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
                          2⤵
                            PID:1188
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
                            2⤵
                              PID:3652
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
                              2⤵
                                PID:3576
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
                                2⤵
                                  PID:220
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
                                  2⤵
                                    PID:968
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
                                    2⤵
                                      PID:4444
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
                                      2⤵
                                        PID:3684
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
                                        2⤵
                                          PID:2472
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4688 /prefetch:8
                                          2⤵
                                            PID:1908
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
                                            2⤵
                                              PID:1912
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6848 /prefetch:8
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4692
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5212 /prefetch:8
                                              2⤵
                                                PID:5080
                                              • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                                                "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:3116
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3116 -s 1196
                                                  3⤵
                                                  • Program crash
                                                  PID:1080
                                              • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                                                "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                PID:3192
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 1240
                                                  3⤵
                                                  • Program crash
                                                  PID:3848
                                              • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                                                "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:4820
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4820 -s 1124
                                                  3⤵
                                                  • Program crash
                                                  PID:3156
                                              • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                                                "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                                                2⤵
                                                • Executes dropped EXE
                                                PID:3688
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1124
                                                  3⤵
                                                  • Program crash
                                                  PID:2052
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1884 /prefetch:2
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:4692
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4015373024668199640,321843218169338041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
                                                2⤵
                                                  PID:4876
                                                • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                                                  "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                                                  2⤵
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3624
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3624 -s 1200
                                                    3⤵
                                                    • Program crash
                                                    PID:4900
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:3820
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:4288
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3116 -ip 3116
                                                    1⤵
                                                      PID:2836
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4820 -ip 4820
                                                      1⤵
                                                        PID:4676
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3688 -ip 3688
                                                        1⤵
                                                          PID:2156
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3192 -ip 3192
                                                          1⤵
                                                            PID:3780
                                                          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
                                                            1⤵
                                                            • Modifies system executable filetype association
                                                            • Checks processor information in registry
                                                            • Modifies Internet Explorer settings
                                                            • Modifies registry class
                                                            • Suspicious behavior: AddClipboardFormatListener
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2804
                                                            • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                              "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Checks system information in the registry
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1268
                                                              • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
                                                                3⤵
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                • Modifies system executable filetype association
                                                                • Adds Run key to start application
                                                                • Checks system information in the registry
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies Internet Explorer settings
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:920
                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                                                                  "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  PID:5068
                                                                • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                  /updateInstalled /background
                                                                  4⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Modifies system executable filetype association
                                                                  • Checks system information in the registry
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies Internet Explorer settings
                                                                  • Modifies registry class
                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4524
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3624 -ip 3624
                                                            1⤵
                                                              PID:868
                                                            • C:\Windows\System32\rundll32.exe
                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                              1⤵
                                                                PID:1932
                                                              • C:\Users\Admin\Downloads\YouAreAnIdiot.exe
                                                                "C:\Users\Admin\Downloads\YouAreAnIdiot.exe"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                PID:5588
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 1196
                                                                  2⤵
                                                                  • Program crash
                                                                  PID:5636
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5588 -ip 5588
                                                                1⤵
                                                                  PID:5616
                                                                • C:\Users\Admin\Desktop\YouAreAnIdiot.exe
                                                                  "C:\Users\Admin\Desktop\YouAreAnIdiot.exe"
                                                                  1⤵
                                                                  • Executes dropped EXE
                                                                  • System Location Discovery: System Language Discovery
                                                                  PID:5736
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5736 -s 1196
                                                                    2⤵
                                                                    • Program crash
                                                                    PID:5784
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5736 -ip 5736
                                                                  1⤵
                                                                    PID:5764
                                                                  • C:\Users\Admin\Desktop\YouAreAnIdiot.exe
                                                                    "C:\Users\Admin\Desktop\YouAreAnIdiot.exe"
                                                                    1⤵
                                                                    • Executes dropped EXE
                                                                    PID:5816
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 1168
                                                                      2⤵
                                                                      • Program crash
                                                                      PID:5864
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5816 -ip 5816
                                                                    1⤵
                                                                      PID:5844
                                                                    • C:\Users\Admin\Desktop\YouAreAnIdiot.exe
                                                                      "C:\Users\Admin\Desktop\YouAreAnIdiot.exe"
                                                                      1⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5896
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 1168
                                                                        2⤵
                                                                        • Program crash
                                                                        PID:5944
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5896 -ip 5896
                                                                      1⤵
                                                                        PID:5924
                                                                      • C:\Users\Admin\Desktop\YouAreAnIdiot.exe
                                                                        "C:\Users\Admin\Desktop\YouAreAnIdiot.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        PID:5980
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 1168
                                                                          2⤵
                                                                          • Program crash
                                                                          PID:6032
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5980 -ip 5980
                                                                        1⤵
                                                                          PID:6008
                                                                        • C:\Users\Admin\Desktop\YouAreAnIdiot.exe
                                                                          "C:\Users\Admin\Desktop\YouAreAnIdiot.exe"
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:6088
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 6088 -s 1172
                                                                            2⤵
                                                                            • Program crash
                                                                            PID:6136
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 6088 -ip 6088
                                                                          1⤵
                                                                            PID:6116
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                            1⤵
                                                                            • Enumerates system info in registry
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:1056
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffa645746f8,0x7ffa64574708,0x7ffa64574718
                                                                              2⤵
                                                                                PID:4976
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
                                                                                2⤵
                                                                                  PID:1032
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
                                                                                  2⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:5224
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
                                                                                  2⤵
                                                                                    PID:5216
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
                                                                                    2⤵
                                                                                      PID:2676
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
                                                                                      2⤵
                                                                                        PID:5396
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3792
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4400 /prefetch:1
                                                                                          2⤵
                                                                                            PID:1384
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
                                                                                            2⤵
                                                                                              PID:1300
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
                                                                                              2⤵
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              PID:820
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4644
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:64
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5648
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:5856
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:5948
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:6048
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6100 /prefetch:8
                                                                                                          2⤵
                                                                                                            PID:4496
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:4536
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 /prefetch:8
                                                                                                              2⤵
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:2940
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6396 /prefetch:8
                                                                                                              2⤵
                                                                                                                PID:5540
                                                                                                              • C:\Users\Admin\Downloads\RevengeRAT.exe
                                                                                                                "C:\Users\Admin\Downloads\RevengeRAT.exe"
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5928
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                  3⤵
                                                                                                                  • Drops startup file
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:5844
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                    4⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5832
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gavsl_-m.cmdline"
                                                                                                                    4⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:1060
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DE4.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4022A97A8E544F8AA79BCB342B33683.TMP"
                                                                                                                      5⤵
                                                                                                                        PID:236
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8aflwzwl.cmdline"
                                                                                                                      4⤵
                                                                                                                        PID:5048
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E71.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE1AE3666F2FC45DEABD76B9F148C63B.TMP"
                                                                                                                          5⤵
                                                                                                                            PID:5624
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\2gddreou.cmdline"
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:3792
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F0D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBDFAC3CFDB07480C9E11D47BC1CDBD70.TMP"
                                                                                                                            5⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:5580
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\dx1lr5nm.cmdline"
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4004
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FA9.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc597ACE7A61054B678842723E5D6724FF.TMP"
                                                                                                                            5⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:5552
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\-ijrwvm0.cmdline"
                                                                                                                          4⤵
                                                                                                                            PID:5328
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7026.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcECD70F7024834745A86124E117F1246.TMP"
                                                                                                                              5⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5924
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\yw4ujyfw.cmdline"
                                                                                                                            4⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:5968
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7094.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc99554412325D4A819545B33751CB8EF8.TMP"
                                                                                                                              5⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:5860
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8cfi71pa.cmdline"
                                                                                                                            4⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:3820
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7120.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc16E8CC2D8D6D4747B9FD61CFF7F575FF.TMP"
                                                                                                                              5⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3004
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\mf0agmwm.cmdline"
                                                                                                                            4⤵
                                                                                                                              PID:324
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71BD.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcE6AC67A772CD4C54A560FD5AD0AB38F4.TMP"
                                                                                                                                5⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:5488
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\8tghnwt9.cmdline"
                                                                                                                              4⤵
                                                                                                                                PID:2132
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES723A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcBC53DEE9EEB84F6D8451C98369D34BF5.TMP"
                                                                                                                                  5⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:6080
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ksfddcby.cmdline"
                                                                                                                                4⤵
                                                                                                                                  PID:4140
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES72B7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc9DA2DC9A8FC54F869F3369142FC26932.TMP"
                                                                                                                                    5⤵
                                                                                                                                      PID:4544
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\keum61ol.cmdline"
                                                                                                                                    4⤵
                                                                                                                                      PID:5012
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7334.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc8187FC3C3BB24F08B5848380F4CE1DFB.TMP"
                                                                                                                                        5⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:2668
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\stfdutsi.cmdline"
                                                                                                                                      4⤵
                                                                                                                                        PID:6040
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73A1.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCC0F60C766614A1EA9BC6D1E3D663BF0.TMP"
                                                                                                                                          5⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5548
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ktybqugj.cmdline"
                                                                                                                                        4⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:752
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES741E.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB6FB5DF9E71D430F94434EF44B24388B.TMP"
                                                                                                                                          5⤵
                                                                                                                                            PID:5432
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ohvvbdnr.cmdline"
                                                                                                                                          4⤵
                                                                                                                                            PID:4284
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES748B.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc26FA4D567F484C2BB310B1440F0488B.TMP"
                                                                                                                                              5⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4556
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\y7ypdgow.cmdline"
                                                                                                                                            4⤵
                                                                                                                                              PID:4188
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7508.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcF5058B1029904213943B9EFF8E3C91BE.TMP"
                                                                                                                                                5⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4376
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\zaxcrmkp.cmdline"
                                                                                                                                              4⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5396
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7585.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7AF4E8B02C03470794DCBA4673B57857.TMP"
                                                                                                                                                5⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5464
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\nawmjgee.cmdline"
                                                                                                                                              4⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:5572
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7602.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc4B80F7F9A24E4B2996F535822ABB3298.TMP"
                                                                                                                                                5⤵
                                                                                                                                                  PID:4500
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lhhrln2k.cmdline"
                                                                                                                                                4⤵
                                                                                                                                                  PID:5792
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES767F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA79B4BC848624CF3909373A6176FD13E.TMP"
                                                                                                                                                    5⤵
                                                                                                                                                      PID:4004
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lhdxtxeb.cmdline"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:4088
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES76FC.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcCB8841AF8DD74EE98C5A609992E1F67.TMP"
                                                                                                                                                        5⤵
                                                                                                                                                          PID:5756
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\4ynids7v.cmdline"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5812
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES775A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc127512E2783341FBBF5220B8BE73A3EB.TMP"
                                                                                                                                                            5⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:5816
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\i0gykcid.cmdline"
                                                                                                                                                          4⤵
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:6136
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES77D7.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcA55738FA7154754ADB270C0BC62ABFF.TMP"
                                                                                                                                                            5⤵
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3820
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\gywirh4l.cmdline"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:540
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7854.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc7468AB1F1E9B4BA384BE80438244C51D.TMP"
                                                                                                                                                              5⤵
                                                                                                                                                                PID:4940
                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
                                                                                                                                                              4⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:3608
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                5⤵
                                                                                                                                                                • Drops startup file
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                PID:4544
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:4140
                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                  schtasks /create /sc minute /mo 1 /tn "svchost" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe"
                                                                                                                                                                  6⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                                                  PID:228
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\kahccjg_.cmdline"
                                                                                                                                                                  6⤵
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5764
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1EC6.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc22FFBC2541C4403C889379F3636E019.TMP"
                                                                                                                                                                    7⤵
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:2940
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uax9fwmx.cmdline"
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:5872
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F91.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc42F70F8FE37E4651B56C201ACB9DA185.TMP"
                                                                                                                                                                      7⤵
                                                                                                                                                                        PID:5820
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\75s-xblf.cmdline"
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:1044
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES202D.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcB252D9855E4C49985AAAB4291B4E7.TMP"
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:2112
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\6v0x582u.cmdline"
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:5444
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20E8.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcD4E4E0FF971A4CA8895B727664A45AD3.TMP"
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:1252
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\r7mohdwx.cmdline"
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:4316
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2165.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc648FF7BAB1DE45D48E4C799AF6A7830.TMP"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:4404
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\uuzrlxll.cmdline"
                                                                                                                                                                                6⤵
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                PID:2964
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21F2.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC6E0D2413814789BC9F4364A058A184.TMP"
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:4084
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3572
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6708 /prefetch:8
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5428
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6748 /prefetch:8
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              PID:1788
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13345128672735655641,5767063936803862162,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6452 /prefetch:2
                                                                                                                                                                              2⤵
                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                              PID:5396
                                                                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5404
                                                                                                                                                                            • C:\Users\Admin\Downloads\RevengeRAT.exe
                                                                                                                                                                              "C:\Users\Admin\Downloads\RevengeRAT.exe"
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:1288
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:3344
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:5312
                                                                                                                                                                            • C:\Users\Admin\Downloads\RevengeRAT.exe
                                                                                                                                                                              "C:\Users\Admin\Downloads\RevengeRAT.exe"
                                                                                                                                                                              1⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:5492
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                PID:1532
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3164
                                                                                                                                                                              • C:\Users\Admin\Desktop\FreeYoutubeDownloader.exe
                                                                                                                                                                                "C:\Users\Admin\Desktop\FreeYoutubeDownloader.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                PID:1060
                                                                                                                                                                                • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                  PID:2012
                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:724
                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:3536
                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:4572
                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:860
                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5080
                                                                                                                                                                                • C:\Users\Admin\Desktop\FreeYoutubeDownloader.exe
                                                                                                                                                                                  "C:\Users\Admin\Desktop\FreeYoutubeDownloader.exe"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:5964
                                                                                                                                                                                • C:\Users\Admin\Desktop\FreeYoutubeDownloader.exe
                                                                                                                                                                                  "C:\Users\Admin\Desktop\FreeYoutubeDownloader.exe"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:5736
                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                    PID:6108
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3884
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5108
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3056
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:6024
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:220
                                                                                                                                                                                  • C:\Users\Admin\Desktop\FreeYoutubeDownloader.exe
                                                                                                                                                                                    "C:\Users\Admin\Desktop\FreeYoutubeDownloader.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    PID:3152
                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                    PID:4692
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:1380
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:772
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5988
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:8
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3304
                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                    PID:6080
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5048
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:3428
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:5156
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:5240
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2412
                                                                                                                                                                                    • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                      1⤵
                                                                                                                                                                                      • Checks computer location settings
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                      PID:4000
                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:5964
                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4680
                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:4936
                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:5376
                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3504
                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                        "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • Checks computer location settings
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                        PID:4288
                                                                                                                                                                                        • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                          "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:5364
                                                                                                                                                                                        • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                          "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:5784
                                                                                                                                                                                        • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                          "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                          PID:1368
                                                                                                                                                                                        • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                          "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:6072
                                                                                                                                                                                          • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                            "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5032
                                                                                                                                                                                          • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                            "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                            PID:5908
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4796
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5432
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:2112
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:3176
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:3604
                                                                                                                                                                                          • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                            "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                            • Checks computer location settings
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                            PID:1648
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:5284
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4664
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:3836
                                                                                                                                                                                            • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                              "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:4780
                                                                                                                                                                                              • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4036
                                                                                                                                                                                              • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                                "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Checks computer location settings
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5012
                                                                                                                                                                                                • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:1060
                                                                                                                                                                                                • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2588
                                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:1144
                                                                                                                                                                                                • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                                  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                  PID:5732
                                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5220
                                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4472
                                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    PID:4720
                                                                                                                                                                                                  • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Random\Firefox.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\Random\Firefox.exe"
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                    • Checks computer location settings
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:5380
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\svchost.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\svchost.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                      PID:3980
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:864
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:320
                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3180
                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                          PID:944
                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2044 -parentBuildID 20240401114208 -prefsHandle 1972 -prefMapHandle 1964 -prefsLen 23681 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {19c5bfd1-8827-45b2-973e-866bed2f8b43} 944 "\\.\pipe\gecko-crash-server-pipe.944" gpu
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:868
                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2456 -parentBuildID 20240401114208 -prefsHandle 2448 -prefMapHandle 2436 -prefsLen 23717 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {157f564b-5c47-4a12-8aa1-724ab9dedfa4} 944 "\\.\pipe\gecko-crash-server-pipe.944" socket
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                              • Checks processor information in registry
                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3020 -childID 1 -isForBrowser -prefsHandle 2776 -prefMapHandle 2852 -prefsLen 23858 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f5ce896-1a0b-4ff8-8bda-7c811f5e37fa} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:3168
                                                                                                                                                                                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3484 -childID 2 -isForBrowser -prefsHandle 4148 -prefMapHandle 2732 -prefsLen 29091 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9dba313c-bdfa-4099-862d-ea9fbb37bf22} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:4724
                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4896 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4936 -prefMapHandle 4932 -prefsLen 29091 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8ffadc8-fea9-4772-a35c-7ec28d2bf243} 944 "\\.\pipe\gecko-crash-server-pipe.944" utility
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  PID:4280
                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5428 -childID 3 -isForBrowser -prefsHandle 5420 -prefMapHandle 5380 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {05e67a17-a866-4fd0-87c8-18a8ad9a265b} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:3644
                                                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5580 -childID 4 -isForBrowser -prefsHandle 5656 -prefMapHandle 5652 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b171c1de-64b3-499d-9648-860fb36c9ea9} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:4348
                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5840 -childID 5 -isForBrowser -prefsHandle 5760 -prefMapHandle 5764 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07028dde-26b9-4336-864c-c424de4cd3c9} 944 "\\.\pipe\gecko-crash-server-pipe.944" tab
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:4768
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                  PID:5776
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x12c,0x130,0x110,0x134,0x7ffa645746f8,0x7ffa64574708,0x7ffa64574718
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:4164
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5468
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2892
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1416
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6028
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:4680
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5504
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 /prefetch:8
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:748
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3728 /prefetch:8
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:5800
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:692
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:5772
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:4204
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5512 /prefetch:8
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:4576
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,4951949580055929839,6744913318822448671,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4188 /prefetch:2
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:3580
                                                                                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:5920
                                                                                                                                                                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:5624
                                                                                                                                                                                                                                                    • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                      C:\Windows\system32\AUDIODG.EXE 0x500 0x4fc
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:704

                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                      Command and Scripting Interpreter

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1059

                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                                                      Component Object Model Hijacking

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1546.015

                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                      Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1547.001

                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                      Change Default File Association

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1546.001

                                                                                                                                                                                                                                                      Component Object Model Hijacking

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1546.015

                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                      Scheduled Task

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1053.005

                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                      Modify Registry

                                                                                                                                                                                                                                                      3
                                                                                                                                                                                                                                                      T1112

                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                      Browser Information Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1217

                                                                                                                                                                                                                                                      Query Registry

                                                                                                                                                                                                                                                      6
                                                                                                                                                                                                                                                      T1012

                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                      5
                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                      System Location Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1614

                                                                                                                                                                                                                                                      System Language Discovery

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1614.001

                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                      Web Service

                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                      T1102

                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                      • C:\ProgramData\svchost\vcredist2012_x86_0_vcRuntimeMinimum_x86.ico
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        fde1b01ca49aa70922404cdfcf32a643

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        b0a2002c39a37a0ccaf219d42f1075471fd8b481

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        741fe085e34db44b7c8ae83288697fab1359b028411c45dab2a3ca8b9ea548a5

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b6b4af427069602e929c1a6ce9d88c4634f0927b7292efb4070d15fb40ce39fc5ce868452dcd5642b2864730502de7a4c33679c936beb1a86c26a753d3f4dc25

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46d5cc8b-c744-4440-9f86-3a6e1c92e144.tmp
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        2bf61a0a04545118928e2227e73e82ee

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ae8faed1c5faedb04291957234ee0d9d79f5bd2f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        66ecc1da38b45958f21890b1109287abbcb022da6657105d1726ea5d48b235d2

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3ab9c96aff86fbfc1f4e899c09cc2cf5b4ca457622c8951ca60383a9cf33ca4d2c1569638dd9ee024643f503e3d635a13f29574481b42ff340547ffa06fa7d14

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        295f18102d24c5deb473f2dc2a50d750

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        394c96ddb0a8cdc2bbcfa08a36a5d4d0737b6563

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f87c6c50b4c42cc063df5e1044f6ea93dcd47ce2ae11cce1af9f6e3df7997dfd

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        81628f7fdee04de81323b29cf38c587d4735c6323afdab63ce6be8c87ef026d7f0edde21f602e80289bf13fe41d1f0599fb0634973fdccca345439ed321f7915

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        709fe095d3db571f4630e0e545aa84a9

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        915c753ba69953a63d8438987d4bc332cd53993f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        14b010803939e1cc878af2300b07d5e94ff91dda47abdde18eea65a8f71c0c99

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        90380b4d5045db14a920dcd65d38878b1dfb3f08baa13c7dac63343052715d6f0e4bf67215e009cc92b4c5cb93c8d68eade3bc8d19ea9b1a31eeec9b21f26164

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        b5fffb9ed7c2c7454da60348607ac641

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        8d1e01517d1f0532f0871025a38d78f4520b8ebc

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        c8dddfb100f2783ecbb92cec7f878b30d6015c2844296142e710fb9e10cc7c73

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9182a7b31363398393df0e9db6c9e16a14209630cb256e16ccbe41a908b80aa362fc1a736bdfa94d3b74c3db636dc51b717fc31d33a9fa26c3889dec6c0076a7

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        cffd6f99cca91b5466cf49be48db9352

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        35aecc164de1f39967fe4c4104b515215ddf29b1

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4b5f1808d7293ff662c5f1450bd2b39d7aef927268d483532fc5f2bf5dd1122a

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        739f222334524fac4545b19957c7d0d946b245eedcd5b5f081948f5f0ec364ee127474226795133728e3892dd7e8ec6174dc37faea8e8132fef424d5904f42bc

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        32d05d01d96358f7d334df6dab8b12ed

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        7b371e4797603b195a34721bb21f0e7f1e2929da

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        287349738fb9020d95f6468fa4a98684685d0195ee5e63e717e4b09aa99b402e

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e7f73b1af7c7512899728708b890acd25d4c68e971f84d2d5bc24305f972778d8bced6a3c7e3d9f977cf2fc82e0d9e3746a6ccb0f9668a709ac8a4db290c551c

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4600b272-a717-4d5a-92d8-af4e0c135dc9.tmp
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        da3ac272930222cf779b199083632c42

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        cfe33f1858eacece8d2d399b0ce37ce9ae92ef2d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        10995262009788fedf10c95274e581e4bdf42e713587fed69c7def6261ff327a

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        319a005ee31493cc229b107a5026913d344d125ab6487d3bceaf12f94667040d0b36cd361c11ec5ad835deff89f5d7305b579ad8a80fa614ba9cbc63f5ab76f3

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        68KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f26bbba7e176ea7ee28bb8d1bb559e46

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        04efbece4b8f5160b177211e1451a649b844b775

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e1fd5de2bdb5c05b81918158dd6f841338028f72ceee214de7c67813ed2a8155

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        c23a748d54d6829127e50a912a0af1f8e9e611bb919a972697a0e71ba812843dc51642f4d72dfae6b6cfdbc65503828456a7773338e1fa83a2d88f889741fd45

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        62KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        c813a1b87f1651d642cdcad5fca7a7d8

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        0e6628997674a7dfbeb321b59a6e829d0c2f4478

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        df670e09f278fea1d0684afdcd0392a83d7041585ba5996f7b527974d7d98ec3

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        af0d024ba1faafbd6f950c67977ed126827180a47cea9758ee51a95d13436f753eb5a7aa12a9090048a70328f6e779634c612aebde89b06740ffd770751e1c5b

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        67KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        b275fa8d2d2d768231289d114f48e35f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        bb96003ff86bd9dedbd2976b1916d87ac6402073

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1b36ed5c122ad5b79b8cc8455e434ce481e2c0faab6a82726910e60807f178a1

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d28918346e3fda06cd1e1c5c43d81805b66188a83e8ffcab7c8b19fe695c9ca5e05c7b9808599966df3c4cd81e73728189a131789c94df93c5b2500ce8ec8811

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        63KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        226541550a51911c375216f718493f65

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        f6e608468401f9384cabdef45ca19e2afacc84bd

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        19KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6dd8803e59949c985d6a9df2f26c833041a5178c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        fd7c30ed95e477da42ea5e162f5f2c89

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        c846401919a0c50f681208822226e801b8d1f68e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        005b2166c3656231961cac5848772d737309b22701b698c0b165e14ab3da39e1

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        a8afdcc34564bd1b939eae7885f62997840d3c86d4b29709212340e890e7d3873e7d7b46126609e501f31ddd4878188bf023f1b3c99a68061efd1ff92175ca83

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        d4d34de5fa11940494b770f51b08fafb

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2a446e13eb3957abeb7bda83426e279e0faee53f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        25a562ccdedfe2138672cd8384462c7bd7a6c87093f1e8ea5d4a1d7fcfd7b73f

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        079927ffaa984852263f43a20676c74142b382e6d04d13b1a0fbd595618bd8e1347a0176ff54f95a483af3462494348c5d73db09e011517e347952d20fda2bcc

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        24ffe7e897920d31cb7636f087f08f2d

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        68cfa94ec3786865d14a5ecc104190b2c2634167

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        86ee658a978ef0d33863ad5ac35539556b4208142ab699fd5263250e577c26ec

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        03a11f11f287bc0539665b7e69add71aae119cba910212e56908cc5d3aa874bf72002f510ef7bce9b70aaf2c635440ec5f8a3d4e5e36fbfc1f4709a7f7298a3e

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        48B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ca5f1800c474e38d0caf14c1b9f5c669

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        3c5c65324d0bbc3443b08dd60d10872f760ee572

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        14069e8142929fc0bbb407e56b6f013b99df6a8ccb4891af5409de5e6306e3d8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        337919469b96611dbf8a441d1fd22287653c16539f390f97710d2e21597f624389e9d77035e78f6549b96cd35cfb4dcdf10b12c14f373fabf88a71aeb758fe90

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        70KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e5e3377341056643b0494b6842c0b544

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        264KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        3eb689d74ce11926aecfe2a94667023c

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        70010b7e6f9e3c0106b65558d261bc5c514edc7d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        05710afff5b088e2ca8a8f79039084849d5de7b726979848443ee78acbe5f2a8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        a7c5f088fe2473a68a1ffd0735f669aac51a45791d48018490f7e504623ae69655adbf8285dd4579768ad5cdce1b8c99fcb645c066af5918cbdc435379e98ff4

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        940B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        82ac7837c348cb8a6e880fc2f326ab72

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        4b361e29d7858e589b433346e3b6540e6ef5b5e8

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        96a75170580f10577cfa846a787791ef5b1983163ab062c5ce09cd8cb9269d43

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5f6d74ae1874674188e7bc350195dbc846635ef04186321c203cad9ca11d4279760d4821c72f6eba1ffbcc333a40f942c66066808bf7fb4f4b0decbbce4c8e41

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e85ffe442f9d773a00a354daeb5f048f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        16bddfbb6ed779a2a31b172cebeb099b6d0ace4a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        ea5c10218aafcb9edb4a0fb9da650d8a7bc0ab398fbe7dddc65d816c1c29e7e8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        1aefadcb79a77aadc0104a4df39541bc5e225918f0a822e1ecf822c78bd5af7f9b468f6f7e4bdc9985f437767752b62fe61908c139bcfde60cd6bf5314696ce8

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        9c57e4a08c23c3c147157e63ef3149a3

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        704a808c60c54795bc177269d6290187a6bf6b7a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        074a9f7e265c012d90215569fc61d59a34ef32c9c0addd396ac95e19617eb53b

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5973b3224f69f24b4ef6bf2125127aaf561f6c3554d017ee5be52d7ccd4b0f66daba3d9b3bd1af224e40fe073c81eef69c12bd244109c54eed6b4d46e7184af8

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        38883a4fad7ad037e58474c9ad7b30e9

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        64a41523d33c72693e752d0050987e44e90bed1e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        30f41122a6c9c6d851220ff2f3a1da71f8c8cb72d4f397738e31865ac4d8cbb7

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        4ae439aafd50bdb2aaec3edea02b13537a62c9f35ea300debad7f6548418b7b1d5094c8733596938130762f192d006d3c791bf8c312c33c947b5e2745ec373d0

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        75e251daf805e4307a2c4c252767dc1b

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        04c6aed34de20af19efc1372adb73435d6364ea9

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f8813ffd5a9f6937394582c4def948bced0a8a68e89de7f853f261c473ee47cd

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5afa94664365582f42c39f9ea79e1c75d42c4edb47b318d3b22218c2302f59efb5555e006678623777e64d9df3dc089f9db276ce6cea25d0700ab967f58f44fd

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        76f7eb85bf266402973f65babd7dbd32

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        a43d69e643115952701e6c0ebe5d427b5dbf9402

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        b8f550379d6ecdddcb259890c29e0bd468f7116ccb1d4eb1aebb3d1f9be4626c

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        decfa3299e9005e1d07591b8403c722eba8854b821d825a7d5d1aab65be657e57683bb2607f0c004c5d5ff85c6bba4e2c7c9f478f6c55cce271331d118f7a525

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        82733eec467d00c19fdce1edd1ed180b

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        96f5c7a72b0c9ab4a3096827a43af2e5cfefd221

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        039334b6fe9c43c3362839c33cba22e98e95769172739d3f7efdfd9a92bcdf59

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d857a0d60e3775441055dd8a1564fc752167e37c53136d1272821740ebb816543be32fb4542a2ccfc950a3f844c1b2137323ffdd5921fa57fd6881fc12720ca0

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        0de035872a916d6f2b54dab5ec63e97d

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        86acff93b96a8cdae5cb6aefd2ce06446837b41d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        69a014a39b25710faa0a7bc486efb57b7ca0ddb3d6ac63efde4939e0b6979a39

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        ab2b2a6c5101672f83808b472ddd9e8a13f898cd3ddd05ec3de41ccb671e3b9d890afb23393f216f3c6fe0ec0ce7da3e91d3232248111fe9c40f08227ae4879a

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe59feb9.TMP
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        59B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        2800881c775077e1c4b6e06bf4676de4

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2873631068c8b3b9495638c865915be822442c8b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        7fb35e5283f9a8c92464e86b7fc79ab4

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        9994373dedaf0ac2e6144e3a98c8ff2ccdcbac9f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        16cb61a3a59f730926e831b77d6af658843dc386b7796de021f1abd69d72cdaa

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9ec9bb446c9c2a0b944ddfa6e8b11193ef70c67ee5274e0aaf0e9f52341fd8817775ba8c0121f895cd38a79eb2414d16ab2f867a142732e6d7f8b91826a18e04

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        085662dace8d68b1fb3c2f623b27981e

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6641b21ec6da98456afd76c3501b1b6cae4da31a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5a40834f981321a701081007518e5c4fccd16fb68783f79247cf476134712b8f

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3582faa9448c703ad85097d288cf434f069ad8e85ece36327f02162d4abb7855ce4b33bbedaa32245e392273c9b174a16e02880e3b3556fc5d29254d9932031c

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        d712d17d6778b14e653278c48d8109f8

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2d71683db6f3913798b38ac10cefaa14dd6199f6

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        326f8a36d68407d9d9afd51effdbd5e9a0ced172da6651438442c245b5ccc86b

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5ea312a95208ee7d7bd9853f61f3773fab28feee16e49fd366e1c17e228fa99c6a922400ebbe7c4ce30fb0ba387f316d89e54924cb0dcdc3d3018ba21fb18c66

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        7b9e16193a2d83ad45e8f12bb29d5f83

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        68de449cad2f3f7e38ec9c0c51bd764a0c2fa620

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        c68b1051c99433ca6c3525fd7c5b556e2c2ff6293c3e62a202280021cb94cb5d

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d284cacae6c2910e52aef3a3cd9288e36b6d92363c2e61cba3fad9d774086e5e8fa0ec670c9aa8cb0f29f37c7b1771fa6d8d703eb1f5508618bd5476213e917e

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        1035408a81426cc3ff8ba3e591944c4d

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        56be3f588d5914a74871ba73c3e859ed71ee8f92

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        8be695feabc8cc718198fd638c98329c356e29b19e613a07b6063fb627f6cb08

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        713555faccda008ac6308e02c2e758a4b363c5f21d8eed847d8e803abbd5b0ae39140123b0cfda5875de1f096c3f3388a03c213a4dc69aec6d4369a5d2a3304d

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        148c224fae41ac17ae98b6a6ddcad308

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        797ca19e55c2b752a4d21435f8c18e4c31cb5cce

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        6c5aa7884ac8de5ca71a84ee9a050328e7636e407a3fa60798319f3a50e99ba8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        eb8e87379a9a3a7991fe7209003f98b1e073d2c878ab01ca85c3970f192a166a6fd1e79ab8e96d43bc9bd4abe262aea28fa2079c89ff25c8c547177a2ef1ae49

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        fe984b903eeb59ca46a57ea86934f533

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        936ae6bb9ee1252664bd68a90c287693d585741f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        357023e03a19d8b83a21d32519d50dd3e7ce8294537c0d9d4172e1023e3dde8a

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        99b0b7854a282bd6bae348ec58bb9b796e72b94fcb3166be58482ae92ca7b48cceb4f159d69db23df4b2d0e88730e1307616ffce59f51bdc95164bec961ea01e

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        b658306e9fe54dc9690d9f2761b76b25

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1fe9409ea0ddbecc5c4a1cdaabf685284e07509c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        7e46d058418f2276dd3d0e982c96d7ffab52121593aa8c021f8e90dc6f1fe1bf

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        39bb220a803e396733dd1730108f27de67bfe680e88e88b08d24ae4e317728780b4b228cae40f6e5067d71e743db475a3e592b9c765e5e7b2fef9aad87d3264a

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        06480cd4d38da6e4ec1c91ff7594f3f7

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        9eba5470183edf56761266c5467cc45ad0a9aeca

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e3e7159824798d95c35030749f1794f9e776059500b5af6a4e217ac781d3f3d6

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3814988dbdcd09a31e9210c2e72908c184bd89337c3fa6019a48c55708c9e53baecfa4d35385e0330a7d5f950a79fc6d499baf83549f1aa46a5ed5c63a305591

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ca7cceb50a3836f53fdf0b0185e09481

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        9d85f89ab66f9588575e28b7d9787f432070302a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        8427ba14f90f2d815e4998ecb7685fc640978f546b9cad128f8d798bb46b0088

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        eae23fea6003bc66e2b704f9beda5ff62d56e6a14ddc472e78108d8864adf31b4eb34bc207b83068ce3aa4dbdc5f49e930b1f8885ad54187df4f6ec7ebc805f9

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        dbdae24e93c2edea3007a6e764132a91

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        77f74b541097e864974fb5f8debb1d889108f261

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        338e2ff17e77e53b3b0047a5dc3b182e761a60f0613cadde160259144d8e05c3

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b20992eb91da8859c9c616fec45a13990113075d38c48a15e34f77d16a50f59c8b872afbf31fcb52bcd36fbd1f1c8171dd36671f0e58fe194c1137f2993d9eb8

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        66dd1dea102712679d56c0b49f4c6ca1

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        f99b2d3b176adfb3d0ca2f1e239672f957a3d769

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0a8fe012fc4020aa7ee5a298892f64a6d8cc0eaac643bc6705f90f644c0ad221

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        97996638e79f0505037fb6b01b5e56fa123bb071e0c60ef6ed3b3a482fb799df67971c086aa78e10dbe5511b208ce927da88be3896a1bd36a5334ada2e466aba

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        47be0bbad95768fb7ad5d024572896b9

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2c5b48681337a60c8f4bab7ca87a7491fc90302c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        13727662c4a5f43937f569c795d8aa515f3cecdf60975e23f421e7c4a27dce15

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        cbe75910c51a2e22745cc0db2d274745267e966da14223cd4e2550ddc3b4312d80c8f29e60fce1b992c3eb7b8e2f79e58711bda7a166c8ac64fe719835e88775

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        aca89649d5279b5cbfb785fe19035b7a

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        73b11edecaf6962df0ab76148dfba158c913aca4

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        ebcfa170b481c334bec9e06a8c710cfce978516f88276061601b0ca4935db34e

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        93f48409ec432adffee20fe1b99717b926c87267c1f0d87b513bc7cfa6e5a5aa1508f3a7bb59cc9f30e33eb34723abd105915b4a27a4bebec5ca4517c0765326

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        6e466bd18b7f6077ca9f1d3c125ac5c2

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        32a4a64e853f294d98170b86bbace9669b58dfb8

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        74fc4f126c0a55211be97a17dc55a73113008a6f27d0fc78b2b47234c0389ddc

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9bd77ee253ce4d2971a4b07ed892526ed20ff18a501c6ba2a180c92be62e4a56d4bbf20ba3fc4fbf9cf6ce68b3817cb67013ad5f30211c5af44c1e98608cb9e3

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ac2b76299740efc6ea9da792f8863779

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        06ad901d98134e52218f6714075d5d76418aa7f5

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        cc35a810ed39033fa4f586141116e74e066e9c0c3a8c8a862e8949e3309f9199

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        eec3c24ce665f00cd28a2b60eb496a685ca0042c484c1becee89c33c6b0c93d901686dc0142d3c490d349d8b967ecbbd2f45d26c64052fb41aad349100bd8f77

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        709d825e4830296007a9d1c1ee0a12c5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        0fb6b562150408d3b098bf12c89be787117fd1a1

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        2dd7959b0569f5a5c8a7488472395e4ad0cba313d6a2e59b2edf18f38027e425

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        bdb5de5a0fd069788a38d392a51ea21953c7f83055f3fb7b39a38cdc9472424c2b4a2bb70b84b4bcc09dd667ab9ec8a06cab48eadc8100f66f138d0549ed2932

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        9980afb28a88881c5a76fbdbf5b71f6c

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e0e3d8c237e87efcd0177312fa9e3b13c2af8d8f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a5ebb63caba5f73d916dff89511a104bce044b11bfe4a288ae20955446c89cad

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        527d82519df77fcb572993af9bbde21b1f7720b0604f8267276c92bef0e7e6679f38bdfa269de1b3443cc72f0309020027a8114dfde547b363219dc4dc172a70

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        afd0641584e40ba4d4d76c3084032ad4

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        b88bd1b01d285131301a535aff3e6316b6259eca

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        be8c8a06b27760d003f6a4945c106b0d39a90a800f7c2b616fef6083ae8aa7e6

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        6f0854d56bb678c464e669873926839f2fffda3fd06dc521f759267891d0c9b6170cd403d3b8a5fcbb837417498b69b49441f11b817ab44c7e5828adfea07923

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        bdd1929523f58e020e7e879a19dfa494

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        883d0379e4c5e024a323033c4c929d3222c45047

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f512369bf8b4af0fdea4602ca92bfead6ad30b87e54825dd3530ded209709910

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        6d532cf9667af30e9d3df6a9fdebab089a9333e0985d777d04add58c0f3bf08f81c2ffc356b5daeaa395c7fad9130f67056a1c1e22dd36f821e9209711dc4127

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        4e83b6d4538a0c07d63b21d2938ca4cf

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        dd467a89813648152199a3f94380a4181562af81

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        20f35779a6e7f944c2f8863d52a74c9ff61eae63edd5c674f47e0a912ed233fb

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        4e9958845d30f75bdf767c02e6db85dd56703c219773a7d37c1b7f6e1b4e30dc68b68fa682709ddce198dcbac2b6cb3582e1fd460a9dec5417ec8b7d287ca589

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        d257f610e01db1d3a8bbf68efaa7e03f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e37980fd6bb79279c7be3c9d7fc2693c4796425b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4675ce2959964b2a6a1c1f4db7421efabd65796023ffe1163d8fd2316d80a1f1

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        891fca1ec9abd72988da775b621a132afe1153f90258dc423bf742d8e2ff6cbbf6d3e2b6c72e7d56f2e47f214e4a9b9ec11780b6ed0c9bbb2bb0e4d6d1878e4f

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        134d86ea9c70f677b4f5896bd7bdf806

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        a79add4c1aee28cb20b6f5cc065a5da25f677586

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        c64aae25e6f61f580d98364f4d7ab71199e2b735e20c018e039e4b0e13a195d3

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        16d8775fd8917ec676f2e7889c0a69e3b682a5278a446fc177c1cb078ebc2b256472950c48885f6aac4d414b16724b23ef057b7641e93098fdf3774713b75d16

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        878a0480cd810cb763483e21aa51d4c1

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        fe3e7a3ba0031c23d2c52e755cc12d8cc3dc192f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        515606f8d34ec81a795ad4a971355868f942d3327493abaacfa82f484e6feabf

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b3f09e97c5421e142492c952a3c5dd74c64ba38e5baa969d5ddb2ce3d06b5aa806d9fca64a814e508aed37549d03a0b004b470ca6f9b11bdefedfb60999d000c

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        a994961b0e499e8d68f50435e31ade7e

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e807323753059143ea6153a60085ac6640586e6a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e82388849687990910086f9ac1d62b2bf096b810a7a6447cb8cb4e96d6dd6afe

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        f0defbd86133f02e44bc4e6f24b55ec19143c62bdc37a91cf7de2c6c22fa6976c22bcf157a5ddaf2b6f1ee988c66707be5568aaf60859e31774c24b7a2afd6bf

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        30941b4f8bf8cc75d8903c6abcd9dec2

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1c2e0603a404d1ffe08cdfba150223a87b96e941

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        7c3d88f1bf71b3935e051a39c8b457671e381b1dcf694f1529a10ff703b7583b

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5a2efe46c25f0aa1e1217210b7e2f1687b98d708608d435828d1910065513eeabc61cbd9c64f4d2d1253d5b7675571efeeeef4959d5280fbb51d04c928e1035e

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        6e1c2d70d80a796eced8557866a98156

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6c4d4a23f53b46053062cc45fabfb68235aa8486

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        28c6cfa5c8a1b9e36ac314852528141fa16af9f8672409384bd14861517c2666

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e9c357ccce75e1e00877a356e344f68b24c2e9cf7250bf896aabbaff6b79bcf28d4629d8f5b7e32ef6410f0bbfdea7b1a44933515d53892cec11af0bf0947e95

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        802f6e591abae70c4e842587b96a3f46

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        c423a6f867f54c7cda2d407e4704d177beab6007

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5bf98ebb36ad0f42d8a0a9e086c7733da9f66ecef40377755a6984183a4da03e

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        a821e9e1da7b9422a42c48489472997d6eb8b3b924199cc22c7c452b87aed3322dcba08dfea82209a6a08e29da5eb8e5f5259894e1901556435422bbd72b6d97

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        7946512a13abd0641f00091e4b47e6cc

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        fc74abbe4b2b3e1d032947ccd1e0c82292bbec0e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        da370c591b819aa86114082c2bf19ea5eb8d35683c7a7258d9f841b9d15fd9dc

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        ff510a934657591035321f5c45441611f0a2acb4cd836dd131882ca9d17dfba2150ed7e80c711d310cf0f45c93bba717b038fed596a472adec17f453605f6164

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5963d1.TMP
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        538B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        55bac64d0ead3e53eaf1be2a240468ae

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d6e99a2c0b788c3b0dae4cdf34a2787c16b63069

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        796091a79ee47e4f3967d026f1a13208caeeadcadf2817dd7d2d097c71509f0c

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        132fe1b8e480b35300177e9045a9568457bd9f20b6fd08a08c72a730f8b4fa2b1d3a65a0e3c4c3a590d065abb050ba4fe6dde4740ed4df7e3881cb632d171c49

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        16B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        aefd77f47fb84fae5ea194496b44c67a

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        16B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        16B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        206702161f94c5cd39fadd03f4014d98

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ea578bf5-f51b-448b-abcd-d1c33367c09d.tmp
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        41B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        16B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        12KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e8870807e3e29cf1722b51dbbfa3cd92

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        3614916db7ada14f6974ffa75ecf46a13673633d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e1d7f243709347ca4c36eb525af523bc2e1c9d2b5682cf1a0da3572b242c7f7c

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        f58eb5c4a2faee75b8072d28e016c2642849198dc5de21e1c4616f1d5d1cf54bd98748902ceb3bcc64994930e8714d45c0211a88fe5602078063bcc620a8db4c

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        28ec691672b33fbf9da5a59c1b9a81be

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        99e06682cd7bfa4b0fd0f1f256e6f8f54f0cfa33

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        19d10648b50244fc4b0c170e6d031c72c43bfa9ba144aaf35927d04d2072f49c

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        390e1188173f509b09522645dff9849142ced42231e2e3f2be1aa4cf77fa9f963b7e1963d19dfec696d88daeb53ae94025bf3ad6503ee8806a5c6e683ba251a3

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        12KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ec66893f1b94f300768a76c3d1024e7b

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        7adb7b3d9c4f1c2ebbc1975ac1ba9d7e5d82c224

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        feb2af2a0a11238c4fd0dd9be8398ba1c82c3d5c180877c6d6eca29f5cf6baaa

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        31b9c4274dc8e982547d3606d4d79d55f97d6e50cf717fb90eb2c9258401754129d376e8f757a05bcb7f0ac573f3de983c07fee0789fa39bef7f830df8226719

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        4ea37e39b97680a554b1a04aec3936e5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        c7ef65ddeb7194b559c5a496c6dddcda0ea9c209

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0cf19c4d58bb5f3b291d919ec538e9e53b8a4eeb4598218ffd44c3e884536a5e

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        1d49b51802c2c2d13b5696f7e00b3b6d74a97bbebd2c61ca4b07ef7df355523b9f54dafdd74b6c1e624c049a3eef479ca2ce63f6d47983700728d103cf3ce0f6

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        d20bde308339b9d45a0b04ce43e4ed75

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        f05759ee1e25f6163f48455253bb034ed663ccc8

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0566b5b4ae81c0b1be0260820acfbeb5f7a7a8d55283a301e2d6bef9848c3c58

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9a804173fa4fd1b19bea376747fb42c761b5d7e39a8dfd529d28fad68899a5632e2354e602b75c803e03fa83d1b1fb1b2e61614b3c3e647464c6ef7f194c3749

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        11KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        cbbb9328e6451d32dd1ef7a7f67008c7

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        50b78f52b141a2abdc66f1c100da3937feb47d4f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4418ff5ec691c30f10bdc7569057bde0eff587090043066021ef7279f7a0f6b5

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e994d7d406e1f04394bef116c39b6f92bba7f350c9569821f40e69e04e02186bac60dfd37a036281166a4cc0350e7d61baad79510418f9c9f3a6c8352d979366

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f0b6e98103f124e7eda93dffe308ca1c

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        45ae7e6e83b18fdec4db05457af8ef2f52039439

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        01a8cf851ccacd2ad51c919d1a723c224f62d036371821d79f2b8a00986d4db1

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        78c3d28d4a40f0295dd6d6a0c32590afa45da5544e41c7a574dc5f801a27e4ebbd1b175a32a52136046d3e31b682ea01c327853fa8f3811087af88cc26826bf2

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncClient.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.0MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        2df24cd5c96fb3fadf49e04c159d05f3

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        4b46b34ee0741c52b438d5b9f97e6af14804ae6e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        3d0250f856970ff36862c99f3329a82be87b0de47923debefe21443c76cddf88

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        a973bc6fd96221252f50ebb8b49774ccfd2a72e6b53e9a412582b0b37f585608e1b73e68f5d916e66b77247b130b4fc58bf49f5bf7a06e39b6931c5f7dac93ab

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        553KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        57bd9bd545af2b0f2ce14a33ca57ece9

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        15b4b5afff9abba2de64cbd4f0989f1b2fbc4bf1

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a3a4b648e4dcf3a4e5f7d13cc3d21b0353e496da75f83246cc8a15fada463bdf

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d134f9881312ddbd0d61f39fd62af5443a4947d3de010fef3b0f6ebf17829bd4c2f13f6299d2a7aad35c868bb451ef6991c5093c2809e6be791f05f137324b39

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncSessions.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.7MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ae97076d64cdc42a9249c9de5f2f8d76

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        75218c3016f76e6542c61d21fe6b372237c64f4d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1e0c26ceecee602b5b4a25fb9b0433c26bac05bd1eee4a43b9aa75ae46ccf115

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0668f6d5d1d012ec608341f83e67ce857d68b4ea9cfa9b3956d4fc5c61f8a6acd2c2622977c2737b936a735f55fdcce46477034f55e5a71e5ef4d115ee09bfec

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncTelemetryExtensions.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        58KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        51b6038293549c2858b4395ca5c0376e

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        93bf452a6a750b52653812201a909c6bc1f19fa3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a742c9e35d824b592b3d9daf15efb3d4a28b420533ddf35a1669a5b77a00bb75

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b8cfdab124ee424b1b099ff73d0a6c6f4fd0bf56c8715f7f26dbe39628a2453cd63d5e346dbf901fcbfb951dfbd726b288466ff32297498e63dea53289388c0c

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogUploader.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        769KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        03f13c5ec1922f3a0ec641ad4df4a261

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        b23c1c6f23e401dc09bfbf6ce009ce4281216d7e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        fe49f22bb132fedf1412e99169d307fa715dbdd84fe71c3e3ff12300d30d4987

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b47dbd9fad9467f72d4d0d5ca9df508247176f9e11b537c750837e8b3782a2d20f31fad361153d816ddf7f5e8109a614f3c6e4e2307af69cd3e2506cc0515d81

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LoggingPlatform.DLL
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        504KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        4ffef06099812f4f86d1280d69151a3f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e5da93b4e0cf14300701a0efbd7caf80b86621c3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        d5a538a0a036c602492f9b2b6f85de59924da9ec3ed7a7bbf6ecd0979bee54d3

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d667fd0ae46039914f988eb7e407344114944a040468e4ec5a53d562db2c3241737566308d8420bb4f7c89c6ef446a7881b83eaac7daba3271b81754c5c0f34a

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-100.png
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        783B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f4e9f958ed6436aef6d16ee6868fa657

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        b14bc7aaca388f29570825010ebc17ca577b292f

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        292cac291af7b45f12404f968759afc7145b2189e778b14d681449132b14f06b

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        cd5d78317e82127e9a62366fd33d5420a6f25d0a6e55552335e64dc39932238abd707fe75d4f62472bc28a388d32b70ff08b6aa366c092a7ace3367896a2bd98

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-125.png
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1018B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        2c7a9e323a69409f4b13b1c3244074c4

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        3c77c1b013691fa3bdff5677c3a31b355d3e2205

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        8efeacefb92d64dfb1c4df2568165df6436777f176accfd24f4f7970605d16c2

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        087c12e225c1d791d7ad0bf7d3544b4bed8c4fb0daaa02aee0e379badae8954fe6120d61fdf1a11007cbcdb238b5a02c54f429b6cc692a145aa8fbd220c0cb2d

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-150.png
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        552b0304f2e25a1283709ad56c4b1a85

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        92a9d0d795852ec45beae1d08f8327d02de8994e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        262b9a30bb8db4fc59b5bc348aa3813c75e113066a087135d0946ad916f72535

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9559895b66ef533486f43274f7346ad3059c15f735c9ce5351adf1403c95c2b787372153d4827b03b6eb530f75efcf9ae89db1e9c69189e86d6383138ab9c839

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-200.png
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        22e17842b11cd1cb17b24aa743a74e67

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        f230cb9e5a6cb027e6561fabf11a909aa3ba0207

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        9833b80def72b73fca150af17d4b98c8cd484401f0e2d44320ecd75b5bb57c42

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        8332fc72cd411f9d9fd65950d58bf6440563dc4bd5ce3622775306575802e20c967f0ee6bab2092769a11e2a4ea228dab91a02534beeb8afde8239dd2b90f23a

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\LogoImages\OneDriveSmallTile.contrast-black_scale-400.png
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        3c29933ab3beda6803c4b704fba48c53

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        056fe7770a2ba171a54bd60b3c29c4fbb6d42f0c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        3a7ef7c0bda402fdaff19a479d6c18577c436a5f4e188da4c058a42ef09a7633

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        09408a000a6fa8046649c61ccef36afa1046869506f019f739f67f5c1c05d2e313b95a60bd43d9be882688df1610ad7979dd9d1f16a2170959b526ebd89b8ef7

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\MSVCP140.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        425KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ce8a66d40621f89c5a639691db3b96b4

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        b5f26f17ddd08e1ba73c57635c20c56aaa46b435

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        545bb4a00b29b4b5d25e16e1d0969e99b4011033ce3d1d7e827abef09dd317e7

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        85fc18e75e4c7f26a2c83578356b1947e12ec002510a574da86ad62114f1640128e58a6858603189317c77059c71ac0824f10b6117fa1c83af76ee480d36b671

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\OneDriveTelemetryStable.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.6MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        6e8ae346e8e0e35c32b6fa7ae1fc48c3

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ca0668ddb59e5aa98d9a90eceba90a0ee2fb7869

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        146811735589450058048408f05644a93786a293c09ccb8d74420fb87c0a4d56

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        aa65ef969b1868a54d78a4f697e6edbded31b118f053bbe8a19a599baaf63821dc05f75b2ac87452cb414ab6572b8d9b349093931e64601c47f8ebbb49c431cd

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\SyncEngine.DLL
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        8.3MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        0e57c5bc0d93729f40e8bea5f3be6349

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        7895bfd4d7ddced3c731bdc210fb25f0f7c6e27e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        51b13dd5d598367fe202681dce761544ee3f7ec4f36d0c7c3c8a3fca32582f07

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        1e64aaa7eaad0b2ea109b459455b745de913308f345f3356eabe427f8010db17338806f024de3f326b89bc6fd805f2c6a184e5bae7b76a8dcb9efac77ed4b95b

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\Telemetry.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        451KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        50ea1cd5e09e3e2002fadb02d67d8ce6

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        c4515f089a4615d920971b28833ec739e3c329f3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        414f6f64d463b3eb1e9eb21d9455837c99c7d9097f6bb61bd12c71e8dce62902

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        440ededc1389b253f3a31c4f188fda419daf2f58096cf73cad3e72a746bdcde6bde049ce74c1eb521909d700d50fbfddbf802ead190cd54927ea03b5d0ce81b3

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\UpdateRingSettings.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        432KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        037df27be847ef8ab259be13e98cdd59

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d5541dfa2454a5d05c835ec5303c84628f48e7b2

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        9fb3abcafd8e8b1deb13ec0f46c87b759a1cb610b2488052ba70e3363f1935ec

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        7e1a04368ec469e4059172c5b44fd08d4ea3d01df98bfd6d4cc91ac45f381862ecf89fe9c6bedce985a12158d840cd6cfa06ce9d22466fbf6110140465002205

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\ucrtbase.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1.1MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        7a333d415adead06a1e1ce5f9b2d5877

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        9bd49c3b960b707eb5fc3ed4db1e2041062c59c7

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5ade748445d8da8f22d46ad46f277e1e160f6e946fc51e5ac51b9401ce5daf46

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d388cb0d3acc7f1792eadfba519b37161a466a8c1eb95b342464adc71f311165a7f3e938c7f6a251e10f37c9306881ea036742438191226fb9309167786fa59a

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\vcruntime140.dll
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        73KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        cefcd5d1f068c4265c3976a4621543d4

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        4d874d6d6fa19e0476a229917c01e7c1dd5ceacd

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        c79241aec5e35cba91563c3b33ed413ce42309f5145f25dc92caf9c82a753817

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d934c43f1bd47c5900457642b3cbdcd43643115cd3e78b244f3a28fee5eea373e65b6e1cb764e356839090ce4a7a85d74f2b7631c48741d88cf44c9703114ec9

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2.3MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        c2938eb5ff932c2540a1514cc82c197c

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2d7da1c3bfa4755ba0efec5317260d239cbb51c3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5d8273bf98397e4c5053f8f154e5f838c7e8a798b125fcad33cab16e2515b665

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5deb54462615e39cf7871418871856094031a383e9ad82d5a5993f1e67b7ade7c2217055b657c0d127189792c3bcf6c1fcfbd3c5606f6134adfafcccfa176441

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40.2MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        fb4aa59c92c9b3263eb07e07b91568b5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6071a3e3c4338b90d892a8416b6a92fbfe25bb67

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e70e80dbbc9baba7ddcee70eda1bb8d0e6612dfb1d93827fe7b594a59f3b48b9

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        60aabbe2fd24c04c33e7892eab64f24f8c335a0dd9822eb01adc5459e850769fc200078c5ccee96c1f2013173bc41f5a2023def3f5fe36e380963db034924ace

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\settings\PreSignInSettingsConfig.json
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        63KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e516a60bc980095e8d156b1a99ab5eee

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        238e243ffc12d4e012fd020c9822703109b987f6

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        543796a1b343b4ebc0285d89cb8eb70667ac7b513da37495e38003704e9d88d7

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9b51e99ba20e9da56d1acc24a1cf9f9c9dbdeb742bec034e0ff2bc179a60f4aff249f40344f9ddd43229dcdefa1041940f65afb336d46c175ffeff725c638d58

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\setup\logs\DeviceHealthSummaryConfiguration.ini
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        77B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        af26ba17639e14e45613d41f18eec220

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        468a10e1896d52531e0ffaaac544f20d47941b40

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        15ae29198ec8af8cf232076f1a2ebb767a81600a1ef60e9ed6fcca5ae92c50c1

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0eed32f44553c2a6e94cf36913e1f0b6ea5e39093da73d4ca30c8d9186005db78082803ca3df6a96bd0ec925177dfdd138fed430f5e6b2580b2461b254de188e

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0FLAO880\update100[1].xml
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        726B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        53244e542ddf6d280a2b03e28f0646b7

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d9925f810a95880c92974549deead18d56f19c37

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        36a6bd38a8a6f5a75b73caffae5ae66dfabcaefd83da65b493fa881ea8a64e7d

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        4aa71d92ea2c46df86565d97aac75395371d3e17877ab252a297b84dca2ab251d50aaffc62eab9961f0df48de6f12be04a1f4a2cbde75b9ae7bcce6eb5450c62

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\dom8snqr.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        96c542dec016d9ec1ecc4dddfcbaac66

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6199f7648bb744efa58acf7b96fee85d938389e4

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        36B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        8708699d2c73bed30a0a08d80f96d6d7

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        684cb9d317146553e8c5269c8afb1539565f4f78

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\$inst\temp_0.tmp
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        176KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        bc82784f4aa47bcfed93e81a3b9950f2

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        f5f2238d45733a6dde53c7b7dfe3645ee8ae3830

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        dd47684334f0a2b716e96f142e8915266d5bc1725853fd0bdc6d06148db6167f

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d2378f324d430f16ce7dcf1f656b504009b005cdb6df9d5215fe0786c112e8eba8c1650a83192b6a9afad5892a1a456714665233f6767765619ccb5ff28e2b8a

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\aria-debug-2804.log
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        470B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        503e1d8c46e38e52c463f742b16e0cb0

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        73e89f002457ad0ef3cccbd687e1887bdf6282e4

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0d46ddebbc94cab2dfdfbc762018f9d51f76ea6602376c9b14e0004b3a1f918d

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        ec9205169edf0c3f09ac359b1ac5ab55f02f0b3229cb12dc92a8f1bf848a1c2963b5104b17883c4ad86df28140f3bda9bca453f8bf51b5b7adc189d0b5b420a8

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\tmp9A1E.tmp
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        35.9MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        5b16ef80abd2b4ace517c4e98f4ff551

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        438806a0256e075239aa8bbec9ba3d3fb634af55

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        bbc70091b3834af5413b9658b07269badd4cae8d96724bf1f7919f6aab595009

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        69a22b063ab92ca7e941b826400c62be41ae0317143387c8aa8c727b5c9ee3528ddd4014de22a2a2e2cbae801cb041fe477d68d2684353cdf6c83d7ee97c43d4

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vbc648FF7BAB1DE45D48E4C799AF6A7830.TMP
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        668B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        3906bddee0286f09007add3cffcaa5d5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        0e7ec4da19db060ab3c90b19070d39699561aae2

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0deb26dcfb2f74e666344c39bd16544fcaae1a950be704b1fd4e146e77b12c00

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        0a73de0e70211323d9a8469ec60042a6892426e30ad798a39864ba123c1905d6e22cb8458a446e2f45ec19cf0233fa18d90e5f87ec987b657a35e35a49fea3b0

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\vbcD4E4E0FF971A4CA8895B727664A45AD3.TMP
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        644B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        dac60af34e6b37e2ce48ac2551aee4e7

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        968c21d77c1f80b3e962d928c35893dbc8f12c09

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        2edc4ef99552bd0fbc52d0792de6aaa85527621f5c56d0340d9a2963cbc9eed6

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        1f1badd87be7c366221eaa184ae9b9ae0593a793f37e3c1ce2d4669c83f06de470053550890ad6781b323b201a8b9d45a5e2df5b88e01c460df45278e1228084

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        a3debdb1ebf8a4ee9f39da7b5db30d34

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        96582728f02c87dfb90c010d0acb1d0daeb51a5b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        727c74f45814548956b899a24dfa9251cd81d67b58833eabddb81b666803b2d5

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e87d01d7919f2d405e78618462c66a0643091e2bc986aa0a4ddae8a28ad6de825e23327d2d2bc42b0758e24aa2a648e713a313c9361a30e83df508e5b4dce997

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e64b3c0a49f9fd626fa327867c782d3b

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        a976ed53d5557e0e1026ca089b38cbce651a6320

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        76692a0503a3a2cf22e00bcdcc47cfd38004d7f5bb2aef51af9d1f862b388edb

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        92687fc0244ce317a35671e3f141374a4eabe8ce4c7f7ad0ea280c14e7c840a448110357f598583d464339e365bc8523c1a5d3634955b35b12876a736a875b2c

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\AlternateServices.bin
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ee31680724df9b2047fe9e0070cfc4cf

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1dcebfd23dcf9710a97045da8869dc3c3ecf4089

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a401c027350dc11360e5e66ddba0fd58e937cce29ddd64ab1dceb126c2696b33

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        28ec4832dc31cf91dc1ebdf7b754e56f6b467033cabe998ad5e270f994023b23e913374eb2c4dd1917196d1bad6ff142ae78d35b93db4c3b1292e807d2e89013

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        9bc618a1039cf0337981da64399ead2b

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        9508bba3346244f4985ee57ddc82d5fa86f90969

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        b60af88e4eb68cc6b5c68cff37c47d905d09f44614b2ca00d4df34dd5294ca57

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        da0e1efe01782c699b9abe0cd1dd16d5968a346fbfda82b6b6899fafd3aafb960e4dce23ea1b30c09e22b6e1dff0704aa56ce3e7c239c147354b371b26489c1c

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        b351fcccaaf2b0f3ba42c0862862a65b

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d0b010aa33b3cde278c42a9ffadfc5a01f967a70

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        ee33157975b8ff5cf8fb0c26deaca0b200d5eed34f7e1253ae28cac10aaf8219

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        5c6cf407b65debf61ba5f46516e7c477e01668506e632a94de9b0aabf88526b403b94bbe627aa03a05ff21925219f93bb9cfc4988bb1189e249752b0e045c409

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\178f86c2-cd93-47a7-a935-de798c118837
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        671B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        663af1effa57b68b06ab18531871e7e6

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        535386b3589ee59ee17002b66ca6b0c78fb4d07d

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        227efae689508cf7c8b9006467ce2f0bdd1f8e4ed652fde006d6982e89a910c6

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3545fdb16cb0b5b1ea0a04dd8f144c7b4010a3385386ac1917e9f86b52502a47701b962af76a7dc7ab1a33d589035cd0e22f640c11e6902af3c7d1adb35e4c0e

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\1cf8b2af-c5a7-4d33-85ce-4615cb1017bd
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        25KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        fb0fa44b4ef577b214d939e76f40365a

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        39ef9f95e558f88f5c6f34795fcc7900d951996b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        37b363d11aa5c3e07eae60f795482ad33b5c6babaac6248d3c027e0f49d598fb

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        32d179ff69b91f669f10bc15a59ab5a7659171aa667577ad86ba29cbf1b5034be4a52aaf8839fbf7980398c5bf6b2813652ffe7810671bb12b2cb6617d9756d4

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\datareporting\glean\pending_pings\d585109c-b62f-4090-931f-3af8bde1d790
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        982B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e112c3b25f9f724b2f17c1cbd2825d38

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        35ac0e177ffb2f13e84dbc08984c3a2c8026e8e2

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        3b653c55ab50f97381bf65cf1efe7231fca151faf62b60a9e1ad3e28e1eacfd5

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        2e423c21cc304b972541fbb9964e68bc3b6ccf6b8aad58dfa1d76baf8d03c6940b00fc552f02f96eacad23a350e0207223a463f4e1228d8cc6f419aa5c67ee34

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\prefs-1.js
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        57837ddcc014a75537daa73c25b8c8f7

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e997d55531ae4943d0cdace319c7705a93968cbe

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        6b46663f09665b66aaa1dbf1a429bba633aae346a604dd9d0b4f5262d5095e83

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        c9d3c2561d799c0ecac6e2fd4694278b81f1ec9dcaaabb92d6d9ea88ee654d504f8487d63a2f8be1f5912039f851b449e96052430f4238ea6d8b44258d2e340a

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dom8snqr.default-release\prefs.js
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        49b0b28dc95d6041a3c2e20c49d49afe

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        a7b7ec98144bd4b2db576050707d7d809b562645

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        7b2a8b185a2e339e081cec093218513929f163f56302b1119b2a248569a393b8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        49a7e20640ced09080c33ef4d719446c262219fde606a5d4fe79bf5334d1c0343efd28b5408ef27a1b3fe4ed8e3784ed44efde2a25968e176c6b635592da3c04

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\Unconfirmed 243088.crdownload
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4.0MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        1d9045870dbd31e2e399a4e8ecd9302f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        7857c1ebfd1b37756d106027ed03121d8e7887cf

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        9b4826b8876ca2f1378b1dfe47b0c0d6e972bf9f0b3a36e299b26fbc86283885

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        9419ed0a1c5e43f48a3534e36be9b2b03738e017c327e13586601381a8342c4c9b09aa9b89f80414d0d458284d2d17f48d27934a6b2d6d49450d045f49c10909

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\Unconfirmed 628064.crdownload
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        396KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        13f4b868603cf0dd6c32702d1bd858c9

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        a595ab75e134f5616679be5f11deefdfaae1de15

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Users\Admin\Downloads\Unconfirmed 993189.crdownload
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        424KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e263c5b306480143855655233f76dc5a

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e7dcd6c23c72209ee5aa0890372de1ce52045815

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        1f69810b8fe71e30a8738278adf09dd982f7de0ab9891d296ce7ea61b3fa4f69

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e95981eae02d0a8bf44493c64cca8b7e50023332e91d75164735a1d0e38138f358100c93633ff3a0652e1c12a5155cba77d81e01027422d7d5f71000eafb4113

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        438KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        1bb4dd43a8aebc8f3b53acd05e31d5b5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        54cd1a4a505b301df636903b2293d995d560887e

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        153KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f33a4e991a11baf336a2324f700d874d

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        9da1891a164f2fc0a88d0de1ba397585b455b0f4

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe
                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        110KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        139df873521412f2aebc4b45da0bc3e9

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        3fd72fd5bad8ee9422fb9efa5f601f6b485404df

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        efe6bd2e0fc7030994fc2837b389da22c52a7b0bbdbd41852fcaf4308a23da10

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        d85cf83d3b2cf9af3076e40d7419be42a561bce1160376ba580b3078b581ed2bd6d274fb2a0767aa81a9e92052762f39c1c391ca0cac3043ad85a72862713bd3

                                                                                                                                                                                                                                                        Download Submit

                                                                                                                                                                                                                                                      • memory/724-3189-0x00000000002C0000-0x0000000000334000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        464KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/1060-2653-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/2012-2654-0x0000023087C40000-0x0000023087C6E000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        184KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/3116-733-0x0000000005500000-0x000000000559C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        624KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/3116-737-0x00000000056E0000-0x0000000005736000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        344KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/3116-736-0x00000000055B0000-0x00000000055BA000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        40KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/3116-735-0x0000000005640000-0x00000000056D2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        584KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/3116-734-0x0000000005B50000-0x00000000060F6000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.6MB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/3116-732-0x0000000000AA0000-0x0000000000B12000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        456KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/3152-2684-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/3344-2110-0x0000000000400000-0x0000000000420000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        128KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/5736-2678-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/5832-2089-0x0000000000400000-0x000000000040C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        48KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/5928-2086-0x000000001C130000-0x000000001C192000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        392KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/5928-2084-0x000000001BAF0000-0x000000001BFBE000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4.8MB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/5928-2085-0x000000001BFC0000-0x000000001C066000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        664KB

                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                      • memory/5964-2660-0x0000000000400000-0x000000000043C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                        Download