hxxps://r2[.]privateuser[.]xyz/launcher/Rewind_0[.]1[.]4_x64-setup[.]exe

Analysis

user interaction
yes
max time kernel
33s
max time network
34s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/07/2026, 21:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://r2.privateuser.xyz/launcher/Rewind_0.1.4_x64-setup.exe
Sample260705-1tk41abx2j

Score

10^/10

defense_evasion discovery persistence ransomware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4152 created 3464	4152	Rewind_0.1.4_x64-setup.exe	57

Downloads MZ/PE file 1 IoCs

flow	pid	Process
21	3688	msedge.exe

Executes dropped EXE 2 IoCs

pid	Process
4152	Rewind_0.1.4_x64-setup.exe
2812	Rewind.exe

Loads dropped DLL 4 IoCs

pid	Process
4152	Rewind_0.1.4_x64-setup.exe
4152	Rewind_0.1.4_x64-setup.exe
4152	Rewind_0.1.4_x64-setup.exe
4152	Rewind_0.1.4_x64-setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Rewind.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rewind_0.1.4_x64-setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3688	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277622059124941"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher\DefaultIcon	Rewind_0.1.4_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Rewind\\Rewind.exe\",0"	Rewind_0.1.4_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Rewind\\Rewind.exe\" \"%1\""	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind\shell\open\command	Rewind.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind\shell	Rewind.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Rewind\\Rewind.exe \"%1\""	Rewind.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4146128427-3460078792-3629963422-1000\{2323559B-ED77-4F88-BCD0-1B8CA479DEB9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://\DefaultIcon	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://\shell\open\command	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher	Rewind_0.1.4_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind\ = "URL:Rewind"	Rewind.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind\URL Protocol	Rewind.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://\URL Protocol	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://\shell\open	Rewind_0.1.4_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Rewind\\Rewind.exe\" \"%1\""	Rewind_0.1.4_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher\URL Protocol	Rewind_0.1.4_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher\ = "URL:mars protocol"	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher\shell\open	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind	Rewind.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://	Rewind_0.1.4_x64-setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://\ = "URL:mars protocol"	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher\shell\open\command	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher\shell	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind\DefaultIcon	Rewind.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Rewind\\Rewind.exe,0"	Rewind.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\Rewind\shell\open	Rewind.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Rewind\\Rewind.exe\",0"	Rewind_0.1.4_x64-setup.exe
Key created	\REGISTRY\USER\S-1-5-21-4146128427-3460078792-3629963422-1000_Classes\rewindlauncher://\shell	Rewind_0.1.4_x64-setup.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4152	Rewind_0.1.4_x64-setup.exe
4152	Rewind_0.1.4_x64-setup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
212	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
2812	Rewind.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 1084	3944	msedge.exe	83
PID 3944 wrote to memory of 3940	3944	msedge.exe	84
PID 3944 wrote to memory of 3688	3944	msedge.exe	85
PID 3944 wrote to memory of 3940	3944	msedge.exe	84
PID 3944 wrote to memory of 3940	3944	msedge.exe	84
PID 3944 wrote to memory of 2336	3944	msedge.exe	86
PID 3944 wrote to memory of 2336	3944	msedge.exe	86
PID 3944 wrote to memory of 5008	3944	msedge.exe	87
PID 3944 wrote to memory of 5008	3944	msedge.exe	87
PID 3944 wrote to memory of 3088	3944	msedge.exe	88
PID 3944 wrote to memory of 5008	3944	msedge.exe	87
PID 3944 wrote to memory of 3088	3944	msedge.exe	88
PID 3944 wrote to memory of 3088	3944	msedge.exe	88
PID 3944 wrote to memory of 4788	3944	msedge.exe	90
PID 3944 wrote to memory of 988	3944	msedge.exe	91
PID 3944 wrote to memory of 4788	3944	msedge.exe	90
PID 3944 wrote to memory of 4788	3944	msedge.exe	90
PID 3944 wrote to memory of 988	3944	msedge.exe	91
PID 3944 wrote to memory of 988	3944	msedge.exe	91
PID 3944 wrote to memory of 3192	3944	msedge.exe	94
PID 3944 wrote to memory of 2292	3944	msedge.exe	95
PID 3944 wrote to memory of 3192	3944	msedge.exe	94
PID 3944 wrote to memory of 2292	3944	msedge.exe	95
PID 3944 wrote to memory of 4912	3944	msedge.exe	96
PID 3944 wrote to memory of 4912	3944	msedge.exe	96
PID 3944 wrote to memory of 4916	3944	msedge.exe	97
PID 3944 wrote to memory of 4916	3944	msedge.exe	97
PID 3944 wrote to memory of 4916	3944	msedge.exe	97
PID 3944 wrote to memory of 4036	3944	msedge.exe	98
PID 3944 wrote to memory of 3628	3944	msedge.exe	99
PID 3944 wrote to memory of 3628	3944	msedge.exe	99
PID 3944 wrote to memory of 4180	3944	msedge.exe	103
PID 3944 wrote to memory of 4152	3944	msedge.exe	104
PID 4152 wrote to memory of 2812	4152	Rewind_0.1.4_x64-setup.exe	113
PID 2812 wrote to memory of 212	2812	Rewind.exe	116
PID 212 wrote to memory of 1220	212	msedgewebview2.exe	117
PID 212 wrote to memory of 3284	212	msedgewebview2.exe	118
PID 212 wrote to memory of 3284	212	msedgewebview2.exe	118
PID 212 wrote to memory of 3284	212	msedgewebview2.exe	118
PID 212 wrote to memory of 1108	212	msedgewebview2.exe	119
PID 212 wrote to memory of 2248	212	msedgewebview2.exe	120
PID 212 wrote to memory of 2248	212	msedgewebview2.exe	120
PID 212 wrote to memory of 5496	212	msedgewebview2.exe	121
PID 212 wrote to memory of 5496	212	msedgewebview2.exe	121
PID 212 wrote to memory of 5496	212	msedgewebview2.exe	121
PID 3944 wrote to memory of 5228	3944	msedge.exe	123
PID 3944 wrote to memory of 5128	3944	msedge.exe	124
PID 3944 wrote to memory of 5152	3944	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r2.privateuser.xyz/launcher/Rewind_0.1.4_x64-setup.exe
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffe5e66c188,0x7ffe5e66c194,0x7ffe5e66c1a0
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,15750242268216621903,9202608900777916605,262144 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,17188038004061879171,12646383983544897406,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
    3⤵
    - Downloads MZ/PE file
    - System Time Discovery
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,2370162295126602668,7379783168303399004,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:2336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,6697981536975120533,8663548483956430767,2097152 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,14013016900843888094,18048129905496818348,2097152 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14945483206177163049,13403668745959899975,2097152 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,16360001402608702420,6879822820710710203,2097152 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,15015999133085792735,15716379949640252291,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
    3⤵
    PID:3192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,16352481980898814387,12675050600777417090,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,12231195378133257231,9058798620519791378,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
    3⤵
    PID:4912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5776,i,9314938583277088961,11854098294901761390,2097152 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,16447629662706312945,5375322241347421027,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16214144684096663364,10713523100319060400,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:8
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1519077762101747758,16769042849263995169,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,1519077762101747758,16769042849263995169,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
    3⤵
    PID:4180
- - C:\Users\Admin\Downloads\Rewind_0.1.4_x64-setup.exe
    "C:\Users\Admin\Downloads\Rewind_0.1.4_x64-setup.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,5135898178832126453,13740394656118379595,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,17448168437325364249,3757259572945165130,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,13039338729018526809,14643729379583554561,524288 --field-trial-handle=2300,i,13675584913568698406,8370274180296257938,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
    3⤵
    PID:5152
- C:\Users\Admin\AppData\Local\Rewind\Rewind.exe
  "C:\Users\Admin\AppData\Local\Rewind\Rewind.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Rewind.exe --webview-exe-version=0.1.4 --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2812.4892.14488132611255113679
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\mars\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\mars\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x1a8,0x1ac,0x1b0,0x184,0xa8,0x7ffe4e7cb078,0x7ffe4e7cb084,0x7ffe4e7cb090
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=Rewind.exe --webview-exe-version=0.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1840,i,4042926665782899561,11869527695114753214,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:2
      4⤵
      PID:3284
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=Rewind.exe --webview-exe-version=0.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2108,i,4042926665782899561,11869527695114753214,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:3
      4⤵
      PID:1108
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=Rewind.exe --webview-exe-version=0.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2164,i,4042926665782899561,11869527695114753214,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
      4⤵
      PID:2248
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\mars\EBWebView" --webview-exe-name=Rewind.exe --webview-exe-version=0.1.4 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3620,i,4042926665782899561,11869527695114753214,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e51b9bee3c2dbb63afcbacc2cde944a53371e66aaf1c8ba0bf71c7ee6eab83a5
MD5 2857cf1b0f1c8c30a6b756a34a37a836
SHA1 b21564c162ba15d8314ad459931f7f7c36b82ddb
SHA512 9fbd8c2a41b37b8a8425570de1371b59602556a9f89dcecaf471ea286b3538f518e368873fcf7b34ac36d9a7de7577953a1abe80c4995e05e1202c1b270d8dab
TLSH
T1F9D012232A5DB011FB695274A812CB00173655A024868711E211C49C96741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7a531d1df9cdae01b650e532ebd4a8c9a4289931e89fb896753dce715d03331d
MD5 e993dcf44300205328a008fa868eaab8
SHA1 005ea0762927bd4df122a5932c9a47e268573e57
SHA512 021dc142847ba30397366fece985ced0649c66fc9ddfa58b99261463107dce9ca4fc43a79aa0b2985989883dd5a6644c2fe5b1c87d24a8455123f7d724943ff2
TLSH
T1D6D012232A9DB411FB695274A812CB00173655A024868711E211C49C86741D862D7587
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4d7431c6a1922c7b26cf872ab5010c30b2700cfcf1b4eefe03e6ef008e913d8b
MD5 8415459f329bdc888245de4343b3421c
SHA1 45e75bdf1863cbdb6c462de8e66a16da2f7b23ec
SHA512 6c6107e41c9cbf1290c02dd0c33bbadfcc7f1fdcf23ec4087bc79803bfadefeb923a8215583b69f582a3d0bc3d128cafff0ceefd62cf713d3251e21b3a6aedfc
TLSH
T1E77171D2C5774DE0D793C23293D20289B8BF8BF3C957AEC6139058357B1B7114419A89
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587c11.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587c11.TMP
Size 3KB
SHA256 3842908136a1f04f1fbb601026d50e5dc3b37e78c90570aa215132ba018d9fba
MD5 e50b31179a0f14a593851be680b6445d
SHA1 d6fd0dbf599f5a79d66b736aae6529576baf76ed
SHA512 026e5ef8a397e6abf27da7ee7e3bfc3a5326d8113c6bf24c37329de6031792131e64af41cfcfe5e0529ad2644b82f033bd0197109922b097672a0ab018054b48
TLSH
T1E57191D2C5770DE0D793C13293D20289BCBF8BF3C913AEC613A018317B1B7100419689
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cc38061a572096ff1048d52890d01dc94f14eedc7830b4ee466ac456b17d6f48
MD5 a5f3af45b99f120cfff951535593f6bb
SHA1 64605213c16ef9d6fcaabbb6b21916a08117ddc6
SHA512 5d0db3fc6c3c3133313ca6a3b9091ed86f7ee16d745def54cd3a7102ad955508a56d03d5c304819b2081a19fdc469996cc0eeebf76348d78c51cfd1e8b12f3fe
SSDEEP 192:sxZkRFyM/jK1Ml8M91/ffsf7UiyIdpJHW6+WNGYcDsZXbPzIgrJ:sxZkV11/ffsfwCJHbGg9
TLSH
T11C42FB126B38597BCCDBD209F9557F53D6F91533A2940E44A9FCCA0C05E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3a28ed73f2a5da5292b2a64f1a47a3f7549f086488f1e600ff1c125e3480cd6f
MD5 ba7b54de69723ead381f90ad479a52f7
SHA1 0f019b8ea050ba1c5c96574c44ff67efa885d0a8
SHA512 cc4ce5637a3a21bb88759f3d573bd6a8edeb8f24eefd22afe96af579c3e0f6a76b32eb9464b414d95700f17a5708b0079a6c632d2ef97dc9b47891f35629e00e
SSDEEP 192:sxZkRFyM/jK1Ml8Mj1/ffsL7UiyIdpJHW6+WNGYcDsZXbPzIg56J:sxZkVb1/ffsLwCJHbGg0
TLSH
T13C520B12AB34597BCCDBD209F955BF53D6F90532A2940E44A9FCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 19e56c86e19ee684462cc8abbc5e87dbfa2bf17e43d9e4f7b04803e916fa3430
MD5 bca5f81dba1167680a92916a1708cef3
SHA1 14d8bf3b55dbc05acb7f896bb028553d7555e0c5
SHA512 2307c51e764110c079caf4522668931ecd6c49c10596bec286fb1d67fb9726c2cd3d2bf231afbe379f1cdc12d4b4629f27e3867d54c10971f8df36c183d1c784
SSDEEP 768:BU4RkXUWvssLg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlLBER6roXMQxcfuOB:BU4RkXUWvssLgu1jacTLBWRxcQ/OB
TLSH
T177D20B2B284CCB7E4F845E9CEC26AF966ED802CB97644D5447FA844C03C77EA511B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 ee6cf23bf558f411a6e134c92647df753e813daa87639fd8bb40214ef7736df0
MD5 f6f326d91983f459d2a3e0ba7c712422
SHA1 3f1cc34088586942d0cd29c088fa391bbb8b420c
SHA512 5c9d5e1e7b44a461b92594825c753693d5444f2b25fc52c2e67ea263bbd2fc7cec3cce45abf86d52aaf345a72850fd1515303587513ae98ee168536209e9ebd2
SSDEEP 96:KUQwKl2CSggK5muiwQKRmqGkK3KaqmQKHqhRu/bpLP7z:yLTPr+PnERu/bpLPv
TLSH
T159E121823076069339BD794C926286375F913273311CEAEF77A824560A66E125CFF9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 dd1cd1f4bb55968394370a276c7907ef85b351e4581f59f0b55e8b2ce1aeea30
MD5 9c9a708028af62509ca742ed4a929522
SHA1 7ea345bbf62a690d46e90423c0623aa13a2525a2
SHA512 7ba5d7e5893c29a84d30230456df656feffd92c57fc2acc801bbbe73fc5d17edd23d125b53321cc4e76cd3d5fd45224fb53334459aa22d25e5197610c3292600
SSDEEP 384:JtNn/s3n9SKsNiAG3AwwSdQ4sw2isS9gGnuOObjI9G6w7NN:Jj+9RzICBsS9pnu29ML
TLSH
T148927B369C796C3A4EE39855F487392BAEF4867793C42B0495DCAF0D06DB2AC430A119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cd9bb15f94c25a4b2ca83918d3eaabbb2c386ff13070658868d24a9bef1cef2e
MD5 a61c1de6abc0e91882a72e907f3167c6
SHA1 a5f6dd508cb7633fd88dd953359485b3e17d75eb
SHA512 109104213418cc40c933dfdcc7ac291a5c4aec3b17b1776f718eeaac21a5ea44a9a82ffbba0e4733741ec847c8996e813f66e26df1784c8b45e45818f3594158
SSDEEP 192:lONM6JpdQmiUymEgcQ4sw2isS1sFH0IU6:lONM6jUgcQ4sw2isS1k9U6
TLSH
T16202E735ADB97C7A8EF3AD45F5873B236FA4113BE6906B54DAE81A0C00DB25C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 36689593245142713549d270b5ceb4a54458620f012a7daea9d69f6ead52468f
MD5 186fd4f4589006fc1dc09e2a36b9e407
SHA1 7e2c51083217dc4b14c590d2e3564cc3e4271adc
SHA512 06cc1e6ec4232ce8e3fb21ad16b9e8645ef423967cb72fe05ee057ddcd2ac4d03ac7dd876bbdd0bf333acf66d0f0b173115f32a5a6e46bcf4d63ab93a2b40c2f
SSDEEP 384:1tNn/s3n9SOsNiAG3A/wSdQ4sw2isS9gSnuOObjI9G6w7NN:1j+9lzHCBsS9Nnu29ML
TLSH
T187927B369C796C364EE39855F487392BAEF4867793C43F04A5DCAF0D06DB2AC4306119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 631f4e17e163c533e6bbfc18e484c730529504f500ea829ccb62d16d5079873c
MD5 ec5cc69698e00e71d4f1ccf60e9de2c3
SHA1 64b3574d60d2a913dbbc0f9c7e61e06543174ece
SHA512 5dd4f80014f6f5c0d547fa2fa1615168ab820332434a7121ff76ae93c997b633a5813898e42e1022c124da8e1bb16dd80d3b57ca49b56a35ab252b4025af66d2
SSDEEP 192:UJONT6JpkQmiUykEOcQ4sw2isS9gKoshsoqcU6:yONT6M8OcQ4sw2isS9g37uU6
TLSH
T15B12F93698B8782A5EE3A955F5C73A279EB48227D784BB50D5DC1A0C01EF25C130B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 54744bf6a41bcdffee88be441aba78075f856e586ddf974335e6415992b9a8c6
MD5 496decd49ccee7e919fe33cc062e3145
SHA1 7104016d943a0d7bedbff73e8c4a9507cab2ee60
SHA512 4ca4eabf796193a6e9302a394c72745943ea2187b5bd202245c008ff115287a021ac654f6c1ac1ff5180751b4eab99e46e38f40830969cd1d9a16766ad7a309b
TLSH
T13041D858BAFA1148B3B77E469BF6B86D487AB9272E06D49D10100E4E4663F44CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

Rewind.exe

Path C:\Users\Admin\AppData\Local\Rewind\Rewind.exe
Size 21.2MB
SHA256 16cbf6bd2691d035e3fa604b803a4412079db627c693aff8f8ae6abbe325a751
MD5 faa889641ad1ca39815b730ba8626e8b
SHA1 e3c10e5ab5d52d7767e25bdbdb326a2fcfdbcc4f
SHA512 a6f7d2cc6887e711ea6b3002e1583caa316cf8c6b5c80ae1c515e1cd574918ef672a88f94cdbbf90eb691d71f0438907826a8f4ca854a1ba40d25a071061acef
SSDEEP 393216:NJf/sfivFAPNGRJuBR+UbbM3TpPWNX8f95yrEV:NJnsfivFAPNGRJuBRelWNXcM
TLSH
T10A2728217B5A996CD09AC47483478BB25A3170DB0B35BAFF449496383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nso414C.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nso414C.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nso414C.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis_tauri_utils.dll

Path C:\Users\Admin\AppData\Local\Temp\nso414C.tmp\nsis_tauri_utils.dll
Size 30KB
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 80a09165ded205904f216af27808ddf60c28995429242a07a05558e77cea3648
MD5 efc716aa62464b9f56ccc48d2d55f894
SHA1 b9c7498a8062a88f96afb2592f3e40326ea1cf9f
SHA512 c91d7c732f10bf72eb47eb093a09cba59f480a88d9a4105143b7a23ebadf63f26894d9b0e75985c2d66adef524dfb84727050a224a9272bfe07c1c8718f81fd6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8c8bd164be24b332b0c23145ea95432e754e05fe2c198e22e606471204cea34f
MD5 03c1e3d61fccfbfa52027a14e9ab9690
SHA1 884163ec92fed0a888d855a7b3f9ccebb363e623
SHA512 7607546ef8776411f968fc774704fab0d25beaee83b24058df387868966bc24b5874e3a3502c2fc7542817ab5722704354cf1ade992a91d8cad45097a1cb5533
TLSH
T197D0122277020174C010A0330603620C0900C51B410544065438A92D3B440940F12881
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\mars\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\mars\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\mars\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\mars\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State
Size 16KB
SHA256 bdb9db773dc8868533ccd0bf53d5c317fe3b3f687339012e0481c05ab3514827
MD5 547ffb347d14ab7b66bb8509198bbfc6
SHA1 1a1db2c5b26ad315c52acafc6bca755ed1e18951
SHA512 6e3373222c83ad1f6724713157e05d56131f4dd2d615bea0db5b55afadc0976f88a91538e8594bb00211a215e8425546b7cfa7d1c6a4621cdc25bf5300a3ced5
SSDEEP 384:z4srv+89zHqlDNP9oid6NbJbEe7jA1YKNT:vrv+4UNbdox7jAuKNT
TLSH
T140729E33A57CA7375DF2E844B48A2E0BBF78559691C20BA8D5DD0F8C469F0E92306D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State
Size 1KB
SHA256 a1a0fe888c60f4660fa323d5d194ff8bc1c18e12d15f336c406e6fff6598eb69
MD5 488d6515a7c233a574833dfbe3da696a
SHA1 40c10a4b262d203b7f9143d5ad5bf1fe6a731931
SHA512 ac21ff21e8a242575a6101382666d04773a6ca99ea8c93762f6c7ea9c24430710c7555fd460f1ed3a7e19b85dbb88a73cc6a9a38023d5d86d2dd8cbead9fdf82
TLSH
T10B31B5B3F1A52E766ED1A94272423B9BAD70117791200E1C61ED4F0C02E79BDD729C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State
Size 2KB
SHA256 decfa18e0c5121b2b96d90399cbd91cc719b4271479768788b22eb185de36c5b
MD5 960928b9fe6c317cc63521a12ddb5089
SHA1 c1ad96fab3012eeb9ba3133f04291c6f87446414
SHA512 6b69000fc8bcab565669ef9ae31900da31a639d107d9597353d5e77a64f9744307c40f4319d15b86afcb4fb67a987357f9f0933fa448e10b80548080339a5d43
TLSH
T15A51B873B958AE7B8AF29D447A853F27DD70516296212F7455ED0F0C02DB57D2306C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State
Size 3KB
SHA256 ea430059a011e1d56fb23357930d806579613506c8440b867d748dd62d9cd681
MD5 7f92b7218f8cfb96c45652d2d977c525
SHA1 3ebd5fce5c75b7999866815a3327132632d8397f
SHA512 e3b95a9d8736531fc1e45387591c32d8ba86c6b5b28db968539816f00bbb2077b939f4395c1281ddf43e971db0ef00887dda43e729057a4bcd49735ff9693e8a
TLSH
T173718577A964A92B4EF2ED05B9852F17BAB05133D5913FA8D5ED0F0C02DB6A81301C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe587a0d.TMP

Path C:\Users\Admin\AppData\Local\mars\EBWebView\Local State~RFe587a0d.TMP
Size 1KB
SHA256 a3627a41146e32b3db623c37b7f1cda08c411629af7d4957d3196fa49641a051
MD5 3868d00fcb45375c43ed448391b4af86
SHA1 e914a6719b4271c0874804c7a2ee26d2fb5744c3
SHA512 8722fef0ab8effb07c9fe76e9e16c105a78f7951cd4412edf45ef8ac7a58c3f960be85493ba61b46cea3981d6c78c97a6030da1fd9767fa841ca7ec051787590
TLSH
T179219573E0996E76AED09C41B2427B8B6DA0517791200E1CA1ED470802D78BD972AC33
MD5 SHA1 SHA512 TLSH

Submit Download

Rewind_0.1.4_x64-setup.exe

Path C:\Users\Admin\Downloads\Rewind_0.1.4_x64-setup.exe
Size 5.9MB
SHA256 af5a199fbd87f162ff5aa50632cc6357185cb991e146d8e7b50cf9a7d64b4b73
MD5 500324fdb585fb840dad4a0ef6137124
SHA1 962b16717cc3f54ff328f6fa9c74ce1dd5bdf10f
SHA512 290429fdc327d3ba878b826140594f2751e346d7b4dca21644139dd2a0aefe79b82ee72d2ec59353c1bfaffba481a203cddad999696a480416f1fee5ff905cbf
SSDEEP 98304:n5sGlgg1gRUEVa2TYfXNpFnZyBdOAagGoftwtixKFtmblG/LmokffiHUG5l:n5HEUEQ2MfXLFnc/J7pftwEKYlGa5i9l
TLSH
T1905633089F496EF9DA115D7757BF0AE6CE8D24B2D331068BFF813649523C7640878B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2248-357-0x00007FFE6DEB0000-0x00007FFE6DEB1000-memory.dmp

Download

memory/2248-356-0x00007FFE6D0B0000-0x00007FFE6D0B1000-memory.dmp

Download

memory/3284-290-0x00007FFE6CD40000-0x00007FFE6CD41000-memory.dmp

Download

memory/5496-369-0x00007FFE6CD40000-0x00007FFE6CD41000-memory.dmp

Download