Overview

overview

10

Static

static

1

URLScan

urlscan

1

http://tiktok.com

windows11-21h2-x64

10

Analysis

  • max time kernel
    464s
  • max time network
    460s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250313-en
  • resource tags

    arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    25/03/2025, 19:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    http://tiktok.com

Score
10/10
wannacrydefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealerworm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]

Family

wannacry

Ransom Note
Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �
Wallets

115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Wannacry family
    wannacry
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops startup file 2 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 7 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 37 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://tiktok.com
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7ffffbacf208,0x7ffffbacf214,0x7ffffbacf220
      2⤵
        PID:132
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=2076,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
        2⤵
          PID:2436
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1932,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
          2⤵
            PID:4496
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2416,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
            2⤵
              PID:2372
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3448,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
              2⤵
                PID:2460
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3432,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
                2⤵
                  PID:1316
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4084,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
                  2⤵
                    PID:3720
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4092,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:9
                    2⤵
                      PID:1656
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4152,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
                      2⤵
                        PID:4736
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4124,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:9
                        2⤵
                          PID:2152
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4108,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
                          2⤵
                            PID:3760
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5372,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
                            2⤵
                              PID:3448
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=5408,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=3328 /prefetch:1
                              2⤵
                                PID:4232
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5524,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
                                2⤵
                                  PID:2172
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:14
                                  2⤵
                                    PID:2520
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
                                    2⤵
                                      PID:1168
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5984,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
                                      2⤵
                                        PID:2164
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6184,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
                                        2⤵
                                          PID:4912
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
                                            cookie_exporter.exe --cookie-json=1128
                                            3⤵
                                              PID:3860
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6340,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
                                            2⤵
                                              PID:2680
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6476,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
                                              2⤵
                                                PID:3180
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3552,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
                                                2⤵
                                                  PID:3344
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3632,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
                                                  2⤵
                                                    PID:420
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6688,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:14
                                                    2⤵
                                                      PID:3036
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6856,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:14
                                                      2⤵
                                                        PID:2552
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7000,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:14
                                                        2⤵
                                                          PID:2824
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4312,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
                                                          2⤵
                                                            PID:3348
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4756,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
                                                            2⤵
                                                              PID:4284
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5336,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
                                                              2⤵
                                                                PID:740
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4304,i,16224045636762553624,11461048082537568342,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
                                                                2⤵
                                                                  PID:4816
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                1⤵
                                                                  PID:4356
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UninstallOptimize.bat" "
                                                                  1⤵
                                                                    PID:2856
                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC
                                                                    1⤵
                                                                      PID:2264
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UninstallOptimize.bat" "
                                                                      1⤵
                                                                        PID:3388
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UninstallOptimize.bat" "
                                                                        1⤵
                                                                          PID:3992
                                                                        • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\DebugTrace.aiff"
                                                                          1⤵
                                                                          • Suspicious behavior: AddClipboardFormatListener
                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1200
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                          1⤵
                                                                            PID:5044
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                            1⤵
                                                                            • Drops file in Windows directory
                                                                            • Checks SCSI registry key(s)
                                                                            • Enumerates system info in registry
                                                                            • Modifies data under HKEY_USERS
                                                                            • Modifies registry class
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            • Suspicious use of FindShellTrayWindow
                                                                            • Suspicious use of SendNotifyMessage
                                                                            PID:2080
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff80c68dcf8,0x7ff80c68dd04,0x7ff80c68dd10
                                                                              2⤵
                                                                                PID:4576
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1832,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2076 /prefetch:11
                                                                                2⤵
                                                                                  PID:3248
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2044,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2040 /prefetch:2
                                                                                  2⤵
                                                                                    PID:3584
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2340,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=2356 /prefetch:13
                                                                                    2⤵
                                                                                      PID:2504
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3184,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3204 /prefetch:1
                                                                                      2⤵
                                                                                        PID:2032
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3248 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3640
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4152,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4188 /prefetch:9
                                                                                          2⤵
                                                                                            PID:4160
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4596,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4616 /prefetch:1
                                                                                            2⤵
                                                                                              PID:3128
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5316,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5328 /prefetch:14
                                                                                              2⤵
                                                                                                PID:4760
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5264,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5384 /prefetch:14
                                                                                                2⤵
                                                                                                  PID:400
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5456,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5528 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:792
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3324,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3216 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:3576
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3516,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=4480 /prefetch:14
                                                                                                      2⤵
                                                                                                        PID:660
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5724,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3548 /prefetch:14
                                                                                                        2⤵
                                                                                                          PID:1340
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5700,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3172 /prefetch:14
                                                                                                          2⤵
                                                                                                            PID:1300
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=212,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3796 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:1272
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=6020,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5920 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:3668
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6084,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6096 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:1600
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=6368,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6336 /prefetch:10
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:1340
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5748,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5016 /prefetch:14
                                                                                                                  2⤵
                                                                                                                  • NTFS ADS
                                                                                                                  PID:4220
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4220,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5016 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:5028
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6036,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=5804 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:4116
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6080,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=6076 /prefetch:12
                                                                                                                      2⤵
                                                                                                                        PID:1424
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6596,i,8014313622894448062,5310299595399420265,262144 --variations-seed-version=20250313-050105.095000 --mojo-platform-channel-handle=3596 /prefetch:14
                                                                                                                        2⤵
                                                                                                                          PID:2060
                                                                                                                      • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                        1⤵
                                                                                                                          PID:1300
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                          1⤵
                                                                                                                            PID:1776
                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:5064
                                                                                                                            • C:\Windows\system32\sihost.exe
                                                                                                                              sihost.exe
                                                                                                                              1⤵
                                                                                                                                PID:4760
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                  2⤵
                                                                                                                                  • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                  • Enumerates connected drives
                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                  • Modifies registry class
                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:4708
                                                                                                                                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                                                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\FindRevoke.mpv2"
                                                                                                                                    3⤵
                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:3804
                                                                                                                                  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                                                                                    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\PingStep.doc" /o ""
                                                                                                                                    3⤵
                                                                                                                                    • System Network Configuration Discovery: Internet Connection Discovery
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    • Enumerates system info in registry
                                                                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:5904
                                                                                                                              • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\[email protected]
                                                                                                                                "C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\[email protected]"
                                                                                                                                1⤵
                                                                                                                                • Drops startup file
                                                                                                                                • Sets desktop wallpaper using registry
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:4744
                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                  attrib +h .
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Views/modifies file attributes
                                                                                                                                  PID:2144
                                                                                                                                • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                  icacls . /grant Everyone:F /T /C /Q
                                                                                                                                  2⤵
                                                                                                                                  • Modifies file permissions
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4532
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
                                                                                                                                  taskdl.exe
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:420
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c 184611742930234.bat
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1636
                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                    cscript.exe //nologo m.vbs
                                                                                                                                    3⤵
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    PID:4728
                                                                                                                                • C:\Windows\SysWOW64\attrib.exe
                                                                                                                                  attrib +h +s F:\$RECYCLE
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Views/modifies file attributes
                                                                                                                                  PID:4984
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  @[email protected] co
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:5464
                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\TaskData\Tor\taskhsvc.exe
                                                                                                                                    TaskData\Tor\taskhsvc.exe
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    PID:1908
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  cmd.exe /c start /b @[email protected] vs
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5656
                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                    @[email protected] vs
                                                                                                                                    3⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1340
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                                                                      4⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:3708
                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                        wmic shadowcopy delete
                                                                                                                                        5⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5336
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
                                                                                                                                  taskdl.exe
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5632
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskse.exe
                                                                                                                                  taskse.exe C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5304
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  @[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Sets desktop wallpaper using registry
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:5308
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vymudavb085" /t REG_SZ /d "\"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\tasksche.exe\"" /f
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2316
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vymudavb085" /t REG_SZ /d "\"C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\tasksche.exe\"" /f
                                                                                                                                    3⤵
                                                                                                                                    • Adds Run key to start application
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Modifies registry key
                                                                                                                                    PID:5432
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
                                                                                                                                  taskdl.exe
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1576
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskse.exe
                                                                                                                                  taskse.exe C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1316
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  @[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:5208
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskse.exe
                                                                                                                                  taskse.exe C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5648
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  @[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:6020
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
                                                                                                                                  taskdl.exe
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3756
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskse.exe
                                                                                                                                  taskse.exe C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5944
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  @[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:2144
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
                                                                                                                                  taskdl.exe
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:6108
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskse.exe
                                                                                                                                  taskse.exe C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:4340
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                  @[email protected]
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:2412
                                                                                                                                • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\taskdl.exe
                                                                                                                                  taskdl.exe
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5628
                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                1⤵
                                                                                                                                • Enumerates system info in registry
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:1776
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:3768
                                                                                                                              • C:\Windows\system32\vssvc.exe
                                                                                                                                C:\Windows\system32\vssvc.exe
                                                                                                                                1⤵
                                                                                                                                  PID:5160
                                                                                                                                • C:\Windows\System32\rundll32.exe
                                                                                                                                  C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                  1⤵
                                                                                                                                    PID:5752

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                  Reconnaissance

                                                                                                                                  Resource Development

                                                                                                                                  Initial Access

                                                                                                                                  Execution

                                                                                                                                  Windows Management Instrumentation

                                                                                                                                  1
                                                                                                                                  T1047

                                                                                                                                  Persistence

                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                  2
                                                                                                                                  T1547

                                                                                                                                  Active Setup

                                                                                                                                  1
                                                                                                                                  T1547.014

                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                  1
                                                                                                                                  T1547.001

                                                                                                                                  Privilege Escalation

                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                  2
                                                                                                                                  T1547

                                                                                                                                  Active Setup

                                                                                                                                  1
                                                                                                                                  T1547.014

                                                                                                                                  Registry Run Keys / Startup Folder

                                                                                                                                  1
                                                                                                                                  T1547.001

                                                                                                                                  Defense Evasion

                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                  2
                                                                                                                                  T1222

                                                                                                                                  Windows File and Directory Permissions Modification

                                                                                                                                  1
                                                                                                                                  T1222.001

                                                                                                                                  Hide Artifacts

                                                                                                                                  1
                                                                                                                                  T1564

                                                                                                                                  Hidden Files and Directories

                                                                                                                                  1
                                                                                                                                  T1564.001

                                                                                                                                  Indicator Removal

                                                                                                                                  1
                                                                                                                                  T1070

                                                                                                                                  File Deletion

                                                                                                                                  1
                                                                                                                                  T1070.004

                                                                                                                                  Modify Registry

                                                                                                                                  5
                                                                                                                                  T1112

                                                                                                                                  Credential Access

                                                                                                                                  Credentials from Password Stores

                                                                                                                                  1
                                                                                                                                  T1555

                                                                                                                                  Credentials from Web Browsers

                                                                                                                                  1
                                                                                                                                  T1555.003

                                                                                                                                  Unsecured Credentials

                                                                                                                                  1
                                                                                                                                  T1552

                                                                                                                                  Credentials In Files

                                                                                                                                  1
                                                                                                                                  T1552.001

                                                                                                                                  Discovery

                                                                                                                                  Browser Information Discovery

                                                                                                                                  1
                                                                                                                                  T1217

                                                                                                                                  Peripheral Device Discovery

                                                                                                                                  2
                                                                                                                                  T1120

                                                                                                                                  Query Registry

                                                                                                                                  5
                                                                                                                                  T1012

                                                                                                                                  System Information Discovery

                                                                                                                                  5
                                                                                                                                  T1082

                                                                                                                                  System Location Discovery

                                                                                                                                  1
                                                                                                                                  T1614

                                                                                                                                  System Language Discovery

                                                                                                                                  1
                                                                                                                                  T1614.001

                                                                                                                                  System Network Configuration Discovery

                                                                                                                                  1
                                                                                                                                  T1016

                                                                                                                                  Internet Connection Discovery

                                                                                                                                  1
                                                                                                                                  T1016.001

                                                                                                                                  Lateral Movement

                                                                                                                                  Collection

                                                                                                                                  Data from Local System

                                                                                                                                  1
                                                                                                                                  T1005

                                                                                                                                  Command and Control

                                                                                                                                  Web Service

                                                                                                                                  1
                                                                                                                                  T1102

                                                                                                                                  Exfiltration

                                                                                                                                  Impact

                                                                                                                                  Defacement

                                                                                                                                  1
                                                                                                                                  T1491

                                                                                                                                  Inhibit System Recovery

                                                                                                                                  1
                                                                                                                                  T1490

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]
                                                                                                                                    Filesize

                                                                                                                                    1KB

                                                                                                                                    MD5

                                                                                                                                    83dd592a5409cd9ac4f4255770e86347

                                                                                                                                    SHA1

                                                                                                                                    1c75875a900dcf8aeac31bed55ad52b9168f23c6

                                                                                                                                    SHA256

                                                                                                                                    17d79bba368ba3cc85592043fcb633e6a9af3b0adbc3f716c18908bd3da67bd6

                                                                                                                                    SHA512

                                                                                                                                    56bc67ba4d6cc329978fa3a1b58cb4daf9223e6f25e813c35866595342ca53f47cda51c9f8a1c2089a724d8f05815518fe80af99e6c9e7d37da1a7bbe3cc0a2f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                    Filesize

                                                                                                                                    649B

                                                                                                                                    MD5

                                                                                                                                    1e5eb86b3bde84baffc6be9a530fca9d

                                                                                                                                    SHA1

                                                                                                                                    b8d3a503894be2dca18bffd377ac6d08b8b1a1e4

                                                                                                                                    SHA256

                                                                                                                                    a1d6b5d03aa55679184ddcaf558d27730493baf55df3b95bf01ffe9da55105ad

                                                                                                                                    SHA512

                                                                                                                                    b41cd231d05e43482d156314c77c1820ec3c78d30601416f2836c14c5552dea91bec998cc39fc77a780e84da66a186eb46d53c0c335649cee8d696b9a67f0316

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    0eb4690c68514acdd8210f0fb688f5f7

                                                                                                                                    SHA1

                                                                                                                                    154fb7909a783327fda8ea3627ba0770943b5594

                                                                                                                                    SHA256

                                                                                                                                    a841356651cb6e543606b49c423e987e882b289f55de89794de8cd838428e9dd

                                                                                                                                    SHA512

                                                                                                                                    24364945d979138d19e3f089aee825f76d554aa5baa3b11a4d0a011b60bff9f8f0c0349d59e187430ac742baa91fcf9ae667ef9a45b0ba586abd64f5763c696d

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                    Filesize

                                                                                                                                    3KB

                                                                                                                                    MD5

                                                                                                                                    573d136be31723c698d06b5a294fb1bb

                                                                                                                                    SHA1

                                                                                                                                    fc23cfd3e6185a9d17f24b80e3ee39774b8b55a7

                                                                                                                                    SHA256

                                                                                                                                    905b8e90f0e00eed97d419e1dcba88c0450c09c050646ec720f141851f932566

                                                                                                                                    SHA512

                                                                                                                                    391b7dce9ea9a9903ed0f05d6d9a003a1298bc7e3b70e516aaeec95a34406db1c08585063b0cd688ebef355fd5a0341d279d17a11bee6180e882be087310ac20

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                    Filesize

                                                                                                                                    5KB

                                                                                                                                    MD5

                                                                                                                                    119859c6f32287ddc050bec36e746cdf

                                                                                                                                    SHA1

                                                                                                                                    bb8caabdf278c943d2ad35b21213a7926c83caf3

                                                                                                                                    SHA256

                                                                                                                                    41c63bf5fd2204c79a4f3a56753406c6466f61468e715f1f7e9da3a05b482fda

                                                                                                                                    SHA512

                                                                                                                                    bee8698705dfa5e0779c1caa5219bb15b29cd66a23a308c70724d4b02f6d9559cd652ca2ad6e507094c6482af77e3f09f20cd5c2b21760339519dafceb4c0439

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                    Filesize

                                                                                                                                    6KB

                                                                                                                                    MD5

                                                                                                                                    820b07a37a737400f91afb730f297915

                                                                                                                                    SHA1

                                                                                                                                    b83d3f6dd8431dcb4a47a1cf5d8a77ef19798062

                                                                                                                                    SHA256

                                                                                                                                    397fbe698a71ebe78fd91501defa017ec2051f544917593d7982671d4c79163f

                                                                                                                                    SHA512

                                                                                                                                    cda550a4752b5a923d8fe7eb57906297f14156413bcdbefb0ecc1995e3f3ea143585c362742769b4425da9fd6c3243f741d24cf3058b5a8fadaa2a41f2054947

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                    Filesize

                                                                                                                                    7KB

                                                                                                                                    MD5

                                                                                                                                    555dc723193e07f2e253fa094f35abdd

                                                                                                                                    SHA1

                                                                                                                                    987c55891df99ccf0947a730d11e468e0b93a21c

                                                                                                                                    SHA256

                                                                                                                                    97fb9b06ea413e70e42243f878ed753c1cf5dc1c115e2079d6fea808ff644823

                                                                                                                                    SHA512

                                                                                                                                    0e53bb50bbaa281df8c80700351d42cce280512e609f56a837a2f77bc40925c6cc5e6e1029b0ecda924ac96af74adfab52f4aa6f9b2b54685106563e2ec06432

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    092cdefb321296f51fc22d064d2d11c3

                                                                                                                                    SHA1

                                                                                                                                    71f84ccb4dc172273ee7eb3d2991f9cb0f68b783

                                                                                                                                    SHA256

                                                                                                                                    304937a3a60b282838de0b9105e744f9867cf607fd584ad012f077234c986bfb

                                                                                                                                    SHA512

                                                                                                                                    08098e66f7312e763c30c6bac5ab0b37b51c025e634c4726d37f911591844f16df025bab89dec374553ccf1ca8406aeac144150fe5a0bef500283778af98aa79

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    93a6e761d87a45859bf54b91166daca5

                                                                                                                                    SHA1

                                                                                                                                    37cf859e8a9d8f135ee53c4cbdf42fde326cb825

                                                                                                                                    SHA256

                                                                                                                                    e6ec76edee5b19088cf38ec6344c519109744be7ebe18a50bc5f70812eb75c1d

                                                                                                                                    SHA512

                                                                                                                                    26ea1de1f26d14d82bcba3e4c7b06080e1ce98f88de6f6b4bdad32f0352f81db928f31624a00d4d8c2191542b1d9f4d2661132fb70cfc3163429aa133aefe64d

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    11KB

                                                                                                                                    MD5

                                                                                                                                    efc341a2bb505efbd9627b9677adb1e7

                                                                                                                                    SHA1

                                                                                                                                    c710bafd8b9e10462cad94a327da060554df80da

                                                                                                                                    SHA256

                                                                                                                                    646be6027d0a22367ed8a6b07f2d2f6e2149f8c7e0b3b105fb24eaed04cd4dce

                                                                                                                                    SHA512

                                                                                                                                    ab8578b3cb4c3510b10f23e51e453b7238eb1508c104f0443f3f113cfa44e2a0ebe332d4c62afc9fc9e831992441ca56c8d68406a9c14c8e6894cc00eee1c463

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    4c5bbbb35ceae5b7a401d3d63f37d18b

                                                                                                                                    SHA1

                                                                                                                                    cf089f7e0f2fc20c1b755776bd659c0730786e35

                                                                                                                                    SHA256

                                                                                                                                    d1ebe9768393b71c915292d42540b7c79a5760d1c3de5a523af2681650b32721

                                                                                                                                    SHA512

                                                                                                                                    07f1ec9927589e201a6d9f95a02e706731669b13e2736398bcc9ef7cece039bd11a3a6b41bfae5cb108c1de0a0bdd0414c1618db45469509f0f041b6787d577f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    3d26e3bfb85f8593e521443f4670a70e

                                                                                                                                    SHA1

                                                                                                                                    76b0452214d334b125273620bf844c4107cb8ea4

                                                                                                                                    SHA256

                                                                                                                                    fb76b0cf115816c15c790a01da359be0e2c39fa05d71569cd1d8b5cf2c6a8063

                                                                                                                                    SHA512

                                                                                                                                    a356b50bed3e0d461fc8c3c89ee59e43bff19869153b9f23dadcff9d01107322772d3d2533e1726eddfb58647796e0cbfe06a399bc3fe22a0cc97c796d87082f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    c4f4321bef7abdd70c5b4de9d7aa08e0

                                                                                                                                    SHA1

                                                                                                                                    89560c4a0950ac9447529910fb07a284569a0021

                                                                                                                                    SHA256

                                                                                                                                    c7101ac663a3c8daf002e40637e0aee83b5fd6c06d51fe880be25b94e7a8f8e9

                                                                                                                                    SHA512

                                                                                                                                    93db902c51a4173972e64fd919abb3e4324a181a94ad088e53e99977ee02d48a66804267f81d6f03228252949a067ae33279e55056a65fb76e9388e45636bdc7

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    732202ae0d0c3fa6f9efc580a6f8d2d1

                                                                                                                                    SHA1

                                                                                                                                    8db15d8ea88c4aa43c5497972c425731e4e3f28d

                                                                                                                                    SHA256

                                                                                                                                    e79329bd183a6476712be148779144bb07bd4e0ac1fe76850362fce34cb12497

                                                                                                                                    SHA512

                                                                                                                                    75d968227abdcfbed7762d86c15a46fa06af12d6e42138730c9e56aa8dfb95d3481e9648f66b206dbeebce3ef8df9290d0703eeea474f5460d196e83e46e9128

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    eab0e5ac75c40f7a751d9fc112670f61

                                                                                                                                    SHA1

                                                                                                                                    f2e01203c82dd6e6bf7e29ba1068fad3081c2db8

                                                                                                                                    SHA256

                                                                                                                                    c6ca3e0e0a1caff24fd2e9be7f64edf14382dd4835a9a5787767f3d538782401

                                                                                                                                    SHA512

                                                                                                                                    e09a537f4fd19bb33e23ce4bb12180f304fc5f3a157a368e9ba3aa8efbc7c0bd86727188bc7461630a1617cef45bc86ef9ab8ccead91d25e4760fda17bca830f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    13KB

                                                                                                                                    MD5

                                                                                                                                    e60190886e51620b6db7774f45b3c95a

                                                                                                                                    SHA1

                                                                                                                                    61c2c7c34f349f4a52fe933e3b231512dc023abf

                                                                                                                                    SHA256

                                                                                                                                    ee8ca1ad5dfd3dd501e348defd992ea69436027cddd0ddf7ce885ce9bf2e93e4

                                                                                                                                    SHA512

                                                                                                                                    1c3aedcac430057968a7ffdba6d05aba0a4dfaceafb13d4c703292144752996f0da39c103c77c903ddcba80ce5a3860a2482282b15b982ed90b2058cbfcd2065

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    0465338502ff360823f83fa411a14678

                                                                                                                                    SHA1

                                                                                                                                    1a00f42a94f139213ba994f6fe21282322c5b76a

                                                                                                                                    SHA256

                                                                                                                                    7bb3374d037c254b3e456f7984e86da524f323ea9b0d7741f6de1741ff2ad4a7

                                                                                                                                    SHA512

                                                                                                                                    d6414d60842ef27bfaa3043c7a489086cd91507133a572d4298f757d862502bae1d6d38e2fd08fb906b3c1b9fbe29c036b43bc9b4fa02821f1d33a4c396ed781

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    13KB

                                                                                                                                    MD5

                                                                                                                                    ffefbd39add2b6bf32b2764ec80bae7d

                                                                                                                                    SHA1

                                                                                                                                    ecb5aed3250f51bd3c7a93402b97179b8270a5eb

                                                                                                                                    SHA256

                                                                                                                                    1c389ce9a6267955a1f95f1b6d7f0aeff85fa797b551e1c76d5b9df431e898dd

                                                                                                                                    SHA512

                                                                                                                                    0568392165f962b0812c5ca245ea91c0c29964c2ae73ab068c1f3338494e88a0a80c2836beae58ead223fe238f7dc67dc025a5dcc2acec6417041a73e2ebb890

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    10KB

                                                                                                                                    MD5

                                                                                                                                    2bfbca3102608aa43dd0e48599fae24f

                                                                                                                                    SHA1

                                                                                                                                    aadbc172d5c5b2419eba41575a67ae3d4b351905

                                                                                                                                    SHA256

                                                                                                                                    81665a0a04e47999212fa72a117535a9c953354355a626791c7dd6f3f21c9403

                                                                                                                                    SHA512

                                                                                                                                    3aa0865e8b275d60725c6edfec10eb66c5e3479573f409cda7171860293104a0fdd5e1f334688cebbf8ad3a37cd5478363a96bca0fd599087e55b777d42bba3e

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    cfc69ec26381de9d5e158f65f8ecfdf1

                                                                                                                                    SHA1

                                                                                                                                    f9af643592a59485972780862fe219fcebddfb3d

                                                                                                                                    SHA256

                                                                                                                                    d6098dc678198252d07deaca8dd52248f0f9b48db6a51b7fd1ac1fbb74cde58d

                                                                                                                                    SHA512

                                                                                                                                    08b4ffefc0dd6cf7d1c4e4b179747f26131bb4d9aeab37f8cc2015906fffe768bfba8409cb9784297bedf4edeb6c4898189567d3d3ff533c1cb1a7cbc9e10324

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                    Filesize

                                                                                                                                    15KB

                                                                                                                                    MD5

                                                                                                                                    69f48251d77ecdf636d07c844dc3336d

                                                                                                                                    SHA1

                                                                                                                                    685f133d7e668ffe0ef5e08b131f101954e49c01

                                                                                                                                    SHA256

                                                                                                                                    ba1074146afb21a1f182c6f985a320089a00c93176a799785c577d30e2b43218

                                                                                                                                    SHA512

                                                                                                                                    32393d52a7ae16fbc22fe22941db725c00cf0adddfe761411e7c17b74586157e40cf9fc8e3d0335cada1344363664068273431487cefd6dc0c4a2d534f1a76ad

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                    Filesize

                                                                                                                                    72B

                                                                                                                                    MD5

                                                                                                                                    2bfd8717a5fe6df30622870150fc5b58

                                                                                                                                    SHA1

                                                                                                                                    06ad63dbf3302e60e8c26a71bc4f20d34ceeecc7

                                                                                                                                    SHA256

                                                                                                                                    a086b6721b4edb9633c914a220fa6ec334701fb310a07feeb1935401f8ba3a95

                                                                                                                                    SHA512

                                                                                                                                    d3a40a3a91954c076a7201fdeb2cb39c18729bc7c07197a5ae03bd02e367fd49040fed77838649324c476b4a65c20645b6f92d61013357ae5e5eea433b42b64c

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5853c8.TMP
                                                                                                                                    Filesize

                                                                                                                                    48B

                                                                                                                                    MD5

                                                                                                                                    c6a59f751b339c9d5a707604eceed87b

                                                                                                                                    SHA1

                                                                                                                                    2c2d4e52e0cae0575de76ef1799ec0deb5b9bb38

                                                                                                                                    SHA256

                                                                                                                                    2bfa4aada4eea22179ee2f61f90e922e6485de6c1bbf4e3dd1f0155429a99a85

                                                                                                                                    SHA512

                                                                                                                                    8251de254c1df7eb06ee5929f5862c89f709803ead1fca70d30ad3c0a999052d0aa09a66e3dd22876a5cfa4a14a86b00c6cd6b34f52d076624e781f4fb4e3865

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    155KB

                                                                                                                                    MD5

                                                                                                                                    c1b9dcc6e874feaf7dcecaa73866cd58

                                                                                                                                    SHA1

                                                                                                                                    e8ce12b32cce1e631b0163e3018de31f100709aa

                                                                                                                                    SHA256

                                                                                                                                    bf2186ee9c97bc2bb05af6de8f134448cdbe16d4496a8c5557464700c3fc4a97

                                                                                                                                    SHA512

                                                                                                                                    ee73344666762858a14e2d719969a5cfa2ed6654ac67209405d96146bdff88e520d47eab04a367eb9248b6337c417f758fdade07a5424b16197dc192b0f6b2d5

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    155KB

                                                                                                                                    MD5

                                                                                                                                    f98c4a136baa20a3c0b770b6edd1e4c8

                                                                                                                                    SHA1

                                                                                                                                    fc043a3e25b45860e3a121550800f893dbd90645

                                                                                                                                    SHA256

                                                                                                                                    910f5c024cc81cb71a5f6aae3bcb66deb4a64bc48d6e295d37a18b778b42145d

                                                                                                                                    SHA512

                                                                                                                                    6467a72474c6b2a8bcca0ebc4fc6e20bcb5f18224a99c7af5336d7ada5e649454a65992823cd07e13d3386543c7e4c2e492e37c5cf95078cb0d979bdbe9b3012

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    156KB

                                                                                                                                    MD5

                                                                                                                                    cafea5ddc992e5caf6fad9d13ce9f331

                                                                                                                                    SHA1

                                                                                                                                    880419c708c071e32d8b42de8bf7d9a92fe6e58e

                                                                                                                                    SHA256

                                                                                                                                    1b9b8710c3cdfa91fb28cd1e5cd8070aee1938f38c9d922849d613a9180f8ad9

                                                                                                                                    SHA512

                                                                                                                                    9fb47b69e8f360315b8fb9adae9d0c7299eada7f8b83f3b25b240da65ad56986007af2c52e39d7fca8c2f532f921565a82fb87db0bfe9e79f2abea3e468e57cd

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    80KB

                                                                                                                                    MD5

                                                                                                                                    7a830ec2fb114996b1f1d9ed30e7786f

                                                                                                                                    SHA1

                                                                                                                                    f6b756a47bee19ac065e9bc214593820443b012e

                                                                                                                                    SHA256

                                                                                                                                    c4de2b061e3a295abc8a211cedaa2a2f6293314ad7462552a0b675c6aa55654c

                                                                                                                                    SHA512

                                                                                                                                    10880b2bf0c3b18f4a174f90276f382730008ca52d449cee72f37c6f6756eed04348818234e9278fd0197cca00e0f11506b63afb7426516019d18751c557c39b

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                                                    Filesize

                                                                                                                                    105KB

                                                                                                                                    MD5

                                                                                                                                    b1f9e6bc13d304e2cd6f2cb034daaa14

                                                                                                                                    SHA1

                                                                                                                                    b77b9a253300dfdad344e75a7cfc3f4152e78bdb

                                                                                                                                    SHA256

                                                                                                                                    ef40eb68e01e88ea3d54d7c3bdf4faf88620bed39270fbaffa966f9ea3a6fa2e

                                                                                                                                    SHA512

                                                                                                                                    249599df660e416859bf1387a32de70b03acfdc4cd9223269cc9e5b96fa5f10c3a6b6f2432c2857d76163e7ce3ea3fe14211d526d97d6d9316f191f1dc304dfe

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                    Filesize

                                                                                                                                    280B

                                                                                                                                    MD5

                                                                                                                                    e569a5a7c29c7fc35a13a57dd80c3ee4

                                                                                                                                    SHA1

                                                                                                                                    5e77b4e69d614e8bd374bbbe7cdc4afc63bf288c

                                                                                                                                    SHA256

                                                                                                                                    ef0c96f2f3ea63fd7ae480908c2dcb6ec20443c82f0cc221a91818cbb24974b8

                                                                                                                                    SHA512

                                                                                                                                    57b59dc121e774c3fde49799cb91e31c8ccc872ecd7f72ced6c9f80ae8dfc7c6e5fc404dfe77c9de20c70a6d061739619925e49fb85cdb3ee69e1913afcb5a76

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                    Filesize

                                                                                                                                    280B

                                                                                                                                    MD5

                                                                                                                                    046b1cdbd636e82e7711ea1fde31d7e3

                                                                                                                                    SHA1

                                                                                                                                    f5fa4183cb259a99b4148ee957a5f76e80a77ada

                                                                                                                                    SHA256

                                                                                                                                    40328502d95af4c1db45d98abe8c4e9214d80a8df7f0b8f19f81edd5e121f90a

                                                                                                                                    SHA512

                                                                                                                                    460ba5792f0df64289ff4057d04615973a7844b2fd2c14df554600c141d720fcf13d9e9c8449ac57e50fa074a81887437918970881b4d48f7a7ee3521bac8eb4

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                    Filesize

                                                                                                                                    280B

                                                                                                                                    MD5

                                                                                                                                    cbc9fc2d9ad2df85283109b48c8e6db0

                                                                                                                                    SHA1

                                                                                                                                    721ea0dfafd882d6354f8b0a35560425a60a8819

                                                                                                                                    SHA256

                                                                                                                                    7c21b286b304b2b42ab3502158aef04892b60c63007b8ed7172dad86a4bcebbe

                                                                                                                                    SHA512

                                                                                                                                    09594b5f33704cf367960376e5abc8cbfa7baead59c3f199ffd365a9a9c2159b45f6596d597ebdd033db5436c000faac3c5b2fb39e97fc17b102d03831265609

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c582cf3-2f43-4fe0-b69f-3d53df23e217.tmp
                                                                                                                                    Filesize

                                                                                                                                    14KB

                                                                                                                                    MD5

                                                                                                                                    affc5d3152dc8b5499c765194c012ed8

                                                                                                                                    SHA1

                                                                                                                                    2779fc46864085841dd53f38d6addf817f5d5707

                                                                                                                                    SHA256

                                                                                                                                    f64240fba847370b8150183ab8ed2d8b087563d5be16694ce4ea66583573ca3a

                                                                                                                                    SHA512

                                                                                                                                    a36127e71e4ac7b0c1d23cf77a958071d8cb4a35ad8d286852f2bae34b5152c68f70991b6c62b83cb0d2b3d74c2f9abf3930f83d201e9ba7193ff696f4aee572

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
                                                                                                                                    Filesize

                                                                                                                                    56KB

                                                                                                                                    MD5

                                                                                                                                    5e53ed25086aaa0d3337101b741466ae

                                                                                                                                    SHA1

                                                                                                                                    08b6244aa107201b2b4e6e76ce4c123dcacda182

                                                                                                                                    SHA256

                                                                                                                                    5ac2037030385ad8cf10e486b44475d778eef2e2a377751fbf3c938fd3991b1c

                                                                                                                                    SHA512

                                                                                                                                    7c90e1b48ee9a1dc112bc1921e2a42f4d329d734be246ed488aaead60ff14e2581580e6629bd2b24c109cb66279190df3ee494eb83d1b96f418886cd72f2747a

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
                                                                                                                                    Filesize

                                                                                                                                    55KB

                                                                                                                                    MD5

                                                                                                                                    fdf2600d905a0faa060d691e0212e1a7

                                                                                                                                    SHA1

                                                                                                                                    62550f0993a219e265ff9a0795a4d9f49b28748f

                                                                                                                                    SHA256

                                                                                                                                    52a37b3a78eb5b59df3bdb129b9115c6fed9bec6ca62b55ae56d8c2701de5972

                                                                                                                                    SHA512

                                                                                                                                    7118d2ea3aafe3d77709842da20acbe3faaf4c6c92a50ab05ecd4986916bbb92fe297a1b00357572683b02c61762cdf31dc425f03221dd169803252db5f04f7f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
                                                                                                                                    Filesize

                                                                                                                                    57KB

                                                                                                                                    MD5

                                                                                                                                    26a1891f272dc17f5ac69a8cfde2991d

                                                                                                                                    SHA1

                                                                                                                                    097239d7cb11b964bd6a745f24e5f82267fcaf0f

                                                                                                                                    SHA256

                                                                                                                                    e4dd3bb15ae6492d5ddff59e08075a6023463b82cfe6c284470fec0d86fe52ae

                                                                                                                                    SHA512

                                                                                                                                    2b78bc3b2e57aeaacdbce5315b117c8900f9cfb99e331704c80f871882b1f0ad88ef7d6808fea6a8e93e1e65a239beaff9c3d61a07191b96bc21c0fac759d783

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
                                                                                                                                    Filesize

                                                                                                                                    55KB

                                                                                                                                    MD5

                                                                                                                                    cfd886e1ca849a7f8e2600763f236d78

                                                                                                                                    SHA1

                                                                                                                                    c1fc2b10d20c529c01b465a1edc0ed2fe04f0bd5

                                                                                                                                    SHA256

                                                                                                                                    c0b1c3c6995c24eabd1a6fcc4f00523e022b546cf1fa4fce6c30d04763244d1b

                                                                                                                                    SHA512

                                                                                                                                    254e37e3650b2c87b524c96f517586b690094abf7c8e0539b050ecdc4c56c2593bedab7b1a830b827ddc19f1c3e05ff4096ebdf4cc969b5bc5fd33cb34e94fd8

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                    Filesize

                                                                                                                                    6KB

                                                                                                                                    MD5

                                                                                                                                    fb9850c4ef22bc152862ca2abbc93bcb

                                                                                                                                    SHA1

                                                                                                                                    7866b9ecaab11850ea1d7a77cf10faf09bc27a2f

                                                                                                                                    SHA256

                                                                                                                                    d923ccaa7d5f3d47eb92260813ebdeafc9c83f88ded47b342946ef1917378043

                                                                                                                                    SHA512

                                                                                                                                    a5a7f5506cc524d4cd13bc26c8123296495eabe1b38024ecea16204a369430717c499a46e3a286ee363257d492f5ba068b4378fbb8c3fbf8b07636bd007672b6

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57fa1f.TMP
                                                                                                                                    Filesize

                                                                                                                                    2KB

                                                                                                                                    MD5

                                                                                                                                    20c84e01e5c2ecc9ab27d4ce8be6d3e9

                                                                                                                                    SHA1

                                                                                                                                    d2a30d0786cffddda675cf812d18d68c41900e58

                                                                                                                                    SHA256

                                                                                                                                    1d318afbcc6512209215f3bbb906fc7c6a2aa3b9d5ada951a9223a7fc6d2d99f

                                                                                                                                    SHA512

                                                                                                                                    f2ccf6c6d78078fc6e44ab8f0e58f5e3dfa28e88bad4b2f7b7247ca27e5d7210c29fa65d4dbc878b3016bee435ceb635550ceeaba6e919480f3227fd6c9a8d7d

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnWebGPUCache\data_1
                                                                                                                                    Filesize

                                                                                                                                    264KB

                                                                                                                                    MD5

                                                                                                                                    ee03907c3589d3cd2de800b00f7f62a6

                                                                                                                                    SHA1

                                                                                                                                    fed1b589f168fe45dddd6d41c23637872d758a5f

                                                                                                                                    SHA256

                                                                                                                                    b8d07b5a276b62bb9b52a7de63752a490304e9fc1afc4a31a43333c1ee8e35aa

                                                                                                                                    SHA512

                                                                                                                                    aeeb0b41b0e72c5a4af9489fc365591ed6e7357f23a86adeafecb2d16ecc2be668cd6e8d1cf88e78d1aa293c3cfa70dcafc4a58a63283b8f43a9e22030e8da1e

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                    Filesize

                                                                                                                                    2B

                                                                                                                                    MD5

                                                                                                                                    99914b932bd37a50b983c5e7c90ae93b

                                                                                                                                    SHA1

                                                                                                                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                                    SHA256

                                                                                                                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                                    SHA512

                                                                                                                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                    Filesize

                                                                                                                                    69KB

                                                                                                                                    MD5

                                                                                                                                    164a788f50529fc93a6077e50675c617

                                                                                                                                    SHA1

                                                                                                                                    c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

                                                                                                                                    SHA256

                                                                                                                                    b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

                                                                                                                                    SHA512

                                                                                                                                    ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js
                                                                                                                                    Filesize

                                                                                                                                    9KB

                                                                                                                                    MD5

                                                                                                                                    3d20584f7f6c8eac79e17cca4207fb79

                                                                                                                                    SHA1

                                                                                                                                    3c16dcc27ae52431c8cdd92fbaab0341524d3092

                                                                                                                                    SHA256

                                                                                                                                    0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

                                                                                                                                    SHA512

                                                                                                                                    315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                    Filesize

                                                                                                                                    107KB

                                                                                                                                    MD5

                                                                                                                                    40e2018187b61af5be8caf035fb72882

                                                                                                                                    SHA1

                                                                                                                                    72a0b7bcb454b6b727bf90da35879b3e9a70621e

                                                                                                                                    SHA256

                                                                                                                                    b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

                                                                                                                                    SHA512

                                                                                                                                    a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                    Filesize

                                                                                                                                    111B

                                                                                                                                    MD5

                                                                                                                                    285252a2f6327d41eab203dc2f402c67

                                                                                                                                    SHA1

                                                                                                                                    acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                                                                                                                                    SHA256

                                                                                                                                    5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                                                                                                                                    SHA512

                                                                                                                                    11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                    Filesize

                                                                                                                                    2B

                                                                                                                                    MD5

                                                                                                                                    d751713988987e9331980363e24189ce

                                                                                                                                    SHA1

                                                                                                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                    SHA256

                                                                                                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                    SHA512

                                                                                                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d2a92ef2-359e-4d0b-b812-83e03e04f3cb.tmp
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    MD5

                                                                                                                                    386a5562b61c45f8db28b67b0742ff88

                                                                                                                                    SHA1

                                                                                                                                    e0d067976b8740020f10a67b98876b1da523d530

                                                                                                                                    SHA256

                                                                                                                                    8c88c808d190a1fcc7cdbd1a131b1da4479ad15c3765c78bb592ba75affd4f9b

                                                                                                                                    SHA512

                                                                                                                                    6e2e75be499f218917154a8bed69b3076f01a6eff3f9187c8e00eb8747fb92e3032fca9126b8ec432240922d804abcdb5b329399f5a3fd50fcaa609c418ddf19

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                    Filesize

                                                                                                                                    16KB

                                                                                                                                    MD5

                                                                                                                                    abcbdc9bbf28d9cdf00218422bd0d148

                                                                                                                                    SHA1

                                                                                                                                    110d093266828e7dc8c5f212a7f5d7f7ff2313ce

                                                                                                                                    SHA256

                                                                                                                                    c465dde268361a0ef80dc2a416bc333a810e9147d8b00e7608429f528c917df8

                                                                                                                                    SHA512

                                                                                                                                    75bd724cdadbeb96101cff657025dbd4de501544d5110da7afd92673f03743bfdeae799ae97a70bfcb71306c49f37db16d86c55aa9e2e8822b9f335df168fd69

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                    Filesize

                                                                                                                                    37KB

                                                                                                                                    MD5

                                                                                                                                    e485c663b5a2355c2d5d2b5e4c261c11

                                                                                                                                    SHA1

                                                                                                                                    9a12642d2ee6ef84dc71ea68b704045a51706137

                                                                                                                                    SHA256

                                                                                                                                    d82f1d9e024c5af3e8c0402ec753c3fdc2f0b1bdf046fac9546b85e805dd7671

                                                                                                                                    SHA512

                                                                                                                                    1ec577f59dae00c36e42d89da3c2610af5fcc05fae8c42eb333e268652f463411cfced4e40cc415aef2800b0ba56c5073012044428cdf03c989569ca0f9972bd

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\2822eb55-bb81-4b2e-86dc-2f33a50a0f76\index-dir\the-real-index
                                                                                                                                    Filesize

                                                                                                                                    72B

                                                                                                                                    MD5

                                                                                                                                    110759fc63b267402dfa3c0193a24f28

                                                                                                                                    SHA1

                                                                                                                                    2cc0b3dee9c78145610809ad1a6cb55855026a2c

                                                                                                                                    SHA256

                                                                                                                                    e78099857095685782ade92aafecec215f8a1b77fa8436daf458d88aab62af4a

                                                                                                                                    SHA512

                                                                                                                                    16fc5e16782ae505b4d2fd36c6fa88f991f26857c603667806712fe96e21ea859438595794d31853e59f30584b16c162758802ca879e58cffa324ff8f086df0a

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\2822eb55-bb81-4b2e-86dc-2f33a50a0f76\index-dir\the-real-index~RFe57da33.TMP
                                                                                                                                    Filesize

                                                                                                                                    48B

                                                                                                                                    MD5

                                                                                                                                    bf07332ce51dabf657a8c748aa43199b

                                                                                                                                    SHA1

                                                                                                                                    6a6830642cc0b16bc99938cbc96640ddc0b8358b

                                                                                                                                    SHA256

                                                                                                                                    69ac684f2ac45caeb843c57d6767afd6269780fbe094ca84fbf6b64cf67e514d

                                                                                                                                    SHA512

                                                                                                                                    8d6498da890e1cfc325acb1ec3a587ed5153426f244f75b1b9e15544a0c4d1f0d7d06a8c9c9353013e15f5ef59032aadc125190e3246cee9bb462647c99b9f91

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\f7bfc239-d6c6-411a-be2d-a203da335b6a\index-dir\the-real-index
                                                                                                                                    Filesize

                                                                                                                                    456B

                                                                                                                                    MD5

                                                                                                                                    02fcad021bef8b05a572a5678a26414d

                                                                                                                                    SHA1

                                                                                                                                    56e8c33a29e38cc5d81754ec5616c7bec65692ba

                                                                                                                                    SHA256

                                                                                                                                    474079cb4a5c8cb39110bce94148bfb670d8df8e8564fb72f49795496a715ee4

                                                                                                                                    SHA512

                                                                                                                                    9322e881e09e3d9b34a480578a0b08476ca98baf748bca60c2f88f4dd0f803bb0f83eca2975840ee00383daf31becf5c81a0954f2f39df1ae4535b33272f18f1

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\f7bfc239-d6c6-411a-be2d-a203da335b6a\index-dir\the-real-index~RFe57dcb4.TMP
                                                                                                                                    Filesize

                                                                                                                                    48B

                                                                                                                                    MD5

                                                                                                                                    732525fb27d91811c6bbf319a65ea31e

                                                                                                                                    SHA1

                                                                                                                                    d50eec90163ceb79aeb684011eecd3046445d902

                                                                                                                                    SHA256

                                                                                                                                    9ba29bcbf58602406bc58963c537eb2e1079cef975086b688b895d339f81d284

                                                                                                                                    SHA512

                                                                                                                                    2d9ec0fda6c446e7079d5c2b97defecc72d6ed7e2585455d7096edaad61b000092c5e85e18e52874716908a1685b0d82589cf752bdf262fd18dd8d3ae335b619

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
                                                                                                                                    Filesize

                                                                                                                                    197B

                                                                                                                                    MD5

                                                                                                                                    0ba50d90ef2ad32b80eba036cb5eaad3

                                                                                                                                    SHA1

                                                                                                                                    59333fb08118d85c4e08fe5b466820a2ebdbd1d7

                                                                                                                                    SHA256

                                                                                                                                    3f88be847d7d7428c4b3e1d06dbbdb5393931d621f65ccd6a9bf720ad26505f2

                                                                                                                                    SHA512

                                                                                                                                    12fa87096a96980087e3ee14df5acee0c242b967868f607473491fa2c5d9fe23d8358054e99b4afb76847f6b8e3587632a2a065b3d8c0701f1a2ca1a0637c82c

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
                                                                                                                                    Filesize

                                                                                                                                    193B

                                                                                                                                    MD5

                                                                                                                                    7e251453376199b29b6a0323fff9aae7

                                                                                                                                    SHA1

                                                                                                                                    b7895a9ade030388ae908353de5ea4b7caf84576

                                                                                                                                    SHA256

                                                                                                                                    b5a84c226daefc572e584e71e556d4e9a88f5cbbe5de661872185142b544f3af

                                                                                                                                    SHA512

                                                                                                                                    1043ea281e20b295899e0696b78ad8be4b888564ef69615b99ad5f1ce7efa41a5c0814d1e7079eb0da71f67c7f005b002406c261f73cfe1353695e956282b159

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe578bc5.TMP
                                                                                                                                    Filesize

                                                                                                                                    131B

                                                                                                                                    MD5

                                                                                                                                    9c1647fe109c8aaab7ec5c3f7e3b63c0

                                                                                                                                    SHA1

                                                                                                                                    a49f93b1abfa9a8df1a9b565e9542eea369e61c5

                                                                                                                                    SHA256

                                                                                                                                    ba2f51e04423ee22305737ca41120f5d0969f90356341dee86473193c9131001

                                                                                                                                    SHA512

                                                                                                                                    fa945b1108877e48942ef3d132d81f1946ca91a9cb951b4c5d94f7ec4fa086131d45ecf7911ae7a42e51da38b91122ff51230d137364fdb7d1b280f9209b80c8

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                    Filesize

                                                                                                                                    264B

                                                                                                                                    MD5

                                                                                                                                    3e37d0cd69e9704d1a7cb32dd4fadb90

                                                                                                                                    SHA1

                                                                                                                                    0f9b19fb6fee3d257b80c366f54a897c0cee6dd5

                                                                                                                                    SHA256

                                                                                                                                    8deb48d52d0d632ea81bbfa11b28a5a59e8e7004e2c51f00aa0dffc4c79b0fe6

                                                                                                                                    SHA512

                                                                                                                                    34ea85682b11f9cbca8ee767d1c3fc6b78933277abcdc2003b86fa5dd89799f3089f66d812c17d09b9dfb5ff407081c475b930b69786a119ca329190d43079d8

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57d978.TMP
                                                                                                                                    Filesize

                                                                                                                                    48B

                                                                                                                                    MD5

                                                                                                                                    4fa9d2eef10d660041def7de0bb18a79

                                                                                                                                    SHA1

                                                                                                                                    e09f2f3876f2b039d1b6af2163df5067c7a4d237

                                                                                                                                    SHA256

                                                                                                                                    282c3c72096b53ab270c63319727345b381dc7d568e539f9841b223cb231fdcd

                                                                                                                                    SHA512

                                                                                                                                    194f1707e4a003f623c7fc1912283a56c087134298314f2b8e9daa1812bea7dfb9a83dd0b325a2274f8e96a1f857de827d5aa82d0a296062df5f658cca7d943a

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                    Filesize

                                                                                                                                    4KB

                                                                                                                                    MD5

                                                                                                                                    dd37b7e36e6e18d55100fd5f2a63f9b5

                                                                                                                                    SHA1

                                                                                                                                    553ace13d0a8b93ab2fd2f6cda2165f1c6978a5f

                                                                                                                                    SHA256

                                                                                                                                    7fc556c7745c891bfa6351c790c8d2c144060d0a123ee70d6ee17abf4e8c9779

                                                                                                                                    SHA512

                                                                                                                                    15bb6884404f1b4cdfe5d69251777a8159be979fac225395b3eae3e1e88af1d187136767b4b04eb20c8eb7bf9acfb1080031c068c6a9022867b7e1e6d9efd569

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
                                                                                                                                    Filesize

                                                                                                                                    1KB

                                                                                                                                    MD5

                                                                                                                                    cca20673fee84c9c68fcad417cd0ccc6

                                                                                                                                    SHA1

                                                                                                                                    a6206d4fc1ca7a4811f2534a3c96e3777f489769

                                                                                                                                    SHA256

                                                                                                                                    003ca558bf6f9329956947a4fcbf20294ed552bd051476433a9d4d204ba47874

                                                                                                                                    SHA512

                                                                                                                                    5f8428cc3529c9d6593f22cc33e7f25d141cbc41126d764f0369ce78a4df41b27144394704a5cbc67ee293da02863355339cdafb45615543a083faf949f313ff

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    30KB

                                                                                                                                    MD5

                                                                                                                                    44ea3215972868b2755d75927f49b56a

                                                                                                                                    SHA1

                                                                                                                                    2256cf61f00a6d9273e7a5fd4d07a17806a99fb2

                                                                                                                                    SHA256

                                                                                                                                    1f2788725956be55e3e071ffc5a294bc8266cc7d1b6a60d82194962f9f5a1dfc

                                                                                                                                    SHA512

                                                                                                                                    2b9dca1a36201b8e0783cc868cdd1e804e748275185b9c3be0558021b168b8d6a79eb92f835c84f45b6410cae98f4db903b5dc72259f8bc1f2ab6d6feae8d40b

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    6KB

                                                                                                                                    MD5

                                                                                                                                    0aaf4e649bfeb74e70b4a15fd5be04e2

                                                                                                                                    SHA1

                                                                                                                                    51af372ed2feb06a0b7dd9da8343e477114e32c5

                                                                                                                                    SHA256

                                                                                                                                    5f3b42bc3ce8271505a0422ce25ce7e94a017e2bde1871b08bc7fb80e8cb060e

                                                                                                                                    SHA512

                                                                                                                                    053c28649ea7caece7ad97c1f5834691bb36ed89175f32bccf2bc307b5168b63876153917052bdffaffb1843fc560dab635a853faea7ee8dade9e0ca531ec759

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    Filesize

                                                                                                                                    7KB

                                                                                                                                    MD5

                                                                                                                                    861f773bab4b00a0580d9c5de780aeee

                                                                                                                                    SHA1

                                                                                                                                    6ff74db39b551ab41a62d751af30dbc3825e26b8

                                                                                                                                    SHA256

                                                                                                                                    9f8209f3c8b02680c033518fa707dddbc50c0853c3789a435c931baf8bb95f9f

                                                                                                                                    SHA512

                                                                                                                                    f6cdf435f9ba8f52f6cde754a56e20888981c4af0c138a98faeed9b3f5b01d691b6ed0d9e28d6a42d4f9aa685c439209063f4c0943bcc8d3a31bebcc9176718b

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WRLUCZ87\www.bing[1].xml
                                                                                                                                    Filesize

                                                                                                                                    326B

                                                                                                                                    MD5

                                                                                                                                    c806e0020f183f6fd64083c192a28ddb

                                                                                                                                    SHA1

                                                                                                                                    3f3adc06c5597b2a1107739962a4331afd4138b5

                                                                                                                                    SHA256

                                                                                                                                    482036b30081632eee55b68f58cb9670bc66559b1d3ae2d71a8fedf49f4d7123

                                                                                                                                    SHA512

                                                                                                                                    b7c5ebc813f026c323deebba1697c65107aaa50dab2a5706792823894f6ea0a92f0342f6dbd9b164c1d97cb3df1aa9e70430c63ae84cae252d3c94d20c881421

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\WRLUCZ87\www.bing[1].xml
                                                                                                                                    Filesize

                                                                                                                                    15KB

                                                                                                                                    MD5

                                                                                                                                    745db9664c36d36ab3c49cc5632ebd9a

                                                                                                                                    SHA1

                                                                                                                                    08c4992f114d8a46d705031e0162c5c0bd9db4e6

                                                                                                                                    SHA256

                                                                                                                                    88e9e0ea44685c2dbf3ea2193e28f83435719cf2f7c3cdc49cef362f25e85dce

                                                                                                                                    SHA512

                                                                                                                                    43f7a595bab5c5822870cb8cb8f23777fab3494a8bf0d9d554709c73ceea5ec1fd7fd0c87a7c1f27e908691badb3875ad92461116629c947c070d71db29fca6f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\08ac4356-a0c7-473e-844d-11c10aa97101.tmp
                                                                                                                                    Filesize

                                                                                                                                    10KB

                                                                                                                                    MD5

                                                                                                                                    78e47dda17341bed7be45dccfd89ac87

                                                                                                                                    SHA1

                                                                                                                                    1afde30e46997452d11e4a2adbbf35cce7a1404f

                                                                                                                                    SHA256

                                                                                                                                    67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

                                                                                                                                    SHA512

                                                                                                                                    9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\83aef58c-c8a6-48a6-af8b-4f88d1565da9.tmp
                                                                                                                                    Filesize

                                                                                                                                    1B

                                                                                                                                    MD5

                                                                                                                                    5058f1af8388633f609cadb75a75dc9d

                                                                                                                                    SHA1

                                                                                                                                    3a52ce780950d4d969792a2559cd519d7ee8c727

                                                                                                                                    SHA256

                                                                                                                                    cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

                                                                                                                                    SHA512

                                                                                                                                    0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\TCD7566.tmp\sist02.xsl
                                                                                                                                    Filesize

                                                                                                                                    245KB

                                                                                                                                    MD5

                                                                                                                                    f883b260a8d67082ea895c14bf56dd56

                                                                                                                                    SHA1

                                                                                                                                    7954565c1f243d46ad3b1e2f1baf3281451fc14b

                                                                                                                                    SHA256

                                                                                                                                    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

                                                                                                                                    SHA512

                                                                                                                                    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir1244_1956386659\2562d78b-2e58-4a01-aaa0-0bbc8b4a3e95.tmp
                                                                                                                                    Filesize

                                                                                                                                    152KB

                                                                                                                                    MD5

                                                                                                                                    dd9bf8448d3ddcfd067967f01e8bf6d7

                                                                                                                                    SHA1

                                                                                                                                    d7829475b2bd6a3baa8fabfaf39af57c6439b35e

                                                                                                                                    SHA256

                                                                                                                                    fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

                                                                                                                                    SHA512

                                                                                                                                    65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    51e8bfc708e6a5ccc1a93ab991a258ec

                                                                                                                                    SHA1

                                                                                                                                    1b48f46c17c4ed22eb7d66711b453bb10fa74ac2

                                                                                                                                    SHA256

                                                                                                                                    e7627d4e80e9b0439397ba353088b498a64fc8502040643c95702073bb57055f

                                                                                                                                    SHA512

                                                                                                                                    d1419758a39b37424da42862bcb2d11eaca631e16f33a553a7f84bd3c66027840a080e86ec69d9e5f3d543c7d1ceb503ad17248b456cb7ef8671c62b502b7d4f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms
                                                                                                                                    Filesize

                                                                                                                                    12KB

                                                                                                                                    MD5

                                                                                                                                    6068d9a07a150ecf0cb9daf4760cbda7

                                                                                                                                    SHA1

                                                                                                                                    91c218fb163ce141302e422b34ddeee77f4fd84e

                                                                                                                                    SHA256

                                                                                                                                    f879ee6413edc2d2e3dd6b698a0bc52fbc50a473f4ac429ce8921f5a64b40adb

                                                                                                                                    SHA512

                                                                                                                                    f5ff927f593bc17c4bd79d85d693e72759ba9224e84758a67ca9a52da825ddf8aec88e59ce47b6bfa3f4e4c178b07aa4d3acff544d7707793142efeccffe33cd

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.jpg
                                                                                                                                    Filesize

                                                                                                                                    81KB

                                                                                                                                    MD5

                                                                                                                                    205a9681209bd58cd433bcbb8faf96df

                                                                                                                                    SHA1

                                                                                                                                    792213c4a115cdb4e8a8cdfbf8d01cd61fc7c11b

                                                                                                                                    SHA256

                                                                                                                                    bcf48a3f1935662314756ca6b07083b14bde67bc3fce05406e65fe2fbd26aa6a

                                                                                                                                    SHA512

                                                                                                                                    caa62868935766c6ae3291c09fed22e9e65f3b4e3f8de9c3108b6c3ac506758754fa8941356e41d7c4201735778f5bc8b704b01f32958a19af72ed8a3c4e9c7a

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                                                    Filesize

                                                                                                                                    45KB

                                                                                                                                    MD5

                                                                                                                                    b019d0ac7ca5013efbc9714eba41bd18

                                                                                                                                    SHA1

                                                                                                                                    5c91cb8314319dc24b667be28793ff017ca3d155

                                                                                                                                    SHA256

                                                                                                                                    e4e9895d943bdb73b7a3831a01780d2e910cfc4bbe578745644793eb907d7484

                                                                                                                                    SHA512

                                                                                                                                    f834673282dc2023cee6f3fd3424d68ac65cc0ed61e5ef65c1c7b5a805443b08c476e2aeec8a1b4a950f0ea8cf87b14d82403524595fed21829f270d908adf11

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
                                                                                                                                    Filesize

                                                                                                                                    12.0MB

                                                                                                                                    MD5

                                                                                                                                    330ee0c81fe82eecb58a494f3885a725

                                                                                                                                    SHA1

                                                                                                                                    de18b557543d7160ae6375b8927fdacd383fd522

                                                                                                                                    SHA256

                                                                                                                                    ec32aea43c20ab0414cf1ef51673904c01160db68dc0cad439126346d235c941

                                                                                                                                    SHA512

                                                                                                                                    d20636b82539fc6f8b5731e385797b2354de88fdfaadfe1bd4a7b7cb1b8a41eb3751e094cbfca701148e651a3cbb59370f2f2c446070dfe7f1bf5933f4930099

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\AppData\Roaming\vlc\ml.xspf.tmp3804
                                                                                                                                    Filesize

                                                                                                                                    304B

                                                                                                                                    MD5

                                                                                                                                    781602441469750c3219c8c38b515ed4

                                                                                                                                    SHA1

                                                                                                                                    e885acd1cbd0b897ebcedbb145bef1c330f80595

                                                                                                                                    SHA256

                                                                                                                                    81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

                                                                                                                                    SHA512

                                                                                                                                    2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master.zip:Zone.Identifier
                                                                                                                                    Filesize

                                                                                                                                    26B

                                                                                                                                    MD5

                                                                                                                                    fbccf14d504b7b2dbcb5a5bda75bd93b

                                                                                                                                    SHA1

                                                                                                                                    d59fc84cdd5217c6cf74785703655f78da6b582b

                                                                                                                                    SHA256

                                                                                                                                    eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                                                                                                                    SHA512

                                                                                                                                    aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                    Filesize

                                                                                                                                    933B

                                                                                                                                    MD5

                                                                                                                                    f97d2e6f8d820dbd3b66f21137de4f09

                                                                                                                                    SHA1

                                                                                                                                    596799b75b5d60aa9cd45646f68e9c0bd06df252

                                                                                                                                    SHA256

                                                                                                                                    0e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a

                                                                                                                                    SHA512

                                                                                                                                    efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\@[email protected]
                                                                                                                                    Filesize

                                                                                                                                    240KB

                                                                                                                                    MD5

                                                                                                                                    7bf2b57f2a205768755c07f238fb32cc

                                                                                                                                    SHA1

                                                                                                                                    45356a9dd616ed7161a3b9192e2f318d0ab5ad10

                                                                                                                                    SHA256

                                                                                                                                    b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

                                                                                                                                    SHA512

                                                                                                                                    91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\TaskData\Tor\tor.exe
                                                                                                                                    Filesize

                                                                                                                                    3.0MB

                                                                                                                                    MD5

                                                                                                                                    fe7eb54691ad6e6af77f8a9a0b6de26d

                                                                                                                                    SHA1

                                                                                                                                    53912d33bec3375153b7e4e68b78d66dab62671a

                                                                                                                                    SHA256

                                                                                                                                    e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

                                                                                                                                    SHA512

                                                                                                                                    8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\b.wnry
                                                                                                                                    Filesize

                                                                                                                                    1.4MB

                                                                                                                                    MD5

                                                                                                                                    c17170262312f3be7027bc2ca825bf0c

                                                                                                                                    SHA1

                                                                                                                                    f19eceda82973239a1fdc5826bce7691e5dcb4fb

                                                                                                                                    SHA256

                                                                                                                                    d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

                                                                                                                                    SHA512

                                                                                                                                    c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\c.wnry
                                                                                                                                    Filesize

                                                                                                                                    780B

                                                                                                                                    MD5

                                                                                                                                    383a85eab6ecda319bfddd82416fc6c2

                                                                                                                                    SHA1

                                                                                                                                    2a9324e1d02c3e41582bf5370043d8afeb02ba6f

                                                                                                                                    SHA256

                                                                                                                                    079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21

                                                                                                                                    SHA512

                                                                                                                                    c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_bulgarian.wnry
                                                                                                                                    Filesize

                                                                                                                                    46KB

                                                                                                                                    MD5

                                                                                                                                    95673b0f968c0f55b32204361940d184

                                                                                                                                    SHA1

                                                                                                                                    81e427d15a1a826b93e91c3d2fa65221c8ca9cff

                                                                                                                                    SHA256

                                                                                                                                    40b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd

                                                                                                                                    SHA512

                                                                                                                                    7601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_chinese (simplified).wnry
                                                                                                                                    Filesize

                                                                                                                                    53KB

                                                                                                                                    MD5

                                                                                                                                    0252d45ca21c8e43c9742285c48e91ad

                                                                                                                                    SHA1

                                                                                                                                    5c14551d2736eef3a1c1970cc492206e531703c1

                                                                                                                                    SHA256

                                                                                                                                    845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a

                                                                                                                                    SHA512

                                                                                                                                    1bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_chinese (traditional).wnry
                                                                                                                                    Filesize

                                                                                                                                    77KB

                                                                                                                                    MD5

                                                                                                                                    2efc3690d67cd073a9406a25005f7cea

                                                                                                                                    SHA1

                                                                                                                                    52c07f98870eabace6ec370b7eb562751e8067e9

                                                                                                                                    SHA256

                                                                                                                                    5c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a

                                                                                                                                    SHA512

                                                                                                                                    0766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_croatian.wnry
                                                                                                                                    Filesize

                                                                                                                                    38KB

                                                                                                                                    MD5

                                                                                                                                    17194003fa70ce477326ce2f6deeb270

                                                                                                                                    SHA1

                                                                                                                                    e325988f68d327743926ea317abb9882f347fa73

                                                                                                                                    SHA256

                                                                                                                                    3f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171

                                                                                                                                    SHA512

                                                                                                                                    dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_czech.wnry
                                                                                                                                    Filesize

                                                                                                                                    39KB

                                                                                                                                    MD5

                                                                                                                                    537efeecdfa94cc421e58fd82a58ba9e

                                                                                                                                    SHA1

                                                                                                                                    3609456e16bc16ba447979f3aa69221290ec17d0

                                                                                                                                    SHA256

                                                                                                                                    5afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150

                                                                                                                                    SHA512

                                                                                                                                    e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_danish.wnry
                                                                                                                                    Filesize

                                                                                                                                    36KB

                                                                                                                                    MD5

                                                                                                                                    2c5a3b81d5c4715b7bea01033367fcb5

                                                                                                                                    SHA1

                                                                                                                                    b548b45da8463e17199daafd34c23591f94e82cd

                                                                                                                                    SHA256

                                                                                                                                    a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6

                                                                                                                                    SHA512

                                                                                                                                    490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_dutch.wnry
                                                                                                                                    Filesize

                                                                                                                                    36KB

                                                                                                                                    MD5

                                                                                                                                    7a8d499407c6a647c03c4471a67eaad7

                                                                                                                                    SHA1

                                                                                                                                    d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b

                                                                                                                                    SHA256

                                                                                                                                    2c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c

                                                                                                                                    SHA512

                                                                                                                                    608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_english.wnry
                                                                                                                                    Filesize

                                                                                                                                    36KB

                                                                                                                                    MD5

                                                                                                                                    fe68c2dc0d2419b38f44d83f2fcf232e

                                                                                                                                    SHA1

                                                                                                                                    6c6e49949957215aa2f3dfb72207d249adf36283

                                                                                                                                    SHA256

                                                                                                                                    26fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5

                                                                                                                                    SHA512

                                                                                                                                    941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_filipino.wnry
                                                                                                                                    Filesize

                                                                                                                                    36KB

                                                                                                                                    MD5

                                                                                                                                    08b9e69b57e4c9b966664f8e1c27ab09

                                                                                                                                    SHA1

                                                                                                                                    2da1025bbbfb3cd308070765fc0893a48e5a85fa

                                                                                                                                    SHA256

                                                                                                                                    d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324

                                                                                                                                    SHA512

                                                                                                                                    966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_finnish.wnry
                                                                                                                                    Filesize

                                                                                                                                    37KB

                                                                                                                                    MD5

                                                                                                                                    35c2f97eea8819b1caebd23fee732d8f

                                                                                                                                    SHA1

                                                                                                                                    e354d1cc43d6a39d9732adea5d3b0f57284255d2

                                                                                                                                    SHA256

                                                                                                                                    1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

                                                                                                                                    SHA512

                                                                                                                                    908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_french.wnry
                                                                                                                                    Filesize

                                                                                                                                    37KB

                                                                                                                                    MD5

                                                                                                                                    4e57113a6bf6b88fdd32782a4a381274

                                                                                                                                    SHA1

                                                                                                                                    0fccbc91f0f94453d91670c6794f71348711061d

                                                                                                                                    SHA256

                                                                                                                                    9bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc

                                                                                                                                    SHA512

                                                                                                                                    4f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_german.wnry
                                                                                                                                    Filesize

                                                                                                                                    36KB

                                                                                                                                    MD5

                                                                                                                                    3d59bbb5553fe03a89f817819540f469

                                                                                                                                    SHA1

                                                                                                                                    26781d4b06ff704800b463d0f1fca3afd923a9fe

                                                                                                                                    SHA256

                                                                                                                                    2adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61

                                                                                                                                    SHA512

                                                                                                                                    95719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac

                                                                                                                                    Download Submit

                                                                                                                                  • C:\Users\Admin\Downloads\MalwareDatabase-master\MalwareDatabase-master\ransomwares\WannaCrypt0r\msg\m_greek.wnry
                                                                                                                                    Filesize

                                                                                                                                    47KB

                                                                                                                                    MD5

                                                                                                                                    fb4e8718fea95bb7479727fde80cb424

                                                                                                                                    SHA1

                                                                                                                                    1088c7653cba385fe994e9ae34a6595898f20aeb

                                                                                                                                    SHA256

                                                                                                                                    e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9

                                                                                                                                    SHA512

                                                                                                                                    24db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb

                                                                                                                                    Download Submit

                                                                                                                                  • memory/1200-997-0x00007FFFF9920000-0x00007FFFF9BD6000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.7MB

                                                                                                                                    Download

                                                                                                                                  • memory/1200-995-0x00007FF63F2E0000-0x00007FF63F3D8000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    992KB

                                                                                                                                    Download

                                                                                                                                  • memory/1200-998-0x00007FFFF73E0000-0x00007FFFF8490000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    16.7MB

                                                                                                                                    Download

                                                                                                                                  • memory/1200-996-0x00007FF80C600000-0x00007FF80C634000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    208KB

                                                                                                                                    Download

                                                                                                                                  • memory/1776-3199-0x0000025F68150000-0x0000025F68170000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                    Download

                                                                                                                                  • memory/1776-3399-0x0000025F6BC00000-0x0000025F6BD00000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1024KB

                                                                                                                                    Download

                                                                                                                                  • memory/1776-3420-0x0000025F6C1E0000-0x0000025F6C2E0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1024KB

                                                                                                                                    Download

                                                                                                                                  • memory/1776-3197-0x0000025F67900000-0x0000025F67A00000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1024KB

                                                                                                                                    Download

                                                                                                                                  • memory/1776-3198-0x0000025F682F0000-0x0000025F683F0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1024KB

                                                                                                                                    Download

                                                                                                                                  • memory/1776-3356-0x0000025F67900000-0x0000025F67A00000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1024KB

                                                                                                                                    Download

                                                                                                                                  • memory/1776-3091-0x0000025F34290000-0x0000025F34390000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1024KB

                                                                                                                                    Download

                                                                                                                                  • memory/1776-3196-0x0000025F562B0000-0x0000025F562D0000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    128KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4193-0x0000000074160000-0x0000000074182000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4250-0x0000000000F90000-0x000000000128E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.0MB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4213-0x0000000074220000-0x0000000074297000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    476KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4212-0x00000000742A0000-0x00000000742BC000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    112KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4210-0x0000000000F90000-0x000000000128E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.0MB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4211-0x00000000742C0000-0x0000000074342000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    520KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4216-0x0000000073F40000-0x000000007415C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4214-0x0000000074190000-0x0000000074212000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    520KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4192-0x0000000074190000-0x0000000074212000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    520KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4215-0x0000000074160000-0x0000000074182000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    136KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4191-0x0000000073F40000-0x000000007415C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.1MB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4194-0x0000000000F90000-0x000000000128E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.0MB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4190-0x00000000742C0000-0x0000000074342000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    520KB

                                                                                                                                    Download

                                                                                                                                  • memory/1908-4314-0x0000000000F90000-0x000000000128E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    3.0MB

                                                                                                                                    Download

                                                                                                                                  • memory/3804-4313-0x00007FFFF9050000-0x00007FFFF915E000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    1.1MB

                                                                                                                                    Download

                                                                                                                                  • memory/3804-4312-0x00007FFFF9E00000-0x00007FFFFA0B6000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    2.7MB

                                                                                                                                    Download

                                                                                                                                  • memory/3804-4310-0x00007FF7E7590000-0x00007FF7E7688000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    992KB

                                                                                                                                    Download

                                                                                                                                  • memory/3804-4311-0x00007FF8047B0000-0x00007FF8047E4000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    208KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4271-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4281-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4279-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4278-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4283-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4282-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4284-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4285-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4270-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4280-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4277-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4276-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4273-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4275-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4274-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4708-4272-0x0000000004E20000-0x0000000004E30000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download

                                                                                                                                  • memory/4744-1954-0x0000000010000000-0x0000000010010000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    64KB

                                                                                                                                    Download